Content
53%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is an exceptionally rich, actionable bug-bounty reference with concrete payloads, bypass tables, and built-in triage/validation rules per class. Its quality failures are structural: a 25k-token monolith with zero progressive disclosure, and a genuine content-integrity defect where sections 25 and 26 are interleaved so that dependency-confusion code blocks and triage rows land inside the padding-oracle class (and vice versa), corrupting both classes' sequences.
Suggestions
Split each of the 26 bug-class sections into its own reference file (e.g. references/classes/idor.md) and keep SKILL.md as a ~100-line index with one-level-deep, clearly signaled pointers — this fixes both the progressive_disclosure failure and most of the token-budget problem.
Repair the interleaved class 25/26 content: move the dependency-confusion 'VULNERABLE/SECURE' bash block back under class 25's Root Cause heading, extract the class-25 rows spliced into class 26's 'Chains That Pay' and 'Triage' blocks, and close the empty code fence at class 25's root cause.
Consolidate the near-duplicate per-class 'Chains That Pay' and 'Triage' tables into a single severity table, and add a short top-level workflow (e.g. recon output → auth state → which classes apply first) so the 26 sections are ordered for an actual hunt rather than only browsable.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Line-for-line it is dense with payloads, commands, and triage tables rather than concept explanations, but at ~1,840 lines (~25k tokens) it carries real redundancy: near-duplicate "Chains That Pay" and "Triage" severity tables per class, some basics Claude already knows ("Any user viewing page executes attacker JS → cookie theft → session hijack"), and the entire 26-class reference loads into context even when one class is needed. This is 'mostly efficient but could be tightened' (anchor 3), not the 4 anchor, because whole sections could be cut or externalized without losing actionable content. | 3 / 5 |
Actionability | The body is overwhelmingly copy-paste ready: ffuf/PadBuster/ysoserial commands, grep patterns, wire-signature tables, working PoC templates (postMessage attacker page, CSS exfil rules, opacity-clickjacking iframe). It is not the 5 anchor because of minor gaps — the class-25 root-cause code block is empty/corrupted and several snippets require placeholder substitution — fitting the score-4 'mostly executable with minor gaps' anchor. | 4 / 5 |
Workflow Clarity | Each class follows a consistent root cause → detection → escalation → triage sequence with genuine validation gates ("Confirm BLIND RCE out-of-band — never trust a 500 alone", ARIN-verify callbacks before submitting, N/A kill rules). But there is no overall workflow ordering the 26 classes for a given hunt, and classes 25 and 26 are physically interleaved — class 25's root-cause code block appears ~95 lines after its heading, spliced inside class 26's sections — breaking sequence in both. That fits anchor 3 (sequence present, checkpoints present per-class but structural gaps) rather than anchor 4's 'minor' gaps. | 3 / 5 |
Progressive Disclosure | The skill is a monolithic 1,842-line SKILL.md with no references/, scripts/, or assets/ bundle at all; all 26 classes, each 50–100 lines of deep reference material (parser internals, CVE lists, per-ecosystem tables), are inlined where they clearly belong in separate per-class reference files. Its cross-references (docs/auth-sessions.md, bughunter/tools/waf_encoder.py, skills/llm-redteam/SKILL.md) point outside the skill's own bundle. This matches the score-2 anchor 'content that clearly belongs in separate files is inlined'; it escapes the 1 anchor only because headers and tables keep it navigable. | 2 / 5 |
Total | 12 / 20 Passed |