Content
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a thorough, well-structured adversary-emulation profile with concrete TTP-to-capability mapping, but it is monolithic and verbose with overlapping sections, relies on external tools without runnable examples, and lacks validation checkpoints in its workflow.
Suggestions
Split the detailed TTP catalog and campaign history into reference files (e.g., references/TTPs.md, references/campaigns.md) and keep SKILL.md as a concise overview with one-level-deep links.
Add explicit validation/verification checkpoints to the emulation workflow (e.g., confirm payload executes in the lab, verify C2 beacon, validate scope authorization before each phase) rather than only an upfront authorized-use caveat.
Tighten redundancy between the 'TTPs by ATT&CK tactic' section and the 'Emulation guidance' section so each technique is described once.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense with genuinely APT36-specific intel rather than concepts Claude already knows, but it is verbose: the TTP-by-tactic catalog and the emulation guidance overlap, and the attribution/campaign narrative could be tightened. | 2 / 3 |
Actionability | Emulation guidance gives concrete specifics (LNK+HTA+mshta.exe chain, the HKCU Run-key path, a 15-day sleep timer, .NET custom TCP C2, Telegram/Slack C2), but it delegates execution to external 'skills' and 'Decepticon capabilities' with no self-contained runnable steps or code, leaving key implementation details missing. | 2 / 3 |
Workflow Clarity | The emulation phases are clearly sequenced along the attack lifecycle (initial access through exfiltration), but there are no validation checkpoints or validate-fix-retry feedback loops for the risky payload-deployment operations, capping workflow clarity at 2. | 2 / 3 |
Progressive Disclosure | The document is well-organized into sections, but it is a single ~177-line monolith with no bundle files, and content that could be split out (the full TTP catalog, campaign history, tooling table) is kept inline rather than referenced one level deep. | 2 / 3 |
Total | 8 / 12 Passed |