Content
32%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill is thorough and well-structured as an adversary reference, with a genuinely actionable emulation-mapping section and an authorized-use caveat. Its weakness is conciseness — it doubles as a CT encyclopedia rehashing known ATT&CK content — and the absence of bundle files leaves it monolithic.
Suggestions
Move the encyclopedic attribution, campaign history, full ATT&CK TTP catalog, and tool table into a references file (e.g., references/TTPS.md), keeping SKILL.md as a lean emulation-guidance overview with signaled links.
Add explicit validation checkpoints in the emulation guidance for destructive/batch steps (e.g., confirm scope/ROE before credential dumping; validate C2 staging before exfiltration) to support a validate→fix loop.
Replace descriptive prose in the TTP section with terse, instruction-oriented guidance that assumes Claude's ATT&CK knowledge rather than re-explaining each technique.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is a dense, encyclopedic catalog — attribution, campaigns, full TTP-by-tactic enumeration, a large tool table — much of which restates ATT&CK/CT knowledge Claude already knows; it is padded with background rather than lean, token-efficient guidance. | 1 / 3 |
Actionability | The 'Emulation guidance' section maps TTPs to concrete skills and named tools (Mimikatz, secretsdump.py, Sliver/Cobalt Strike, certutil) and includes an authorized-use caveat, giving actionable direction; however most of the document describes rather than instructs, with no copy-paste commands. | 2 / 3 |
Workflow Clarity | Sequencing is present in the emulation guidance as a logical attack-chain progression (initial access → ... → exfiltration) and detection mappings, but there are no explicit validation checkpoints or validate→fix→retry feedback loops for the destructive/batch operations referenced. | 2 / 3 |
Progressive Disclosure | The content is well-organized into clear sections and includes a real sources list, but it is a single monolithic SKILL.md with no bundle files or one-level-deep references, so heavy reference material (full TTP catalog, tool table) that should be split out is inlined. | 2 / 3 |
Total | 7 / 12 Passed |