Content
83%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, highly actionable offensive skill: every command is copy-paste-ready and token-efficient, with clean sectioning. The main weakness is workflow clarity — no validation that an upload was accepted and no feedback loop for iterating bypass techniques — which caps it despite the excellent actionability.
Suggestions
Add a verification checkpoint after each upload attempt (e.g., check the HTTP response body/status for acceptance or a blocklist error before assuming success).
Add an explicit feedback loop: if a technique fails, advance to the next bypass family (extension → content-type → magic bytes → .htaccess) rather than leaving the ordering implicit in section layout.
Consider moving the long extension/content-type bypass catalogs into a references/ file if the skill grows, keeping SKILL.md as the quick-start overview.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean and code-first: a two-sentence purpose statement followed by commented, self-explanatory commands. It assumes Claude's competence (no explanation of what a webshell or .htaccess is beyond one-line 'why' comments), so every token earns its place — matches the anchor-5 example. | 5 / 5 |
Actionability | Every section is copy-paste-ready bash: discovery greps, a webshell one-liner, an executable extension-fuzzing loop, curl content-type overrides, .htaccess upload, and post-exploitation extraction commands. The common cases are fully covered with executable code, matching anchor 5; no pseudocode or gaps. | 5 / 5 |
Workflow Clarity | A sensible sequence exists (Discovery → upload → bypass techniques → post-exploitation) and the PHP section has one explicit checkpoint (HTTP 200 probe loop), but uploads are never validated for acceptance vs. rejection and there is no feedback loop telling Claude to iterate to the next bypass technique on failure — checkpoints are otherwise implicit, matching anchor 3 rather than 4. | 3 / 5 |
Progressive Disclosure | No bundle files exist; the skill is a single ~100-line file with clear, well-ordered section headers and zero reference nesting. Good structure and easy navigation, but at ~100 lines (above the under-50-lines simple-skill exception) the technique catalog could arguably live in a reference file — solidly anchor 4. | 4 / 5 |
Total | 17 / 20 Passed |