Content
85%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An outstandingly actionable exploit playbook: executable commands, explicit decision rules, calibration steps, and bounded-retry pivot rules make the workflows unambiguous to follow. The weaknesses are minor duplication of payloads across sections and the absence of any progressive-disclosure split despite substantial length.
Suggestions
Split per-engine payload catalogs into references/ files (e.g. references/django.md, references/twig-sandbox.md) loaded only after fingerprinting identifies the engine, keeping SKILL.md to detection, fingerprinting, and decision rules.
Deduplicate the Jinja2 globals payloads: the 'Common RCE payloads' comment block in the Jinja2 section repeats payloads that reappear under 'Alternative globals-based RCE' — keep one canonical location.
State the top-level sequence explicitly at the top (fingerprint → confirm engine → apply engine section → follow blind/sandbox variants only if reflection is absent), so the section-level triggers hang off one master workflow.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Nearly every token is an executable payload, a terse decision rule, or genuinely non-obvious expert knowledge (e.g. the Django messages.storages.0.signer.key mechanism), with no explanation of concepts Claude already knows. Minor duplication keeps it below 5: Jinja2 globals payloads appear both as comments in the Jinja2 section and again in full under 'Alternative globals-based RCE', and the 'Common RCE payloads' comment blocks repeat later content. | 4 / 5 |
Actionability | Fully copy-paste-ready curl commands throughout — polyglot detection probes, per-engine RCE payloads, an executable subclass-enumeration script with concrete index guidance, a complete boolean-extraction bash loop with calibration, and a fingerprinting table with expected outputs. Not level 4: the examples comprehensively cover the common cases with specific commands and observable results (49, 7777777, 200/500). | 5 / 5 |
Workflow Clarity | Explicit validation and feedback loops throughout: numbered decision flows for blind SSTI and the 5xx oracle (calibrate → extract → pivot), the 'attempt login FIRST' fast-path ordering, the multi-surface store→probe-every-surface sequence, and 3-strike pivot rules that bound dead-end iteration. Calibration before the batch oracle loop is an explicit checkpoint, matching the level 5 anchor. | 5 / 5 |
Progressive Disclosure | A single 317-line self-contained file, well-organized by engine with clear headers — but the under-50-lines self-containment exception does not apply at this length, and engine-specific payload catalogs (especially the ~70-line Django deep-dive and sandbox-bypass payload lists) are inline content that belongs in references/ files loaded only for the detected engine. Structure itself is good, so this sits at the 'content that should be separate is inline' anchor rather than the minimal-structure level 2. | 3 / 5 |
Total | 17 / 20 Passed |