Decepticon is an autonomous red-team agent that coordinates AI agents, security tools, sandboxes, and supporting services for authorized cybersecurity assessments. Security researchers and red teams can run it through its Docker stack, cloud service, command-line interface, or Python SDK, with the catalogue entries representing its available skills.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PurpleAILAB/Decepticon --skill clickjackinggit clone --depth 1 https://github.com/PurpleAILAB/DecepticonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/purpleailab/decepticon/clickjacking)<a href="https://agentmods.dev/skills/purpleailab/decepticon/clickjacking"><img src="https://agentmods.dev/badge/skills/purpleailab/decepticon/clickjacking/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/purpleailab/decepticon/clickjacking"><img src="https://agentmods.dev/badge/skills/purpleailab/decepticon/clickjacking.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 22 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Prompt Injection · line 70 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.01451 |
| Opus 5 | $0.00022 | $0.00726 |
| Sonnet 5 | $0.00009 | $0.00290 |
| Haiku 4.5 | $0.00004 | $0.00145 |
Grade A, and why
clickjacking scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -D- -o /dev/null "https://<TARGET>$path" \ How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Clickjacking Playbook
Framing a sensitive UI under an attacker page lets a single victim click trigger
a privileged action (delete account, transfer funds, grant OAuth scope, confirm
2FA). Severity = severity of the framed action. Pages without X-Frame-Options
and without Content-Security-Policy: frame-ancestors are framable.
1. Detection — framing controls
# Inspect headers on every sensitive page (settings, transfer, oauth/consent, delete, admin)
for path in / /account /account/email /account/delete /transfer /oauth/authorize /admin; do
echo "== $path =="
curl -s -D- -o /dev/null "https://<TARGET>$path" \
| grep -iE "x-frame-options|content-security-policy"
done
# Quick "is it framable?" probe — save to disk, open in a browser
cat > /tmp/cj.html <<'EOF'
<!doctype html><title>frame test</title>
<iframe src="https://<TARGET>/account/delete" width="900" height="600"></iframe>
EOF
# If the iframe renders the target UI → framing allowed.
Server-side allow:
- no
X-Frame-Optionsheader and - no
frame-ancestorsdirective inContent-Security-Policy(orframe-ancestors */ overly broad).
2. Misconfig matrix
| Class | Server behaviour | Exploit |
|---|---|---|
| No XFO, no CSP frame-ancestors | full framing allowed | classic overlay |
XFO: ALLOW-FROM only |
ignored by modern browsers | full framing in Chromium/Firefox |
frame-ancestors * |
explicit allow-all | full framing |
frame-ancestors 'self' *.target.com |
trusts every subdomain | host PoC on a takeable subdomain |
Frame-buster JS only (if (top!=self) top.location=self.location) |
client-side defense | sandbox="allow-forms allow-scripts" (no allow-top-navigation) defeats it |
| 204-frame-buster | response replaces self | <iframe csp="sandbox" ...> or pre-empt with onbeforeunload |
| Drag-and-drop sinks | sensitive textarea framable | drag attacker-controlled string onto target form |
| Cursorjacking | custom cursor + offset | misalign visible vs. real pointer |
| Double-clickjacking | first click opens prompt, second confirms | two-stage overlay (Paulos Yibelo 2024) |
| Touch / pointer gestures | mobile swipe consent | overlay with transparent gesture target |
Permissions-Policy missing |
camera/mic in iframe | request perms in nested iframe over consent UI |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 116 lines · 43 tokens per session scan A 0eddaec7f2f7
clickjacking is a skill published in the GitHub repository PurpleAILAB/Decepticon (5,471 stars, last pushed 10d ago), licensed Apache-2.0. It adds 43 tokens to every session and 1,451 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
interactive-dashboard
Interactive web dashboards: stock trackers, sector heatmaps, portfolio monitors — served via preview URL.
inline-widget
Inline HTML widgets: charts, dashboards, data tables rendered directly in the chat via ShowWidget.
api-crud-generator
A code generator that creates standard Next.js API routes and an administration page from Prisma models. Prisma is a tool that describes and accesses an application’s database.
frontend-design
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
landingpage-generator
You are a professional Landing page designer who is very friendly and supportive. Your task is to guide a beginner through planning and designing a landing page or personal portfolio. Follow these instructions.
vibe-ppt
Convert this into a web based slide deck using reveal.js.