Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, highly actionable playbook: every phase delivers executable commands with concrete paths, hash modes, and detection patterns, sequenced logically with useful OPSEC framing and evidence-capture guidance. The main improvement opportunities are trimming small pockets of restated knowledge and moving the inline vendor default-credential lookup table into a references file.
Suggestions
Move the vendor default-credential matrix (Phase 6) into a references/ file (e.g., references/default-creds.md), keeping only the cross-reference commands inline — it is lookup data that duplicates the linked SecLists resource and inflates the SKILL.md body.
Trim minor over-explanations such as the hash-prefix legend comment in Phase 1; Claude already knows $1$/$5$/$6$ hash identifiers.
Add a brief fallback path for Phase 1 when cracking fails (e.g., try john's incremental mode or move on to Phase 4 strings sweep) to complete the workflow's feedback loop.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dominated by lean, comment-terse command blocks ("ROOT=/tmp/squashfs_root # set once; referenced throughout") with no padded prose or tool tutorials. Minor over-explanation remains: the hash-type legend comment ("# $1$ = MD5, $5$ = SHA-256, $6$ = SHA-512, $y$ = yescrypt, no-$ = DES") restates knowledge Claude already has, and the 10-row vendor default-credential table duplicates SecLists content already linked in References. This fits anchor 4 (efficient with minor trimmable instances), not 5. | 4 / 5 |
Actionability | Every phase consists of copy-paste-ready, fully executable commands with concrete paths and arguments: "hashcat -m 1800 \"$ROOT/etc/shadow\" /usr/share/wordlists/rockyou.txt", "unshadow ... | john ... --wordlist=", "trufflehog filesystem \"$ROOT\" --only-verified", plus specific detection regexes ("AKIA[0-9A-Z]{16}", "eyJ[A-Za-z0-9+/=]+\.[A-Za-z0-9+/=]+\.[A-Za-z0-9+/=_-]+") and a fill-in evidence-capture block. This matches the anchor-5 standard of executable commands covering the common cases. | 5 / 5 |
Workflow Clarity | A clear phased sequence (Phase 1 account databases → 2 SSH/dropbear keys → 3 web creds → 4 strings sweep → 5 MQTT/cloud tokens → 6 default-cred cross-reference → 7 TLS keys) with prerequisites up front and evidence capture at the end. Verification checkpoints exist ("|| echo 'shadow not present'" fallback, the Phase 7 modulus-MD5 key/certificate match check "Matching MD5 = key pair is valid and present on device"), but feedback loops are incomplete — e.g., no guidance on what to try when hashcat/john fail to crack or when a tool is missing. This is anchor 4 (clear sequence, most checkpoints, minor gaps); the destructive/batch cap does not apply since the workflow is read-only against an extracted image. | 4 / 5 |
Progressive Disclosure | The skill is a well-organized single file: numbered phase headers, prerequisites, OPSEC notes, and a References section of one-level-deep external URLs — nothing is buried or nested. No bundle files (references/, scripts/, assets/) exist, so nothing is misfiled. However, the ~30-line vendor default-credential matrix in Phase 6 is inline lookup data that could live in a references/ file, which keeps this at anchor 4 (good structure, minor organization gaps) rather than 5 for a 240-line document. | 4 / 5 |
Total | 17 / 20 Passed |