Content
76%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, highly actionable S7 attack runbook with excellent token efficiency and concrete snap7/nmap code for nearly every task area. Its weaknesses are the absence of validation checkpoints around destructive operations (write/read-back verification, pre-stop target confirmation), which caps workflow clarity, and two hint-level sections (CVE PoC, TIA Portal) lacking executable detail.
Suggestions
Add explicit validation checkpoints for destructive operations: after db_write/write_area, re-read the area to confirm the write landed; before plc_stop, verify the target is in-scope (re-run enumeration against the exact IP/rack/slot) as a hard gate.
Make the CVE-2019-10936 section executable: include the crafted COTP/S7 request bytes or a minimal Python socket snippet instead of relying solely on an external PoC repo link that may rot.
Either give the TIA Portal section concrete commands (e.g., mssql client syntax against port 1433, project-file search paths) or move it and the Stuxnet primitives into a separate reference file to keep SKILL.md a lean overview.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean throughout: a two-line protocol fact, compact copy-paste snippets, a dense comparison table, and bullet primitives — no padding, no explanations of concepts Claude already knows. The one explanatory line ('S7 memory areas: DB (data block), M (memory bits), E (input), A (output)...') is domain-specific decoding (German-derived area codes) that earns its tokens. This matches 'Lean and efficient; every token earns its place.' | 5 / 5 |
Actionability | Most sections are executable: the nmap s7-info one-liner, snap7 connect/get_cpu_info, db_read with util.get_bool/get_int/get_real decode and set_real/db_write round-trip, plc_stop/hot_start/cold start, and write_area with the 0x84 area code. Two sections are high-level hints rather than executable guidance — the CVE-2019-10936 section just names a PoC repo ('github.com/Nibblesec/s7-info-leak') without the crafted packet, and the TIA Portal section lists actions ('Steal the project file', 'port 1433 with default sa') without commands. That fits 'Mostly executable guidance; concrete code or commands with minor gaps,' one notch below fully copy-paste-ready coverage. | 4 / 5 |
Workflow Clarity | The sections imply a sensible sequence (discover → read/write → stop/start → auth bypass → advanced primitives → OPSEC), and the OPSEC section does flag destructive risk ('plc_stop() halts whatever the PLC controls... Confirm scope authorization for stop-class testing'). But the destructive/batch cap applies: db_write, write_area, logic tampering, and plc_stop have no validation checkpoints — no read-back verification after writes, no target-confirmation step before stop-class actions, no verify-before-persist loop. Per the guideline that a skill with destructive operations and missing validation cannot score above 3, this is capped at 3 ('Steps listed but validation gaps'). | 3 / 5 |
Progressive Disclosure | The body (~105 lines) is a single cohesive runbook with clear per-task sections, and no bundle files exist — there is nothing nested or buried, and the closing References section points one level out to canonical sources (snap7 docs, Wireshark dissector, CISA advisories, Langner). Minor gap: the Stuxnet primitives, CVE detail, and TIA Portal sections are self-contained inline material that could be split into reference files if the skill grows. This lands on 'Good structure; most content is appropriately placed; minor organization gaps' rather than 5, since the under-50-line simple-skill exception does not apply. | 4 / 5 |
Total | 16 / 20 Passed |