Content
78%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An unusually actionable, executable runbook: nearly every line is a real command, sequencing is reinforced by a decision gate and error-handling guidance, and there is no concept-explanation padding. The two structural weaknesses are inlined content that belongs in reference files (progressive disclosure) and duplicated Quick Reference / repeated loop scaffolding that inflates token cost.
Suggestions
Move per-service pivoting details (section 6), detection signatures, and the tools table into a references/ file (e.g., references/pivoting.md, references/detection.md) and keep SKILL.md as a lean overview with one-level-deep, clearly signaled pointers.
Delete or shrink the Quick Reference block — its five commands reappear verbatim in sections 1–4, so it duplicates content rather than adding value; alternatively keep only commands not shown later.
Define the per-project enumeration loop once (e.g., a short shell function or a single "for each project" convention stated in section 1) and reference it from sections 4–6 instead of repeating the full `for proj in $(jq ...)` scaffolding 8+ times.
Add explicit verify steps after destructive persistence actions (e.g., re-run `gcloud organizations get-iam-policy` after `add-iam-policy-binding` to confirm the binding applied).
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is almost entirely executable commands with terse comments and assumes Claude's competence — no padding explaining what GCP, IAM, or jq are. It is not a 5 because the "Quick Reference" block duplicates commands that reappear verbatim in sections 1–3, and the `for proj in $(jq -r '.[].projectId' all_projects.json)` enumeration scaffolding is repeated verbatim 8+ times across sections, which could be defined once and reused. | 4 / 5 |
Actionability | Copy-paste-ready gcloud/gsutil/kubectl/curl commands with real flags, working jq filters, computed variables (e.g., `ORG_ID=$(gcloud organizations list --format="value(ID)" | head -1)`), and cross-section state files (all_projects.json produced in section 1, consumed in sections 4–6). This matches the fully-executable anchor covering the common cases; the 4 anchor would require missing key details, and the impersonation chains, org-policy bypasses, and secret-extraction one-liners are all concrete and complete. | 5 / 5 |
Workflow Clarity | Sections 1–7 form an explicit escalation sequence (enumerate → impersonate → bypass org policy → pillage Terraform state → pivot via GKE/cross-service → persist), the "Decision Gate" adds conditional branching on achieved access state, and "Error Handling & Edge Cases" supplies recovery paths (e.g., "Org-level permissions denied: start with project-level SA, enumerate impersonation chains to find a path upward"). It is not a 5 because some checkpoints are implicit — destructive persistence actions (add-iam-policy-binding, roles create, keys create) have no verify step confirming the change took effect. | 4 / 5 |
Progressive Disclosure | The body has well-organized section headers, but there are no bundle files and no references to any — everything (per-service pivoting details, detection-signature tables, tools list, GKE escape payloads) is inlined in a ~370-line monolithic SKILL.md. Content that clearly belongs in separate reference files (e.g., a cross-service pivoting reference or detection-signatures reference) is inline, matching the "should be separate is inline" anchor; it is not a 2 because internal structure and navigation via headers are good, and the sub-50-line simple-skill exception does not apply at this length. | 3 / 5 |
Total | 16 / 20 Passed |