Content
65%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, highly actionable command reference with well-organized sections, vendor-specific exploit chains, and thoughtful error handling. The main weaknesses are the absence of post-exploitation validation checkpoints for destructive operations and the monolithic single-file structure that inlines per-CVE deep-dive material a references/ bundle would carry better.
Suggestions
Add post-operation validation steps to each exploit chain (e.g., verify the implant account logs in before moving to config extraction, verify the web shell responds before relying on it, confirm config files are non-empty before parsing) — this both raises workflow clarity and lifts the destructive-operations cap.
Split per-vendor CVE chains into references/ files (e.g., references/cisco-ios-xe-cves.md, references/ivanti-cs-cves.md, references/panos-cves.md, references/fortimanager-cves.md) and keep SKILL.md as an overview with the Quick Reference, MITRE mapping, and Decision Gate — this improves progressive disclosure and removes the duplicated probes.
Replace or complete the CVE-2024-47575 placeholder ("Simplified — real exploit crafts valid FGFM handshake") with either a working FGFM registration example or an explicit pointer to a reference file / Metasploit module, since it is the one non-executable block in an otherwise copy-paste-ready skill.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is command-dominant with one-line context per CVE ("Unauthenticated attacker creates a privileged local account via the web UI") and almost no padding or explanation of concepts Claude already knows — matching the score-4 anchor's "efficient; minor instances... that could be trimmed". It is not a 5 because the Quick Reference probes (webui logoutconfirm.html, GlobalProtect login.css, Ivanti welcome.cgi) reappear verbatim in Section 2, and the Tools table partially duplicates inline commands. | 4 / 5 |
Actionability | Mostly executable, copy-paste-ready guidance: complete curl exploit requests with headers and payloads, a Metasploit module invocation, full SNMP OID sequences for config extraction, and a working Cisco Type-7 decoder. Falls short of the score-5 anchor because CVE-2024-47575 is explicitly placeholder code ("Simplified — real exploit crafts valid FGFM handshake") and the FortiManager Python snippet would not run as written (ssl.wrap_socket is removed in modern Python). | 4 / 5 |
Workflow Clarity | The sequence is clear — numbered sections (Identifying → CVE chains → Post-exploitation → Implant), per-CVE numbered steps, pre-exploitation checks ("Step 1: Verify web UI is accessible", "Confirm GlobalProtect is exposed"), an Error Handling & Edge Cases section, and a branching Decision Gate. However, the workflows involve destructive, hard-to-reverse operations (implant deployment, config modification, web shell drops) with no post-operation validation loops — no verify-implant-functional or verify-extraction-complete checkpoints — so the destructive-operations cap of 3 applies. | 3 / 5 |
Progressive Disclosure | No bundle files exist (no references/, scripts/, or assets/), and ~300 lines of per-CVE exploit deep dives, credential-harvesting scripts, detection signatures, and IOC tables are all inlined in SKILL.md. This matches the score-3 anchor ("200 lines of API reference that could be in a separate file") with good section headers but content that should be split into per-vendor reference files is inline; it is above the score-2 anchor because structure and navigation are genuinely good. | 3 / 5 |
Total | 14 / 20 Passed |