Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a lean, highly actionable playbook of executable curl commands spanning detection, cloud metadata exploitation, internal scanning, bypass techniques, and pivot strategy, anchored by an explicit dead-end circuit breaker with a concrete validation script. The main gaps are the implicit (never enumerated) workflow sequence and some duplication of the fetch-url curl pattern across sections.
Suggestions
Consolidate the repeated 'curl <TARGET>/fetch?url=... -o ...' pattern (detection, file://, and admin-port probe sections) into one parameterized example or a short table to reduce duplication.
Add a brief numbered workflow at the top (1. detect via callback, 2. test localhost/metadata, 3. scan internal, 4. attempt bypasses, 5. pivot on dead end) to make the section order an explicit sequence rather than an implicit one.
Move the Gopher payload and the IP-variation catalog into a references/ file if the bundle grows, keeping SKILL.md as the overview with clearly signaled one-level references.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and lean — executable commands with terse comments ('Decimal: 2130706433', 'Hex: 0x7f000001') and no explanation of concepts Claude already knows; the circuit-breaker prose earns its place as operational guidance. It falls short of 5 because the detection, file://, and admin-port-probe sections repeat the same 'curl <TARGET>/fetch?url=... -o ...' pattern in ways that could be consolidated. | 4 / 5 |
Actionability | Fully executable, copy-paste-ready curl commands cover the common cases: callback detection, AWS/GCP/Azure/DigitalOcean metadata with exact required headers ('-H Metadata-Flavor: Google'), port and internal-network scan loops, a fully URL-encoded Gopher Redis payload, and concrete markdown/HTML/webhook SSRF vectors. This matches the anchor for copy-paste-ready commands covering common cases. | 5 / 5 |
Workflow Clarity | Section ordering (detection → metadata → scanning → bypass → pivot) implies a clear sequence, and the mandatory circuit-breaker provides an explicit validation feedback loop — the md5 response-signature check with a 3-strike stop, PIVOT.md documentation, and an enumerated pivot list — so the batch-operation cap does not apply. It is not 5 because the overall workflow is never explicitly enumerated as steps; the sequence is implicit in section order. | 4 / 5 |
Progressive Disclosure | Sections are well organized and cross-references ('see ssti.md Twig Multi-surface rendering rule', 'recon SUMMARY.md', 'exploit/PIVOT.md') are one level deep and inline-signaled. It is not 5 because reference-style catalogs (IP-variation table, the Gopher payload) are inlined in a 157-line SKILL.md rather than split into a references/ file, and the referenced files are not part of this bundle. | 4 / 5 |
Total | 17 / 20 Passed |