Content
62%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The profile is well-structured, distinctive, and offers concrete emulation guidance mapped to capabilities with strong safety caveats, but it carries substantial inlined reference content (campaigns, malware catalog) that a leaner SKILL.md could push into separate files, and it lacks explicit validation checkpoints.
Suggestions
Move the full campaigns list and signature-tooling table into a references/ file (e.g. references/campaigns.md) and keep only a brief summary inline, improving progressive disclosure and conciseness.
Add explicit validation checkpoints in the emulation workflow (e.g. confirm RoE/scope before each phase, verify lab isolation before destructive steps) to lift workflow clarity.
Trim background prose Claude already knows (e.g. explanations of what ATT&CK tactics mean) to tighten token efficiency.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | It is mostly efficient reference material, but the lengthy campaigns list, per-malware table, and TTP-by-tactic narrative restate well-known ATT&CK context Claude already has, so it could be tightened without losing actionable value. | 3 / 5 |
Actionability | The 'Emulation guidance' section maps each signature play to concrete Decepticon capabilities and skills (phishing/payload-builder, web-compromise, c2 skill, Sliver) with specific CVEs, registry keys, and API call chains, giving mostly executable direction with minor gaps. | 4 / 5 |
Workflow Clarity | The emulation guidance is sequenced by kill-chain phase with an explicit authorized-use caveat and lab-only boundary for destructive actions; it lacks explicit validate/verify checkpoints between phases, which keeps it just below a 5. | 4 / 5 |
Progressive Disclosure | It is a single monolithic SKILL.md with no bundle files; the heavy campaign/malware reference material is inlined rather than split into reference files, so structure is decent but content that could live separately is all inline. | 3 / 5 |
Total | 14 / 20 Passed |