Conciseness

The body is lean and command-first: nearly every section is an executable curl/PowerShell block with one or two load-bearing sentences of context (e.g. "If the target SP has any of these app roles, you have GA-equivalent"). No padding, no explanation of concepts Claude already knows — every token earns its place, matching the 5 anchor.

Actionability

Fully executable, copy-paste-ready Graph API and AADInternals commands with concrete parameters (endDateTime, JSON bodies, jq filters) covering each attack family, e.g. the addPassword POST and the appRoleAssignment grant. Placeholders like <TENANT> and <APP_OBJECT_ID> are legitimate parameterization, not pseudocode. Specific examples cover the common cases — the 5 anchor.

Workflow Clarity

A clear phased sequence (Phase 0 recon → Phase 1-6 escalation paths) with a "Chains" section composing steps and a closing "Decision gate" that routes by precondition — most checkpoints are present. Falls short of 5 because there are no explicit verify-after-action steps or feedback loops (e.g. confirming a granted role before chaining on it); Phase 0 recon is the only real checkpoint.

Progressive Disclosure

No bundle files exist (references/, scripts/, assets/ are absent), so this scores the single-file structure: well-organized sections (phases, permission table, chains, tools, detection signatures, decision gate) that are easy to navigate, matching anchor 4. Not 5 because at ~190 lines the detail-dense Phase 5 hybrid attacks and tool/detection material would be more appropriately split into one-level-deep reference files per the rubric's overview-first rationale.

Specificity

The description enumerates multiple concrete capabilities: "app role/owner abuse, service-principal credential addition, dynamic group membership abuse, Administrative Unit role assignment, hybrid identity attacks (Connect, PHS, PTA, Seamless SSO, Golden SAML), Graph API privesc paths" — comprehensive, specific technique coverage with no vague filler. This matches the 5 anchor (multiple specific concrete actions, comprehensive) rather than 4, since the enumerated list covers essentially every major privesc family in the domain with no significant gaps.

Completeness

The "what" is clear and concrete (walks Entra ID escalation and persistence techniques), but the description contains no "Use when..." clause or equivalent explicit trigger guidance — per the judging guidelines this caps completeness at 3. The metadata.when_to_use field supplies triggers, but it is a separate frontmatter field, not part of the description evaluated here. Not 4 because the 'when' is absent from the evaluated text, not merely implicit-but-present.

Trigger Term Quality

Good natural-term coverage: "privilege escalation", "persistence", "Golden SAML", "Graph API", "privesc" are phrases users would actually say, plus abbreviation variants (PHS, PTA, SSO). A few natural terms are missing — notably the still-ubiquitous synonyms "Azure AD" / "Azure" / "AAD" appear only in metadata.when_to_use, not in the description field itself. This sits between anchor 3 (some keywords, missing common variations) and 5 (comprehensive including synonyms), landing at 4.

Distinctiveness Conflict Risk

"Entra ID privilege escalation + persistence" carves out a clear niche (post-exploitation privesc, not enumeration or defense), and the technique-level terms (Golden SAML, PHS, Administrative Unit) are unambiguous triggers that would not route to a generic Azure or defender skill. Clear niche with distinct triggers and minimal conflict risk — the 5 anchor.