Content
96%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, highly actionable offensive-security skill body that is token-efficient and pairs a clear audit workflow with an explicit finding-validation contract. The only minor gap is progressive disclosure: it is a single long file that could offload some payload/CVSS detail to references.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and token-efficient: it assumes Claude knows what XSS/SQLi/SSTI are and spends tokens on payloads, grep commands, and tables rather than concept explanations; every section earns its place. | 5 / 5 |
Actionability | Fully executable guidance throughout — copy-paste grep recipes, concrete attack payloads, ready-to-send PoC prompts, and explicit CVSS vectors covering the common cases. | 5 / 5 |
Workflow Clarity | Sequenced audit workflow (find sinks via grep → ask 3 validation questions per sink → exploit → validate) with an explicit validate_finding contract providing success/negative patterns and a negative_command feedback loop. | 5 / 5 |
Progressive Disclosure | Well-organized into 8 clearly headed sections with no nested references and no bundle files to mismanage, but at ~155 lines some material (full PoC payload set, CVSS table) is inline rather than split into reference files. | 4 / 5 |
Total | 19 / 20 Passed |