Content
80%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is concise, well-structured, and largely actionable, with executable evilginx commands for the core workflow. Its main weakness is the absence of explicit validation/verification checkpoints in the deploy-and-capture flow, which caps workflow clarity.
Suggestions
Add explicit validation steps after Deploy (e.g., 'verify phishlet enabled', 'confirm lures get-url returns a reachable HTTPS URL', 'confirm ACME cert issued') and after Capture (e.g., 'verify sessions <id> shows non-empty token JSON before replay').
Provide a minimal concrete phishlet YAML example in the Authoring section showing auth_tokens and a sub_filter, so authoring is copy-pasteable rather than purely descriptive.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and efficient: the intro states only the essential AiTM rationale and the rest is commands and terse directives, with no padding or explanation of concepts Claude already knows. | 5 / 5 |
Actionability | Deploy and Capture sections give copy-paste-ready evilginx console commands, but the Authoring section is descriptive guidance ('list them under auth_tokens') with no concrete phishlet YAML template, leaving a minor gap. | 4 / 5 |
Workflow Clarity | The Prereqs → Deploy → Author → Capture → Evidence → OPSEC sequence is clear, but validation checkpoints are missing or implicit (no 'verify phishlet enabled', 'confirm cert issued', or 'confirm lure URL resolves'), and the rubric caps workflow clarity at 3 without explicit verification steps. | 3 / 5 |
Progressive Disclosure | No bundle files exist and the body is ~50 lines with well-organized, clearly headed sections; per the simple-skill exception this scores 5 with clean section structure and one-level cross-skill references (lookalike-domain, lure-deconfliction). | 5 / 5 |
Total | 17 / 20 Passed |