Content
87%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The content is an exceptionally lean, actionable privesc reference with clear phasing and good structure. Its one notable gap is the lack of validation/verification checkpoints for the destructive operations it walks through.
Suggestions
Add explicit verification steps between phases, e.g. confirm sts:GetCallerIdentity shows the target role after AssumeRole before chaining the next hop.
Insert a pre-flight check (verify iam:PassRole / lambda:CreateFunction permissions) before executing Phase 2 to fail fast on missing access.
Add a brief cleanup/remediation note for created resources (delete the pwn Lambda, terminate the EC2 instance) to support reversible testing.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean — terse bash commands with minimal inline comments and no re-explanation of concepts Claude already knows (e.g., what IAM or PassRole is); every token earns its place. | 5 / 5 |
Actionability | Provides concrete, executable aws-cli commands and a complete copy-paste Lambda payload (pwn.py) covering the common privesc paths (Lambda, Glue, EC2, SageMaker, AssumeRole); placeholders like TARGET_ROLE are obvious template variables. | 5 / 5 |
Workflow Clarity | Phases are clearly sequenced (Enumerate → Phase 1-4), but the workflow involves destructive/irreversible operations (creating Lambda functions, running EC2, escalating privileges) with no validation or verification checkpoints, which caps workflow clarity at 3. | 3 / 5 |
Progressive Disclosure | A self-contained single-file reference with clear section headers, easy navigation, and no nested or buried references; the compact reference-table and OPSEC sections belong inline, so the single-file structure is appropriate. | 5 / 5 |
Total | 18 / 20 Passed |