The body is a lean tactical reference that assumes Claude's competence — it never explains what a WAF, EDR, or OPSEC is, and every line carries actionable specifics with only a brief framing aphorism.

Provides concrete, copy-paste-ready commands with real flags ('nuclei -rl', 'nmap -T2 --max-rate', 'ffuf -p延迟', 'unset HISTFILE', 'touch -r', '/dev/shm') rather than pseudocode or vague direction.

The progressive-exposure escalation ('被动侦察→确认无强监控→主动扫描→利用落地') and the IP-bypass validate-then-proceed loop ('正常请求返回黑名单→加XFF头后返回200→后续都带XFF') give explicit checkpoints and a feedback loop for risky batch/covert operations.

A self-contained skill under 50 lines with no external references, organized into clearly labeled themed sections (IP bypass, rate/timing, obfuscation, footprint, anti-forensics, progressive exposure), which the rubric scores 3 for simple skills.

Lists multiple concrete capability areas ('IP黑名单绕过,速率时序,流量混淆,最小足迹,反取证,渐进暴露') rather than vague language, matching the 'lists multiple specific concrete actions' anchor.

Explicitly answers both 'what' (the six capability areas) and 'when' via a present 'Use when...' clause, satisfying the explicit-trigger anchor.

The 'Use when maintaining stealth, bypassing IP bans, or planning covert red-team ops' clause supplies natural English triggers, but the jargon-dense Chinese first half and absence of common variations (e.g. 'evading detection', 'staying undetected') leave coverage incomplete.

Carves a clear OPSEC/red-team stealth niche with distinct triggers unlikely to fire for unrelated skills.