Content
60%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill body is a thorough, well-structured adversary-emulation profile with strong actionability in its emulation guidance. Its main weaknesses are verbosity from inlined campaign history and ATT&CK enumerations, and the absence of explicit validation/feedback loops for destructive or surveillance operations.
Suggestions
Move the detailed campaign timeline and full ATT&CK ID enumeration into a separate reference file (e.g. references/campaigns.md, references/ttps.md) and keep SKILL.md as a concise overview with one-level-deep links.
Add explicit validation checkpoints in the emulation guidance (e.g. verify scope/authorization before each phase, confirm lab isolation before mobile/Pallas deployment, validate payload execution before collection).
Trim narrative attribution prose that Claude can derive from the cited sources, retaining only the operationally relevant TTP and tooling detail.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense and mostly avoids generic concept explanations, but it is long and includes narrative attribution/campaign history and a large enumeration of ATT&CK IDs that pads context beyond what an emulation skill strictly needs. | 3 / 5 |
Actionability | The 'Emulation guidance' section maps signature plays to concrete capabilities and tools (Sliver, .rev archives, process hollowing into iexplore.exe, the '&&&' C2 marker) with specific, executable direction, though it references other skills generically rather than giving standalone commands. | 4 / 5 |
Workflow Clarity | TTPs are well-organized by tactic and emulation plays are listed as discrete steps, but the destructive/surveillance operations lack explicit validation checkpoints or feedback loops, capping workflow clarity at 3 per the rubric's destructive/batch cap. | 3 / 5 |
Progressive Disclosure | Content is cleanly sectioned (attribution, targeting, campaigns, TTPs by tactic, tooling, emulation, detection, sources) with no bundle files to defer to, so the monolithic-but-organized structure is well navigable with only minor bloat that could live in references. | 4 / 5 |
Total | 14 / 20 Passed |