Content
65%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A well-organized, highly actionable single-file skill with executable code, thoughtful branching (Decision Gate), and strong failure-mode coverage. Its weaknesses are the missing pre-delivery validation step in the workflow and the absence of any bundle structure despite referencing unbundled script files.
Suggestions
Add an explicit validation checkpoint before campaign delivery — e.g., open the generated HTML in a browser (or send a controlled test email) and confirm the blob download triggers before sending to targets; per the rubric, batch delivery without validation caps workflow clarity.
Move the Python generator into a bundled scripts/ file with a real argparse CLI (--payload, --filename, --mimetype, --output) so the Quick Reference command 'python3 /workspace/gen_smuggle.py ...' matches an actual bundled script instead of an inline snippet with a different signature.
Number the core workflow steps (encode payload → generate page → validate locally → deliver via GoPhish → record evidence) so the sequence is explicit rather than implied by section order, and trim the opening mechanism paragraph that re-explains HTML smuggling and recites threat actors Claude already knows.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense operational content (bypass table with MOTW/Win11 22H2 specifics, OPSEC, decision gate, detection signatures), but the opening paragraph re-explains the HTML smuggling mechanism ('HTML smuggling abuses the browser's ability to construct files from JavaScript') and cites Nobelium/Qakbot/IcedID — concepts Claude already knows — partially duplicating the description. Confined to one short paragraph, so above anchor 3 but not the lean anchor 5. | 4 / 5 |
Actionability | Nearly everything is copy-paste executable: a complete HTML smuggling template, a complete Python generator, concrete base64/curl commands with real paths and full GoPhish JSON. Not a 5 because the Quick Reference command 'python3 /workspace/gen_smuggle.py --payload ... --mimetype ... --output' does not match the provided generator, which has no CLI and no mimetype parameter, and 'smuggle_template.json' is referenced before its content exists. Far above anchor 3's pseudocode/missing-details level. | 4 / 5 |
Workflow Clarity | The sequence (prerequisites → encode → generate → deliver → evidence) is present but implicit, and there is no validation checkpoint before batch delivery — no 'test-open the HTML' or controlled test-email step, only an implicit hint ('Test in Edge (corporate default)') in OPSEC. Per the rubric's cap, a batch operation (campaign delivery) without validation cannot score above 3 despite the useful Decision Gate and Error Handling sections. Not a 2: steps, branching, and failure handling are present. | 3 / 5 |
Progressive Disclosure | No bundle files exist (no references/, scripts/, or assets/) and the skill is a ~290-line single file. The ~60-line Python generator clearly belongs in a scripts/ file — the body itself references it as a standalone path ('/workspace/gen_smuggle.py') that is not bundled. Section headers and cross-references (§3a/§3c, Decision Gate) are well signaled, keeping it above anchor 2, but inlined script content and a referenced-but-missing script file hold it below anchor 4. | 3 / 5 |
Total | 14 / 20 Passed |