Content
76%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, highly actionable skill whose curl flow is nearly executable as-is; its main weaknesses are literal placeholders in two payloads and the absence of pre-launch validation checkpoints for what is a batch, externally-visible send operation. The OPSEC/failsafe section partially compensates but does not replace verify-before-launch steps.
Suggestions
Insert validation checkpoints before launch: after each create call, verify the resource exists (e.g., GET the template/page/smtp by name) and send a test email to a controlled address before launching the campaign at the group.
Replace literal placeholders with concrete minimum-viable examples — a working capture-credentials form for the landing page and a real username field (secret sourced from env) for the SMTP profile.
Show the pause/complete command as a concrete executable with the campaign id substituted from the launch response (e.g., capturing the id from the POST /campaigns/ result), so the failsafe is copy-paste ready under time pressure.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and efficient throughout: no concept explanations, no padding — every section (Prerequisites, Flow, Evidence, OPSEC) carries operational information Claude does not already know, and the intro is two sentences that do real routing work (fake login page vs. evilginx2 for MFA). | 5 / 5 |
Actionability | Six numbered curl commands with real, runnable JSON payloads against the actual GoPhish endpoints. Not fully copy-paste ready, though: literal placeholders remain ('"username":"..."', '"html":"<form>...</form>"') and the pause command's ':id' is unsubstituted, which fits 'concrete code with minor gaps' rather than anchor 5. | 4 / 5 |
Workflow Clarity | The sequence is clearly numbered (SMTP -> group -> template -> page -> launch -> poll) and includes a failsafe (gophish_pause_campaign) and send-rate limits, but there is no pre-launch validation — no check that each resource was created, no test send to verify SMTP/template before launching the batch send to the whole group. A campaign launch is a batch operation, and the rubric caps workflow clarity at 3 without validation checkpoints. | 3 / 5 |
Progressive Disclosure | No bundle files exist, and the ~64-line body is well-organized into cleanly signaled sections with the full API flow inline — appropriate at this size, though slightly over the 'under 50 lines' bar that would let well-organized sections alone score 5. Cross-references to sibling skills (lookalike-domain, pretext-engineering) are clearly named rather than linked, a minor organization gap. | 4 / 5 |
Total | 16 / 20 Passed |