Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, highly actionable offensive-security playbook with executable curl/HTML/JS PoCs, a clear detection-to-exploitation workflow, and a validation decision gate. It is concise without re-teaching basics, and well-structured for a self-contained skill; minor gains would come from making the validate→retry loop explicit and optionally offloading the larger matrices to a reference file.
Suggestions
Make the error-recovery feedback loop explicit in the Decision Gate (e.g., 'If any gate check fails, revisit section 2 for a bypass class, re-run the relevant detection probe, and re-confirm before escalating or downgrading').
Consider moving the full bypass/misconfig matrix and detection/OPSEC tables into a references/ file (e.g., BYPASS-MATRIX.md) to keep SKILL.md as a lean overview, which would also lift progressive_disclosure toward 5.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is largely lean — a one-paragraph principle, a compact detection curl block, and tight matrices — and assumes Claude already understands CSRF mechanics without re-explaining them. It earns 4 rather than 5 because the bypass/misconfig matrix and a few inline explanations carry some density that could be trimmed without losing clarity. | 4 / 5 |
Actionability | Provides fully executable, copy-paste-ready curl detection commands (steps a–e) and concrete HTML/JS PoCs for classic form CSRF, JSON-via-text/plain, and CSRF-via-XSS, covering the common cases with specific commands and bodies, matching the score-5 anchor. | 5 / 5 |
Workflow Clarity | There is a clear numbered sequence (Detect → Bypass matrix → Exploit PoC → Chains → Tools → Detection/OPSEC → Decision Gate) with an explicit validation checklist in the Decision Gate. It is not 5 because the recovery/feedback loop ('if a check fails, do X and re-test') is implicit rather than spelled out as a validate→fix→retry cycle, though the destructive-action validation cap is satisfied by the decision-gate checklist. | 4 / 5 |
Progressive Disclosure | No bundle files exist (references/, scripts/, assets/ are absent), so the skill is intentionally self-contained with well-organized section headers and matrices — appropriate for a single-purpose playbook under the simple-skill guidance. It earns 4 rather than 5 because several dense matrices (bypass matrix, detection/OPSEC) could justify a separate reference file for deeper material, but the current one-level structure is clear and navigable. | 4 / 5 |
Total | 17 / 20 Passed |