Content
76%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is highly actionable with executable code throughout and clear section structure, but it over-explains a couple of basic concepts and lacks explicit validation checkpoints in its destructive attack workflow, capping workflow clarity at 3.
Suggestions
Add an explicit validation checkpoint between rebinding and exploitation (e.g., 'Verify the rebind succeeded by checking that fetch returns the internal service response before chaining to IMDS') to lift workflow_clarity above the destructive-operation cap of 3.
Trim the introductory explanation of same-origin policy mechanics that Claude already knows, keeping only the rebind-specific insight, to move conciseness toward 5.
Consider moving the port table, CVSS table, and defenses table into a reference file with a one-line pointer from SKILL.md to better separate overview from detail and improve progressive_disclosure.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient with executable code and compact tables, but minor over-explanation of concepts Claude already knows (e.g., re-explaining that same-origin policy checks the hostname not the IP) keeps it just below lean. Not 3 because there is no heavy padding; not 5 due to the small amount of explanatory prose. | 4 / 5 |
Actionability | Provides copy-paste-ready bash for rbndr hostname construction and singularity, a complete JS payload page, IMDS credential-fetch chains, and a kg_add_node snippet — fully executable guidance covering the common cases. | 5 / 5 |
Workflow Clarity | The attack is sequenced (Phase 1/2/3, numbered Electron steps) but lacks explicit validation checkpoints for a destructive/offensive operation; the JS retry is a partial loop rather than a validate-then-proceed gate, so per the batch/destructive cap it cannot exceed 3. | 3 / 5 |
Progressive Disclosure | A single well-organized file with clear numbered sections and tables, but all content is inlined with no overview-to-detail split or external references; good structure with minor organization gaps. Not 5 because nothing is split out to separate files despite the ~200-line length. | 4 / 5 |
Total | 16 / 20 Passed |