Content
77%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An exceptionally actionable exploitation reference: executable commands, ordered procedures, explicit verification steps, and hard-won failure-mode guidance (cookie-gating checkpoint, SSRF body-control gotcha, custom-gadget pitfalls). Its weaknesses are repeated guidance across sections and a monolithic single-file structure that inlines advanced deep-dives which belong in separate reference files.
Suggestions
Move the multi-service SSRF+PHAR chain and the custom PHAR builder into one-level-deep reference files (e.g. references/phar-ssrf-chain.md, references/custom-gadget.md), keeping SKILL.md as identification signatures plus per-stack payload generation and the standard PHAR flow.
Deduplicate repeated passages: the endpoint-permutation rationale (stated in bash comments and again in 'Why permutation matters'), the two near-identical 'Generality' notes, and the upload/trigger wiring repeated across the standard, SSRF, and custom-builder sections.
Add injection examples for the .NET and Python sections (parity with the Java curl example) so all four stacks show generate-plus-deliver.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly dense, non-obvious expert material (PHAR stream-wrapper triggers, the SSRF body-control gotcha and workaround ladder, custom-gadget pitfalls like namespace-aware serialization and \x00*\x00 visibility encoding) that Claude largely does not already know. But there is more than minor trimmable material: the endpoint-permutation rationale appears both as bash comments and again in the "Why permutation matters" paragraph, the "Generality" note appears twice nearly verbatim, and the PHAR upload/trigger wiring is repeated across three sections. That fits anchor 3 ('could be tightened') better than anchor 4 ('minor instances'). | 3 / 5 |
Actionability | Fully executable, copy-paste-ready commands throughout: "phpggc -p phar -o exploit.phar Monolog/RCE6 system 'id > /tmp/pwn'", the complete heredoc PHP PHAR builder, the curl permutation loop with status/size output, ysoserial.net with concrete machineKey flags, and the pickle __reduce__ generator. The common cases (Java and PHP generate-plus-inject flows) are covered end to end with verification steps, matching anchor 5. | 5 / 5 |
Workflow Clarity | Multi-step processes are explicitly sequenced with validation checkpoints and error-recovery loops: the auth-cookie checkpoint ("Replay with the gating cookie attached before concluding the chain or gadget is wrong", "Only then consider sink-side causes"), the ordered workaround ladder (1→5), "Verify execution via the chain's side-effect (file write, HTTP callback, DNS)", and signature verification via "php -d phar.readonly=0 -r '... getSignature()'". The pitfalls section covers silent-failure recovery, so the missing-validation cap does not apply. | 5 / 5 |
Progressive Disclosure | Section headers are clear and well-ordered, but everything is inlined in a single ~296-line SKILL.md with no bundle files at all. The multi-service SSRF+PHAR chain (~110 lines) and the custom PHAR builder (~80 lines) are advanced deep-dives that belong in one-level-deep reference files. This fits anchor 3 ('content that should be separate is inline') rather than anchor 2, since structure is genuinely good, and not anchor 4, since the split is more than a minor organization gap. | 3 / 5 |
Total | 16 / 20 Passed |