Content
57%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A thorough, well-structured adversary-emulation profile with concrete command-level actionability and strong safety framing, but it is a monolithic single-file document with no progressive disclosure and lacks explicit validation checkpoints for its destructive emulation steps. Splitting stable reference material into bundle files and adding verify-then-proceed gates would raise the weaker dimensions.
Suggestions
Move the notable-campaigns timeline, the full ATT&CK TTP catalog, and the signature-tooling list into references/ files (e.g., CAMPAIGNS.md, TTPS.md, TOOLING.md) with clear one-level-deep links from SKILL.md to improve progressive disclosure.
Add explicit validation checkpoints to the emulation guidance (e.g., 'Confirm written scope/ROE before each phase', 'Verify benign canary target is isolated before running the ransom routine') to lift workflow clarity above the destructive-operation cap of 3.
Tighten the attribution and notable-campaigns prose into terse bullet entries to reduce token cost without losing operational detail.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense reference material with little explanation of concepts Claude already knows, but the narrative attribution and notable-campaigns sections contain prose padding that could be tightened, placing it at 3 rather than 4. | 3 / 5 |
Actionability | The emulation-guidance section maps each TTP chain to specific Decepticon skills and concrete commands (`net group`, `csvde.exe`, `sc start sshd`, `certutil`), and the detection section gives specific alert signatures; minor gaps keep it at 4 rather than fully copy-paste-ready 5. | 4 / 5 |
Workflow Clarity | The emulation chain is sequenced by attack phase with explicit safety guardrails ('Do not encrypt real data', 'isolated directory'), but there are no validation checkpoints or verify-then-proceed feedback loops for the destructive ransomware step, which caps workflow clarity at 3 per the rubric. | 3 / 5 |
Progressive Disclosure | No bundle files exist and the ~150-line document inlines campaigns, the full TTP catalog, and the tooling list into SKILL.md with good headers but no one-level-deep reference files; content that could be split is inline, matching the 3 anchor. | 3 / 5 |
Total | 13 / 20 Passed |