Content
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The profile is information-dense and well-structured with genuinely actionable emulation and detection guidance, but it is monolithic and verbose, lacks executable code and validation feedback loops, and keeps all detail inline rather than splitting large catalogs into reference files.
Suggestions
Split the TTP-by-tactic catalog and signature-tooling list into a reference file (e.g., references/ttp-map.md) and keep SKILL.md as a concise overview that links one level deep.
Add a short validation/verification checkpoint for the emulation chain, e.g., confirm C2 beaconing and detection coverage before moving to lateral movement or any impact stage.
Tighten the intro and campaign narratives to remove recap already covered by the description, keeping only TTP-relevant detail.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense, factual intel (TTPs, tooling) that mostly earns its place and avoids explaining concepts Claude already knows, but the ~165 lines include narrative prose (intro recap, campaign histories) that could be tightened, so it is mostly efficient rather than lean. | 2 / 3 |
Actionability | The emulation and detection sections name concrete tools, commands, event IDs, and a recommended chain, but guidance is prose direction rather than copy-paste executable code blocks, so it is concrete yet incomplete. | 2 / 3 |
Workflow Clarity | A clear sequenced emulation chain is given with an explicit ROE/authorization gate, but there are no validate->fix->retry checkpoints, and the guideline caps destructive/batch operation workflows without validation feedback at 2. | 2 / 3 |
Progressive Disclosure | The file is well-organized with clear section headers, but it is a single ~165-line monolithic document with no bundle references; the TTP catalog and tooling lists could be split into separate reference files, so content that should be separate is inline. | 2 / 3 |
Total | 8 / 12 Passed |