Content
63%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a dense, largely executable attack playbook with useful validation (PoC checklist, retry loop) and good internal structure. Its weaknesses are redundancy in the mechanics explanation, an inconsistent Singularity setup path, time-sensitive browser claims without a deprecation section, and a monolithic layout that inlines content suited to reference files.
Suggestions
Collapse the Phase 1-3 narrative and the ASCII sequence diagram into a single statement of the rebind mechanics, and drop the same-origin-policy basics from the intro — this trims the conciseness problem directly.
Fix the Singularity setup to be self-consistent (build the image from source after setting rebindingFn, or use the stock image's manager UI only), and fill the payload placeholders with worked example values so the main path is fully copy-paste ready.
Move the CVSS table, Electron/desktop port table, and defense/bypass matrix into a references/ file (e.g., references/targets-and-scoring.md) linked one level deep from SKILL.md, and relocate browser-version-specific TTL/pinning claims to a clearly labeled version-notes section.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content is mostly dense and useful, but the three-phase narrative and the ASCII sequence diagram restate the same mechanics twice, the intro re-explains same-origin-policy basics Claude already knows, and time-sensitive browser-version claims ('Chrome: pins for ~1min', 'Chrome 124', 'Safari doesn't implement PNA') appear outside any old-patterns/deprecated section. It is not a 4 because the phase/diagram duplication is a real tightening opportunity, not a minor instance; it is not a 2 because the bulk is concrete tables, commands, and code rather than padded prose. | 3 / 5 |
Actionability | Most guidance is executable: the rbndr.us hostname-construction bash runs as-is (with a clearly marked <YOUR_VPS_IP>), and the payload HTML and IMDS fetch JS are near copy-paste ready. It is not a 5 because the Singularity section is internally inconsistent (instructs editing cmd/singularity-server/main.go for rebindingFn, then runs the stock nccgroup/singularity image that would not contain that edit) and several placeholders (<TARGET_PORT>, <ATTACKER_COLLECTOR>) require assembly; it is not a 3 because the core paths (rbndr + payload + IMDS chain) are concrete and executable. | 4 / 5 |
Workflow Clarity | Sections follow a coherent order (applicability → mechanics → tooling → payload → IMDS pivot → Electron → defenses → evidence → scoring → chaining), and validation is explicitly present via the PoC Evidence Checklist ('Show the exfiltrated data', 'Show that without the rebind... the same request fails') and the payload's bounded retry loop. It is not a 5 because no single end-to-end numbered procedure ties tooling, payload hosting, and delivery together — the reader must assemble the sequence from reference-style sections. | 4 / 5 |
Progressive Disclosure | The skill is a single ~220-line file with no bundle files (no references/, scripts/, or assets/ exist) and no pointers to any. Header organization is decent, but self-contained content that would serve better as one-level-deep references — the CVSS table, the Electron port table, the defense/bypass matrix — is inlined in the monolith. It is not a 4 because the <50-line simple-skill exception does not apply at this length and the split opportunities are real; it is not a 2 because internal section structure is clear and navigable, not an unstructured wall. | 3 / 5 |
Total | 14 / 20 Passed |