Content
72%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An exemplarily lean principles document that adds only expert DFIR judgment Claude would not produce on its own (provenance discipline, correlation over proximity, evidentiary limits on IOCs and ATT&CK mappings). Its weakness is that all execution detail is externalized to sibling technique skills, leaving the guidance concrete in direction but never in application — no examples, commands, or mini-procedures bridge principle to practice.
Suggestions
Add one worked micro-example per principle, e.g. correlating a Sysmon process GUID across EVTX and Zeek session logs instead of timestamp proximity.
Include a compact provenance checklist template (source, hash algorithm, TZ/offset, parser version, collection gap notes) that can be copied directly into case notes.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Every sentence carries non-obvious expert guidance ("A nearby log line is a lead, not causation"; the six-field provenance list; "ATT&CK mappings require a supported technique, not merely a tool name") with zero padding and no explanation of concepts Claude already knows. Tools are named without elaboration, fully assuming competence. | 5 / 5 |
Actionability | There are concrete directives (record acquisition source, hash, timezone, clock offset, collection gaps, parser version; prefer shared identifiers over temporal proximity; work on copies; IOC context fields), but nothing is executable and implementation is deferred wholesale to "the relevant existing technique skills". As an instruction-only skill it is not penalized for lacking code, yet no worked example or specific procedure illustrates how to apply the principles, which sits between the incomplete and mostly-executable anchors. | 3 / 5 |
Workflow Clarity | The body explicitly disclaims a stage order ("they do not define an engagement stage order"), presenting principles rather than a sequence, and validation is only implicit ("a parsed view must remain traceable to original bytes" gestures at verification without a checkpoint or recovery loop). Not 2 because the guidance itself is coherent and specific rather than gapped; not 4 because no ordered steps or explicit checkpoints exist. | 3 / 5 |
Progressive Disclosure | The body is under 50 lines with no bundle files present and no content that needs splitting; per the rubric's simple-skill provision, well-organized sections suffice. The two sections ("Evidence-source selection", "Correlation and uncertainty") are clearly headed, and format-specific detail is appropriately delegated one level out to sibling dfir skills rather than inlined. | 5 / 5 |
Total | 16 / 20 Passed |