Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, highly actionable playbook body: concrete tooling, a copy-paste seed profile, a sequenced kill chain, and real RoE gates for the destructive edge-device operations. Main gaps are the absence of per-phase verification checkpoints (dwell-time measurement in particular) and an unverifiable external reference, plus time-sensitive CISA citations embedded in core guidance.
Suggestions
Add explicit per-phase verification checkpoints — e.g. confirm the edge foothold and proxy egress before credential access, and define how dwell time (the stated success metric) is measured and recorded.
Isolate the time-sensitive CTI citations (CISA BOD 26-02, AA24-038A) in a dated 'CTI delta' note so aging references can be pruned without touching core guidance.
Bundle references/apt-groups.md with the skill (or inline the relevant industry → actor rows) so the '../../references/apt-groups.md' pointer does not dangle.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and lean — a fillable JSON seed, a compact kill-chain table, and tight OPSEC/RoE sections with no explanations of concepts Claude already knows. Not a 5 because time-sensitive citations ('CISA BOD 26-02 (Feb 2026)', 'CISA AA24-038A') sit in core guidance rather than an isolated, prunable section, and the intro blockquote slightly repeats traits restated in the OPSEC section. | 4 / 5 |
Actionability | Fully concrete for a planning skill: a copy-paste-ready ThreatProfile JSON, exact LOLBin tool names (netsh, wmic, ntdsutil, vssadmin, reg, dnscmd), MITRE technique IDs per phase, and explicit per-phase executing-agent → sub-skill paths. The guidance is specific down to which sub-skill to invoke at each step. | 5 / 5 |
Workflow Clarity | A clearly numbered 8-phase kill chain plus a CONOPS list cross-referencing phases ('(2-3)', '(5-8)'), with explicit safety gates (device-write authorization, 'confirm a config backup exists before exploiting', an EMERGENCY abort trigger, IT/OT boundary). Not a 5 because operational verification checkpoints are missing — no step to verify the edge foothold or proxy egress before proceeding, and no dwell-time checkpoint despite dwell being the stated success metric. | 4 / 5 |
Progressive Disclosure | Well-sectioned ~95-line body with clearly signaled, one-level-deep references (the industry → actor map in references/apt-groups.md and per-phase sub-skill SKILL.md paths). Not a 5 because the bundle ships no references/ directory, so the '../../references/apt-groups.md' path cannot be verified from the skill's location and may dangle. | 4 / 5 |
Total | 17 / 20 Passed |