Content
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a well-organized, technically rich adversary-emulation reference with concrete operational parameters and a clear authorized-use caveat. Its main weaknesses are a monolithic single-file structure with no progressive disclosure, the absence of validation checkpoints in the emulation workflow, and descriptive (rather than directly executable) guidance that depends on other named skills.
Suggestions
Split the large TTP-by-tactic catalog and/or the detection-and-defense section into reference files (e.g., TTPS.md, DETECTION.md) and link them from a concise overview in SKILL.md to improve progressive disclosure.
Add an explicit validation/verification loop to the emulation workflow (e.g., 'validate the dropper unpacks and beacons before deploying; confirm C2 check-in before collection') to lift workflow_clarity past 2.
Dedupe techniques repeated across tactic sections (process hollowing, keylogging) and trim narrative victim-count flavor to tighten conciseness.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense and avoids explaining concepts Claude already knows, but at ~165 lines it includes some redundancy (T1055.012 process hollowing and T1056.001 keylogging each appear in two tactic sections) and narrative flavor (exact victim/message counts) that could be tightened. | 2 / 3 |
Actionability | It gives concrete, specific parameters (registry paths, the `&&&` C2 suffix marker, AES/Twofish schemes, `.rev` archives, masquerade identities), but the emulation guidance maps to other named skills and is descriptive rather than copy-paste executable code. | 2 / 3 |
Workflow Clarity | Emulation plays are listed with some numbered sub-steps (e.g., the four-step dropper chain) and an authorized-use caveat, but it reads as a menu of plays rather than a sequenced end-to-end workflow, and there are no validation/verification checkpoints for risky implant deployment. | 2 / 3 |
Progressive Disclosure | The single file is well-sectioned for easy navigation, but it is monolithic with no external references; at well over 50 lines the simple-skill exemption does not apply, and splittable content (the full TTP catalog, detection guidance, campaign history) is inline. | 2 / 3 |
Total | 8 / 12 Passed |