
from decepticon4,341
High-volume codebase scanner that shards work, ranks suspicious locations, and promotes a concise set of candidates for deeper analysis.
The Scanner skill performs broad-spectrum, high-volume scans over large codebases to surface suspicious code locations. It shards the codebase deterministically, processes file shards in parallel, and ranks results to produce a small, precise list of candidate locations for downstream analysis.
Use this skill as the first stage in a vulnerability research pipeline where scale and throughput matter: initial triage across 10^4–10^6 files to produce ~20–50 high-quality candidates for the Detector. It's used at scanner-agent startup and when you need an automated, token-efficient sweep.
Designed for autonomous code-analysis agents and pipeline orchestrators (agents capable of running ripgrep-like scans, managing parallel shards, and producing KG nodes). Works best with agents that support structured outputs and simple tooling integrations.
Scanner-overview is a playbook-only skill (no scripts) for the Decepticon vulnerability research pipeline. It instructs an agent to perform broad-spectrum codebase scanning via scan_shard, promote suspicious locations as CANDIDATE nodes, and hand off to a Detector stage. The SKILL.md is well-structured with clear workflow, decision tables, and explicit constraints on what not to do. However, it requires the Decepticon framework's specific tools (scan_shard, kg_add_candidate) and is not usable standalone.
The skill is a well-written orchestration playbook for a niche security research pipeline. No security concerns — all operations are read-only code scanning. The incorrect source_url in the DB record meant the SKILL.md content couldn't be fetched automatically; had to locate it via GitHub API tree traversal.
AD Overview (Decepticon)
Playbook and workflows for Active Directory offensive operations: BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync and LAPS extraction.
APT29 (Cozy Bear) Adversary Emulation Profile
Adversary-emulation profile that maps APT29 (Cozy Bear) ATT&CK TTPs to Decepticon tooling for realistic, cloud- and identity-focused red-team exercises.
Web Recon — Web Application Reconnaissance Hub
Directory, vhost and API enumeration hub with CMS scanning, WAF detection, auth mapping and cookie auditing — a reconnaissance orchestration skillset.
T5 — Model & API Exploitation
Techniques to probe and exploit LLM APIs: rate-limit abuse, token-cost amplification, schema bypass, model-version manipulation, and related probes.
DAO Governance Attack
Techniques and reconnaissance steps for attacking or testing DAO governance: flash-loan voting, delegation hijack, quorum dilution, proposal spam, time-lock byp