annatchijova·annatchijova/SKILLS/deception-signal-quality/SKILL.md

deception-signal-quality

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Design deception so that a triggered decoy is a true positive by construction — a honeytoken, honeypot, or canary earns its keep only if nothing legitimate ever touches it, which turns "someone touched it" into signal with a near-zero false-positive rate, the inverse of every noisy detection you own. Use whenever deception is being built or evaluated: "let's plant a honeytoken", "set up a honeypot", "canary tokens", "decoy credentials / files / AWS keys", "tripwire", "we deployed a deception grid", "why is our honeypot noisy", "fake admin account to catch attackers". Sibling of detection-engineering (deception is a detection whose benign-twin rate is engineered to zero) and dual-use-behavior-adjudication (its mirror image: a decoy is built to have no legitimate use, so no adjudication is needed); it judges decoy placement and signal quality. It does not run offensive deception against third parties, and never trusts a decoy whose legitimate-access paths were not eliminated first.

• Reads credentials