Content
80%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An exceptionally actionable, token-lean offensive playbook with clear phase sequencing, held back by missing validation checkpoints for destructive steps and a monolithic structure with no reference split.
Suggestions
Add explicit validation checkpoints after destructive steps (e.g. 'Verify the new SP credential authenticates before proceeding', 'Confirm appRoleAssignment succeeded via GET before assuming GA-equivalent').
Split the hybrid-identity attacks, detection signatures, and tools sections into reference files (e.g. references/hybrid-identity.md, references/detection.md) and keep SKILL.md as an overview pointing one level deep.
Add a verify step in the decision gate confirming the assumed permission is actually granted before committing to a path.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Dense, operational content with no basic-concept padding; inline comments are operational (e.g. 'not appId — objectId of the Application') and earn their place, assuming the operator's competence. | 5 / 5 |
Actionability | Copy-paste-ready curl and PowerShell commands with concrete endpoints, payloads, and a permission-to-path table cover the common escalation cases; only inherent placeholders (TOKEN, TENANT) remain. | 5 / 5 |
Workflow Clarity | Phases 0–6 plus a decision gate give a clear sequence, but the destructive operations (credential minting, role assignment, DCSync, Golden SAML) lack explicit verify-success checkpoints, which caps workflow clarity at 3 per the destructive-operations guideline. | 3 / 5 |
Progressive Disclosure | Well-organized into sections, but the ~190-line body is monolithic with no bundle files: content that could live in references (hybrid-attack details, detection signatures, tools) is fully inlined rather than split one level deep. | 3 / 5 |
Total | 16 / 20 Passed |