Content
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, domain-rich operational runbook with strong concrete commands and a clear phased sequence, held back by ellipsized/undefined helpers, missing validation checkpoints for the batch read, and an all-inline structure that could benefit from splitting peripheral sections into references.
Suggestions
Replace the "ldapsearch ..." ellipses with complete, executable commands (full flags and base DN) so every code block is copy-paste ready.
Add an explicit validation checkpoint before the bulk read — e.g. verify ReadLAPSPassword access on a single target and confirm the attribute is populated before scraping the domain — plus an error-recovery note if the query returns empty.
Document or bundle the "laps_ingest" helper (or replace it with a concrete kg_add_node sequence), and consider moving Defender remediation, CVSS, and Known exemplars into reference files to keep SKILL.md as a lean overview.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly lean operational content (exact ldapsearch filters, BloodHound query, impacket helper, event 4662), but the intro re-explains what LAPS is and the CVSS/Known-exemplars sections add length that could be trimmed; it is not a 3 because not every token earns its place. | 2 / 3 |
Actionability | Many commands are real and copy-paste ready, but repeated "ldapsearch ..." ellipses and an undefined "laps_ingest" helper are incomplete rather than fully executable; it is not a 1 because the majority of the guidance is concrete and specific. | 2 / 3 |
Workflow Clarity | A clear numbered sequence (detect, find readers, read, ingest, crack, auth) is present, but there are no explicit validation checkpoints or error-recovery loops for the batch password read, which the rubric caps at 2 for batch operations. | 2 / 3 |
Progressive Disclosure | Content is well-sectioned (not a monolithic wall), but at ~120 lines it is entirely inline with no external references, and sections like Defender remediation and Known exemplars could be split out; it is not a 3 because no one-level-deep references are signaled. | 2 / 3 |
Total | 8 / 12 Passed |