Content
57%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The profile is well-structured and gives concrete, kill-chain-sequenced emulation guidance with a strong tooling/TTP reference, but it is a long monolithic document with no progressive disclosure and lacks validation checkpoints for its destructive operations. Splitting reference material into bundled files and adding verification steps would raise the weakest dimensions.
Suggestions
Move the dated campaign timeline, exhaustive ATT&CK TTP enumeration, and tooling table into separate reference files (e.g. references/campaigns.md, references/ttps.md) and link them one level deep from SKILL.md.
Add explicit validation/verification checkpoints to the emulation guidance for destructive, credential-harvesting, and batch operations (e.g. confirm scope/authorization before each phase, verify payload in a sandbox before delivery).
Trim or relocate time-sensitive dated material to a dedicated section so the core emulation workflow stays lean in the context window.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and mostly assumes Claude's competence (no basic-concept padding), but the full dated campaign timeline and exhaustive ATT&CK sub-technique enumeration are heavy, time-sensitive reference material that could be tightened or split out, matching the 'mostly efficient but could be tightened' anchor. | 3 / 5 |
Actionability | The Emulation guidance section gives concrete, mapped instructions ('set up lookalike login pages (Google, Naver, Kakao) with DMARC-abusing sender spoofing', 'Use Sliver (c2 skill) as primary HTTPS C2', 'exfiltrate on 10-minute automated intervals'); as an instruction-only skill this is actionable with only minor gaps. | 4 / 5 |
Workflow Clarity | Plays are sequenced by kill-chain phase (Initial Access through Exfiltration/Anti-analysis) with an authorized-use caveat, but there are no explicit validation/verification checkpoints for the destructive and credential-harvesting operations described, which caps workflow clarity at 3. | 3 / 5 |
Progressive Disclosure | Section headers give the monolithic file some navigability, but no bundle files exist and bulk reference content (campaign timeline, full TTP enumeration, tooling table, sources) is fully inlined rather than split into one-level-deep references. | 3 / 5 |
Total | 13 / 20 Passed |