Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, operational skill body that consistently provides concrete executable commands with genuine domain tradecraft and no filler. It features a coherent phase-based workflow with decision-gate feedback loops, and its only shortcomings are minor: unresolved token/credential placeholders, a non-executable IMAP hint, and a few implicit validation checkpoints.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean and command-first: every prose fragment conveys tenant-specific tradecraft Claude cannot be assumed to know (ROPC vs 'Other clients' CA scoping, PKeyAuth advertisement-vs-compliance caveat, audit-only policy state). Deprecation status is explicitly flagged ('deprecated but still works in some tenants'), and there is no padded explanation of concepts Claude already knows — matching the 'every token earns its place' anchor. | 5 / 5 |
Actionability | Nearly every technique ships a concrete command (Graph API curl with jq filters, ROPC spray loop, swaks SMTP probe, openssl IMAP, MailSniper one-liner, named-location listing). It falls short of the copy-paste-ready 5 anchor due to unresolved placeholders (TOKEN=<GLOBAL_READER_OR_SECREADER> acquisition is never shown) and the IMAP section being a hint comment ('A1 LOGIN ...') rather than an executable command. | 4 / 5 |
Workflow Clarity | A clear phase sequence (enumerate policy surface → exploit per gap class → chains → detection signatures → decision gate) with real feedback loops: AADSTS error codes route pivots ('53003 everywhere → pivot to phishing'), the SMTP probe validates with '235 Authentication succeeded', and break-glass abuse includes an explicit sacrificial-login validation. Not a 5 because some checkpoints are implicit — e.g., no verification that a minted service-principal token actually grants the claimed permissions before escalating to entra-privesc. | 4 / 5 |
Progressive Disclosure | Single-file skill (~140 lines) with well-organized phase sections and clearly signaled one-level cross-skill references ('See entra-privesc § service-principal credential addition'). No bundle files exist, so there is no nesting risk, but the file exceeds the under-50-line simple-skill threshold and sections like the Tools catalog and detection signatures could arguably live in separate reference files — good structure with minor organization gaps, matching the 4 anchor. | 4 / 5 |
Total | 17 / 20 Passed |