Content
63%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a well-structured, actionable adversary-emulation profile with concrete emulation and detection guidance and a clear kill-chain sequence gated by an authorization checkpoint. Its main weaknesses are length/inlined reference material that would benefit from offloading to reference files and the absence of copy-paste executable scripts or explicit validation feedback loops.
Suggestions
Move the 'Notable campaigns' history and the 'Signature tooling & malware' table into a references/ file (e.g. references/campaigns.md and references/tooling.md), keeping SKILL.md as an overview that links to them — this improves both conciseness and progressive_disclosure.
Add one or two concrete, copy-paste-ready command or script snippets for the highest-priority plays (e.g. an Outlook CVE-2023-23397 reminder-crafting snippet or a Responder invocation) to lift actionability from guidance-level to executable.
Add an explicit validate->fix->retry checkpoint in the emulation guidance (e.g. confirm spray-rate/egress rotation before proceeding, verify captured Net-NTLM hashes relay successfully before pivoting) to reach anchor 5 workflow clarity.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense and avoids explaining concepts Claude already knows (no 'what is phishing' padding), but the ~200 lines include a substantial inlined campaign-history narrative and a full TTP matrix across 11 tactics that could be tightened or moved to a reference file, matching 'mostly efficient but could be tightened' rather than anchor 4's 'minor instances'. | 3 / 5 |
Actionability | The Emulation guidance maps plays to concrete actions (run Responder for LLMNR/NBT-NS poisoning, low-and-slow spraying ~few attempts/account/hour, GooseEgg CVE-2022-38028 for SYSTEM, Sliver over HTTPS, split archives into <1MB chunks) and Detection names specific signals (spoolsv.exe spawning cmd, PidLidReminderFileParameter UNC paths, netsh interface portproxy add), giving mostly executable guidance; it stops short of anchor 5 because there are no copy-paste-ready code or script blocks. | 4 / 5 |
Workflow Clarity | The emulation guidance is sequenced by kill-chain phase (initial access -> NTLM coercion -> privesc -> cred access -> C2 -> cloud -> collection/exfil -> edge devices) with an explicit authorization/safety checkpoint and destructive-op fencing, so the destructive-cap-at-3 rule does not apply; it falls short of anchor 5 only because there are no explicit validate->fix->retry feedback loops. | 4 / 5 |
Progressive Disclosure | Section headers are clear and the Sources section links out, but no bundle/reference files exist and large reference-grade material (the campaign list and the signature-tooling table) is inlined in SKILL.md, matching 'some structure but content that should be separate is inline' rather than anchor 4's 'most content appropriately placed'. | 3 / 5 |
Total | 14 / 20 Passed |