Content
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a thorough, well-organized ATT&CK-mapped adversary profile with concrete emulation and detection guidance. It is held back by narrative padding, guidance that points to other skills rather than self-contained procedures, missing validation checkpoints for destructive operations, and a monolithic structure with no bundled reference files.
Suggestions
Move the large TTP-by-tactic catalog, the signature-tooling table, and the notable-campaigns narrative into reference files (e.g. references/ttps.md, references/tooling.md) and link them one level deep from SKILL.md to improve progressive disclosure.
Add explicit validation/verification checkpoints to the emulation workflow (e.g. confirm scope/ROE before destructive T1561/T1498 steps, verify privesc success before credential access) so destructive and batch operations have feedback loops.
Tighten or condense the 'Attribution & motivation' and 'Notable campaigns' sections to only what drives emulation decisions, reducing token spend on background Claude already largely knows.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Most of the body is dense, non-obvious reference data (TTP→ATT&CK mappings, tool table, CVEs) that earns its tokens, but the 'Attribution & motivation' and 'Notable campaigns' narrative sections add background not strictly needed for emulation; matches 'mostly efficient but could be tightened'; not a 3 due to that narrative padding, not a 1 because it avoids explaining basic concepts Claude already knows. | 2 / 3 |
Actionability | The 'Emulation guidance' section gives specific direction ('run Responder for LLMNR/NBT-NS poisoning', 'use Sliver over HTTPS', 'split into <1MB chunks', 'Mimikatz for LSASS dump/DCSync') but largely delegates to other skills rather than providing self-contained executable commands; matches 'some concrete guidance but incomplete'; not a 3 because it stops at cross-skill mapping instead of copy-paste-ready steps. | 2 / 3 |
Workflow Clarity | Tactic-phase ordering (initial access → ... → exfil) gives an implicit sequence and an authorized-use caveat, but there are no explicit validation checkpoints or validate→fix→retry loops despite destructive/batch operations (T1561/T1498); per the guidelines this caps workflow clarity at 2; not a 1 because a phase sequence does exist. | 2 / 3 |
Progressive Disclosure | The body is well-sectioned with clear headers, but it is a monolithic ~200-line file with no references/scripts/assets bundle and no one-level-deep split for the large TTP catalog and tool table; matches 'some structure but content that should be separate is inline'; not a 3 because the >50-line reference material is not offloaded to separate files, not a 1 because organization is clean. | 2 / 3 |
Total | 8 / 12 Passed |