Content
80%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, highly actionable offensive playbook with excellent conciseness, but workflow clarity and progressive disclosure are held at 2 by the absence of validation checkpoints and the monolithic single-file structure.
Suggestions
Add explicit checkpoints between phases (e.g., verify the token decoded as JWT and confirm the MI assignment before pivoting) to lift workflow clarity.
Split the more self-contained sub-techniques (Workload Identity federation, AAD Connect MSOL extraction) into reference files and link to them one level deep from SKILL.md to improve progressive disclosure.
Clarify or remove the dead `$key = (New-Object System.Security.Cryptography.AesManaged).Key` line in the AAD Connect section, which does not perform the claimed DPAPI extraction.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and token-efficient: concrete commands, audience and pivot tables, and a tight OPSEC list with no concept preamble, assuming Claude's competence throughout. | 3 / 3 |
Actionability | Copy-paste-ready bash/powershell for IMDS, App Service, workload-identity STS exchange, and Key Vault secret reads, plus concrete tooling commands like Get-AADIntSyncCredentials. | 3 / 3 |
Workflow Clarity | A logical steal-token -> choose-audience -> use-token -> pivot sequence is present, but there are no explicit validation checkpoints or feedback loops, so it sits at the 'checkpoints missing or implicit' anchor. | 2 / 3 |
Progressive Disclosure | Well-organized into sections with no nested references, but it is a single >50-line monolithic file with no bundled detail files split out for distinct sub-techniques (workload identity, AAD Connect). | 2 / 3 |
Total | 10 / 12 Passed |