Content
68%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A highly actionable command reference with lean explanations, correct tooling, and a clean section structure including detection signatures and a decision gate. The main weaknesses are significant content duplication (Quick Reference vs. sections, body vs. attack-paths.md) and missing validation checkpoints for batch operations like DCSync.
Suggestions
Remove the 'Quick Reference' section's duplicated commands — either keep only the Quick Reference and drop the repeated commands from each section, or drop the Quick Reference and let each section stand alone.
Deduplicate against references/attack-paths.md: keep SKILL.md as a lean overview (one representative command per technique plus the decision gate) and move the full command matrices and BloodHound query sets to the reference file.
Add explicit validation checkpoints to the technique chains, e.g. `hashcat -m 13100 ... --show` to confirm cracks before pivoting, and verifying obtained credentials with a low-impact authentication before using them for DCSync or lateral movement.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Explanations are lean one-liners that assume Claude's competence (no concept over-teaching), but the "Quick Reference" block duplicates commands repeated verbatim in sections 1–5, and much of the body (BloodHound queries, hashcat modes, ESC1, DCSync, Golden Ticket, delegation commands) is duplicated again in references/attack-paths.md. This matches the score-3 anchor ('mostly efficient but could be tightened') rather than 4, where duplication would be minor. | 3 / 5 |
Actionability | Fully executable, copy-paste-ready commands throughout with exact flags, placeholders, and correct hashcat modes (13100, 18200, 19700), covering the common cases per tool on both Linux and Windows. Matches the score-5 anchor ('fully executable; copy-paste ready; specific examples cover the common cases'). | 5 / 5 |
Workflow Clarity | Sections are logically sequenced (recon → roasting → AD CS → DCSync → ticket forging → delegation) and the Decision Gate gives failure branches, but there are no explicit validation checkpoints for batch operations (e.g., secretsdump -just-dc dumps all hashes) — no step verifies cracked credentials before pivoting and no hashcat --show check. Per the rubric's cap rule for batch operations lacking validation, workflow clarity is capped at 3. | 3 / 5 |
Progressive Disclosure | Well-sectioned body with a clearly signaled, one-level-deep reference (references/attack-paths.md — a real file — with an explicit 'read when' note), matching the score-4 anchor ('good structure; references mostly clear; minor organization gaps'). It falls short of 5 because content is not appropriately split: the inline command detail largely duplicates the reference file instead of the SKILL.md serving as a lean overview of it. | 4 / 5 |
Total | 15 / 20 Passed |