Content
90%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A highly actionable, concise offensive-security skill body with concrete commands, payloads, and a verification contract. The only meaningful gap is an inline validation/feedback checkpoint within the audit workflow itself.
Suggestions
Add an explicit validation step to the audit workflow (e.g. 'For each flagged tool, re-run the approval-logic grep and confirm the gate is genuinely absent before reporting') to create a validate→fix→retry loop.
Consider moving the CVSS table and PoC payloads into a reference file referenced one level deep, keeping SKILL.md as a tighter overview.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and efficient throughout — assumes Claude's familiarity with LLM security and OWASP, with no padding; every section (recognition signals, attack vectors, audit greps, PoCs, CVSS) earns its place. | 5 / 5 |
Actionability | Provides copy-paste-ready grep commands, concrete PoC payloads with exact parameters, named tools, and a validate_finding contract with explicit success and negative patterns — fully executable guidance covering common cases. | 5 / 5 |
Workflow Clarity | The audit workflow is clearly sequenced (enumerate inventory → destructive verbs → approval logic → creds → per-tool questions) and a verification contract exists in section 6, but the audit steps themselves lack an inline validate→fix→retry checkpoint, leaving a minor validation gap. | 4 / 5 |
Progressive Disclosure | A single well-organized SKILL.md with eight clearly numbered sections and no nested references; structure is good and navigation is easy, though the CVSS table and PoC payloads could optionally be split into reference files for a fully one-level-deep layout. | 4 / 5 |
Total | 18 / 20 Passed |