Content
53%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The profile is a comprehensive, accurate, ATT&CK-grounded reference with strong actionability in the emulation guidance, but it is a monolithic single-file skill with no progressive disclosure and lacks explicit validation checkpoints for destructive emulation workflows. Splitting reference material into bundle files and adding verify-steps would materially raise the score.
Suggestions
Move the campaign timeline, full per-tactic TTP catalog, and detection guidance into separate reference files (e.g. references/campaigns.md, references/ttps.md, references/detection.md) and link to them from a concise overview, improving progressive disclosure.
Add explicit validation/verification checkpoints to the emulation guidance (e.g. confirm scope/authorization before each destructive step, verify payload staging, validate C2 reachability) to lift workflow clarity above the destructive-skill cap of 3.
Tighten the TTP sections by collapsing redundant per-technique prose and relying on the ATT&CK IDs plus the tooling table, since Claude already knows most technique definitions.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense and well-organized rather than padded with concepts Claude already knows, but it is long (TTP enumerations across many tactics, a campaign timeline, detection guidance) and some sections restate ATT&CK technique names Claude already knows, so it is mostly efficient with room to tighten. | 3 / 5 |
Actionability | The 'Emulation guidance' section gives concrete, executable direction (registry Run key paths, 15-day sleep timer, LNK+HTA+mshta.exe chain, Telegram/Slack/Google Drive C2) with specific ATT&CK IDs throughout; minor gaps in that it describes techniques to emulate rather than providing copy-paste tooling commands. | 4 / 5 |
Workflow Clarity | There is a clear conceptual kill-chain sequence (initial access -> execution -> persistence -> evasion -> collection -> C2 -> exfiltration) and an authorized-use caveat, but no explicit validation/verification checkpoints or feedback loops; the emulation work is destructive/offensive, so missing validation caps workflow clarity at 3 per the feedback_loops scoring note. | 3 / 5 |
Progressive Disclosure | It is a single ~180-line monolithic SKILL.md with no bundle files in references/scripts/assets and no one-level-deep reference links; the campaign timeline, full TTP catalog, and detection guidance are strong candidates for separate reference files but are all inlined, matching the 'content that clearly belongs in separate files is inlined' anchor. | 2 / 5 |
Total | 12 / 20 Passed |