Content
83%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, highly executable playbook: real commands for every auth variant, exact GUIDs and event IDs, output formats, and a prioritized target table. The only real gap is the absence of validation after the batch hash dump (verify output files non-empty / krbtgt captured) before escalating to golden-ticket forgery.
Suggestions
Add a verification step after secretsdump (e.g., check /tmp/secrets.ntds is non-empty and grep for the krbtgt RID 502 line) before running ticketer.py — this closes the batch-operation validation gap and lifts workflow clarity.
Optionally move the detection signature, CVSS, and defender remediation sections into a references/ file to keep SKILL.md as a lean attack-path overview.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and operational — a two-sentence framing of the miscondition ('The "vulnerability" is when a non-DC principal has the replication-rights ACL'), then straight to Cypher, commands, a value table, and detection signatures. Every section adds information Claude would not reliably produce unaided (specific GUIDs, event IDs, output file formats); nothing is padded. | 5 / 5 |
Actionability | Commands are copy-paste ready across the common auth variants — 'secretsdump.py 'DOM/USER:PASS@DC_IP' -just-dc', '-hashes :NT_HASH', '-k -no-pass', mimikatz 'lsadump::dcsync /domain:dom.local /user:krbtgt', ticketer.py, and the PowerShell remediation. Placeholders (DOM/USER:PASS@DC_IP, KRBTGT_NT, S-1-5-21-XXXX) are clearly marked, and output file formats are spelled out ('user:RID:LM_HASH:NT_HASH:::'). | 5 / 5 |
Workflow Clarity | Sections 1–6 give a clear sequence (identify candidates → execute → parse output → select targets → golden ticket → promote), and step 1 includes a data-quality pre-check, but the batch dump itself ('secretsdump.py ... -just-dc' dumps all hashes) has no post-execution verification — no check that /tmp/secrets.ntds is non-empty or that the krbtgt line was captured before pivoting to ticketer.py. Per the rubric's cap, a batch operation without validation cannot score above 3. | 3 / 5 |
Progressive Disclosure | Well-sectioned single-file playbook with clear headers (Identify, Execute, Output files, OPSEC, Detection, CVSS, Remediation) and no bundle files to navigate. It exceeds the under-50-lines simple-skill exemption, and secondary material (detection signature, CVSS, defender remediation) sits inline where a references/ file could hold it — minor organization gap, good structure overall. | 4 / 5 |
Total | 17 / 20 Passed |