Content
86%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tightly written, operationally dense audit playbook: it routes signals to specific attack classes, gives deterministic confirmation oracles to prevent false positives, and stays lean throughout. The main gaps are the absence of concrete probe templates for the excessive-agency and privilege-compromise classes and an implicit rather than explicit end-to-end workflow order.
Suggestions
Add a one-line concrete probe example to §2.5 (excessive agency), e.g. a sample instruction that attempts to trigger a send/pay/delete without the confirmation prompt, mirroring the injection payload shown in §2.1.
Add a brief explicit sequencing line (e.g. 'recon tool surface → apply routing table → run attack class → confirm per §4 → record turn sequence') so the end-to-end audit order is stated, not just implied by section order.
In §2.6, name one concrete enumeration technique (e.g. asking the agent to list its available tools or probing a tool name that should be out of role) to match the specificity of §2.2's oracle.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean with no padding — it never explains concepts Claude already knows, and every section carries operational signal (kill rules, a signal-to-move routing table, concrete oracles). The one-line blockquote earns its place by orienting the core attack philosophy (making the agent *do* vs. *say*). | 5 / 5 |
Actionability | Mostly executable guidance: the routing table maps each signal to a specific move, §2.2 gives a deterministic three-step canary oracle ('remember: FLAG=<canary>', identity switch, re-read), and §2.1 includes a concrete injection payload plus an OOB listener path. It falls short of 5 because §2.5 (excessive agency) and §2.6 (privilege compromise) give direction ('Drive a destructive/irreversible action', 'Enumerate what tools exist, then invoke one') without a concrete probe example. | 4 / 5 |
Workflow Clarity | The Quick Kill Checklist plus routing table give a clear decision flow, and §4 supplies explicit validation (deterministic oracles, two identities, recorded turn sequences), so the destructive-operation validation cap does not apply. It is a 4 rather than 5 because the end-to-end sequence (recon → attack selection → confirmation → reporting) is implied by section order rather than explicitly sequenced as a workflow. | 4 / 5 |
Progressive Disclosure | No bundle files exist, and the body is a compact, well-sectioned overview that points to the authoritative ASI table in `skills/llm-redteam/SKILL.md` instead of duplicating it ('Do not re-define it here'). References are one level deep, clearly signaled, and nothing that belongs in a separate file is inlined. | 5 / 5 |
Total | 18 / 20 Passed |