CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-mailbox-abuse

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access, phishing chains, and token-to-mailbox side effects. Use when the user asks to trace mailbox rules, OAuth consent grants, forwarding or delegate abuse, shared mailbox access, message-trace evidence, or explain how mail artifacts turn into persistence, exfiltration, or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

73

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, well-structured instruction skill that offloads detail to one clearly signaled reference and avoids over-explaining known concepts. Its main weakness is workflow validation: the mailbox-forensic workflow lacks an explicit verify-and-retry checkpoint, capping workflow clarity.

Suggestions

Add an explicit validation checkpoint to the Workflow (e.g., a step 4: 'Verify — reproduce the smallest mail effect; if it does not reproduce, revisit the consent/rule/transport hypothesis before reporting'), so batch/forensic operations have a feedback loop.

Tighten actionability by including one concrete evidence-gathering snippet or example log-query/message-trace correlation, so Claude has an executable anchor rather than only declarative guidance.

Cross-reference the reference file's checklists inline by name (e.g., 'apply the consent checklist from references/mailbox-abuse.md') at the point each workflow stage needs it, making the navigation bidirectional rather than only top-down.

DimensionReasoningScore

Conciseness

The body is lean with no concept tutorials Claude already knows; every line — Quick Start steps, workflow stages, 'What To Preserve' — carries direct instruction and earns its place in context.

5 / 5

Actionability

Concrete, specific guidance throughout ('Identify the principal, mailbox, token or session, consent grant, delegate edge…', 'Keep message IDs, sender or recipient pairs, and timestamps aligned across logs'), but it is instruction-only with no executable commands or log-query syntax, leaving minor gaps.

4 / 5

Workflow Clarity

A clear 3-stage sequenced workflow exists, but for forensic/batch-style mailbox operations there is no explicit validation feedback loop (validate → fix → retry) embedded in the workflow; Quick Start step 5 mentions reproducing an effect but not as a checkpoint with error recovery, so the destructive/batch cap applies.

3 / 5

Progressive Disclosure

Under 50 lines with a single one-level-deep reference that is clearly signaled ('Load `references/mailbox-abuse.md` for the consent checklist, rule checklist, and evidence packaging') and corresponds to a real file, with well-organized sections throughout.

5 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, trigger-rich, and well-scoped: it names specific mailbox-abuse surfaces, gives natural 'Use when…' triggers, and draws a clear downstream boundary against the orchestrator skill. It scores at the top of every dimension with no padding or over-claims.

DimensionReasoningScore

Specificity

Lists multiple concrete surfaces and actions — 'OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access, phishing chains, and token-to-mailbox side effects' — giving comprehensive coverage of the mailbox-abuse domain rather than generic language.

5 / 5

Completeness

Explicitly answers both 'what' (a CTF-sandbox workflow for enterprise mail abuse and the listed surfaces) and 'when' via the concrete 'Use when the user asks to trace…' trigger clause.

5 / 5

Trigger Term Quality

Includes natural analyst-facing phrases such as 'trace mailbox rules,' 'OAuth consent grants,' 'forwarding or delegate abuse,' 'shared mailbox access,' and 'message-trace evidence' that a user would actually say when needing this skill.

5 / 5

Distinctiveness Conflict Risk

Highly niche scope — enterprise mail abuse inside a CTF sandbox — with an explicit boundary ('Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here'), minimizing overlap with generic identity or mail skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.