Content
72%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A lean, high-signal reference of evidence standards for exploit work that respects the token budget and avoids padding. Its main weaknesses are that execution guidance is deliberately deferred to unnamed sibling skills and that the thematic sections never cohere into an explicit workflow.
Suggestions
Name the specific technique skills or domain routers to consult for test construction (or list them in a short reference table) instead of the vague "use existing technique skills".
Add one brief worked example per vulnerability class in Discriminating observables (e.g., a concrete in-band SSRF vs blind SSRF evidence pattern) to turn criteria into directly actionable checks.
Add a short ordered checklist at the top (design reproducer → verify component/protocol fidelity → establish discriminating observable → preserve artifacts) to give the thematic sections an explicit sequence.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and lean with no padding: every sentence encodes a specific evidentiary rule (e.g., "A single fast response or race win is inconclusive", "terminate only identified owned processes") and no concepts Claude already knows are re-explained. | 5 / 5 |
Actionability | Some guidance is concrete — named tools (`cve_lookup`, `cve_poc_lookup`, `payload_search`) and specific evidence criteria ("controlled identities, known object ownership and a content or state comparison", "correlated owned-listener interaction") — but key execution details are deferred to unnamed "existing technique skills" and "domain routers", and directives like "follow injected bash/session semantics" lack any example or elaboration. | 3 / 5 |
Workflow Clarity | The sections are thematic rather than sequenced; the implicit order (design reproducer → ensure component/protocol fidelity → establish discriminating observable) is never stated, and while the observables section functions as evidence-validation criteria, no explicit workflow or checkpoints connect the sections. | 3 / 5 |
Progressive Disclosure | The body is under 50 lines with no bundle files and no need for external references; it is cleanly organized into well-signaled sections (Reproducer design, Component and protocol fidelity, Discriminating observables), which satisfies the simple-skill exception. | 5 / 5 |
Total | 16 / 20 Passed |