Content
75%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A compact, safety-first catalog with concrete commands, a well-sequenced assessment workflow gated by explicit safety checkpoints, and good section structure. The main gaps are command fragments instead of complete executable examples, no error-recovery feedback loops, and an unresolvable 'soundwave/' reference.
Suggestions
Provide at least one copy-paste-complete command per major step (e.g., a full 'nmap -sV -T2 --script modbus-discover -p 502 <target>' and a complete tshark capture filter) to raise actionability.
Add an error-recovery checkpoint to the protocol assessment workflow, such as what to do when a PLC stops responding mid-poll or how to verify a register/coil state after any gated write.
Resolve or clearly signal the 'soundwave/' RoE-template reference — either give a full relative path to the template file or inline the annex skeleton it points to.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean and assumes Claude's competence — no protocol tutorials or library explainers — with dense, information-carrying lines like 'nmap with -sV --script modbus-discover, bacnet-info, s7-info, dnp3-info'. A few framing sentences ('Industrial engagements are not application security with longer rules of engagement — they are a different discipline', 'The project file is the crown jewel') could be trimmed, so it is not a 5. | 4 / 5 |
Actionability | Guidance is mostly executable and concrete: 'tshark -Y modbus || tshark -Y bacnet', 'nmap with -sV --script modbus-discover ... set -T2 for production networks', project extensions '.s7p, .acd, .stp', and named tools (Snap7, python-snap7). It falls short of 5 because commands are fragments rather than copy-paste-complete invocations (no full nmap/tshark command with target and output handling). | 4 / 5 |
Workflow Clarity | The protocol assessment section gives a clear numbered sequence (passive observation → network-layer discovery → function-code polling → SIL identification → engineering workstation path) with real checkpoints: 'Read-only protocol discovery first', 'SIL 3+ devices NEVER get write probes without plant-ops sign-off', and the middleware write gate in Hard rule 1. Not 5 because there are no error-recovery feedback loops (e.g., how to respond when a device stops responding, or post-write verification). | 4 / 5 |
Progressive Disclosure | The ~70-line body is well-sectioned (Hard rules, Playbooks, Protocol assessment, Detection gap, Out of scope) with deliberate inline technique summaries explicitly declared as not separately loadable, and no bundle files exist to organize. The minor gap keeping it from 5 is the dangling 'soundwave/' RoE-template reference, which is not resolvable within the skill and is not presented as a clear path or link. | 4 / 5 |
Total | 16 / 20 Passed |