Content
65%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is highly specific and actionable, with concrete CVEs, registry keys, API chains, and cloud-C2 mappings tied to ATT&CK IDs, but it is padded with narrative history, lacks validation feedback loops around its destructive operations, and keeps all reference material inline rather than splitting it across bundle files.
Suggestions
Tighten the attribution and notable-campaigns sections into compact reference entries (drop the vendor-citation prose and confidence rationale) to reduce tokens spent on background Claude already knows.
Add explicit validation checkpoints around destructive and exfil steps (e.g., 'confirm isolated lab scope before T1561.002; verify exfil staging archive before upload') to introduce a validate→fix→retry loop.
Move the malware catalog, campaign timeline, and full per-tactic TTP breakdown into references/ files (e.g., MALWARE.md, CAMPAIGNS.md, TTPS.md) and keep SKILL.md as a concise overview that links one level deep.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Operational specifics earn their place (CVEs, registry paths, C2 platforms, API chains), but the attribution rationale and dated campaign chronology with vendor citations are narrative prose Claude largely already knows and could be trimmed, fitting the 'mostly efficient but could be tightened' anchor. | 2 / 3 |
Actionability | The emulation guidance maps each kill-chain phase to concrete artifacts — CVE-2020-1380/CVE-2021-26411 chains, HKCU\...\Run persistence, VirtualAlloc→WriteProcessMemory→CreateRemoteThread injection into cmd.exe, Dropbox/pCloud/Yandex/Box C2, and `shutdown /r /t 1` — which is specific and actionable for an instruction-only skill where executable code is not required. | 3 / 3 |
Workflow Clarity | Phases are sequenced by ATT&CK tactic and gated by an explicit authorized-use caveat, but there are no validate→fix→retry feedback loops for the destructive (MBR wipe) and batch (collection/exfil) operations, which caps workflow clarity at 2 per the rubric. | 2 / 3 |
Progressive Disclosure | Sections and the malware table are well organized, but everything lives inline in one ~180-line SKILL.md with no bundle files and no one-level-deep references, so reference detail that could be split (campaigns, malware catalog, full TTP breakdown) sits inline at the anchor-2 level. | 2 / 3 |
Total | 9 / 12 Passed |