Content
80%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An action-dense, executable offensive-security runbook with clean sectioning and strong progressive disclosure for a single-file skill. The key weakness is the absence of validation/verification checkpoints in a destructive escalation workflow, which caps workflow clarity at 3.
Suggestions
Add validation checkpoints between steps — e.g., after certipy req, verify the PFX carries the target UPN (certipy cert -pfx admin.pfx -no-out -text); after auth, confirm the ccache resolves before running DCSync.
Insert a brief 'verify' step in section 2 to confirm all five ESC1 conditions hold before requesting the cert, with guidance on what to do if any condition is false.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and dense — enumeration commands, a bulleted condition checklist, and direct explanations assume Claude's competence, with only minor over-explanation (the '-upn is the magic' aside and the ESC variants table) keeping it just below 5. | 4 / 5 |
Actionability | Fully executable certipy, secretsdump, psexec, and PKINIT commands with clear placeholders cover the common end-to-end cases and are copy-paste ready, matching the 'fully executable, specific examples cover common cases' anchor. | 5 / 5 |
Workflow Clarity | Steps are cleanly numbered 1-6, but this is a destructive privilege-escalation workflow with no validation checkpoints (e.g., confirm the issued cert carries the SAN, confirm the TGT is usable before DCSync); per the rubric, a destructive workflow without validation is capped at 3. | 3 / 5 |
Progressive Disclosure | A single self-contained file under ~120 lines with clear section headers and no bundle files to navigate; for a simple single-purpose skill this is well-organized and easy to scan, scoring 5 under the simple-skill exception. | 5 / 5 |
Total | 17 / 20 Passed |