Conciseness

The body is almost entirely terse command listings with one-line comments (e.g., "nxc smb <TARGET> -u '<USER>' -H '<NTLM_HASH>' -x 'whoami'") and comparison tables — no padding explaining concepts Claude already knows. The Quick Reference block duplicates roughly six commands that reappear verbatim in the detailed sections (nxc PtH, wmiexec.py, psexec.py, evil-winrm, smbclient.py, Ligolo setup), which is trimmable redundancy. This matches the score-4 anchor (efficient with minor instances that could be trimmed) rather than 5 (every token earning its place) and is well above 3.

Actionability

Every section provides copy-paste-ready commands with consistent placeholders, covering the common cases for each technique: PtH via nxc/impacket ("psexec.py '<DOMAIN>/<USER>@<TARGET>' -hashes :<NTLM_HASH>"), Rubeus ticket ops, Evil-WinRM sessions including in-session commands (upload/download, Bypass-4MSI), and full Ligolo/Chisel tunnel setup with both attacker and pivot-host sides. This matches the score-5 anchor: fully executable commands covering common cases.

Workflow Clarity

Sequences exist for multi-step operations (Ligolo: tuntap setup → proxy → agent connect → session → route → scan; a Decision Gate routes next steps), and prerequisites are listed for WinRM. However, no validation checkpoints appear: the tunnel workflow never verifies connectivity before scanning, and batch operations like the subnet hash spray ("nxc smb <SUBNET>/24 -u '<USER>' -H '<NTLM_HASH>' | tee pth_spray_<TARGET>.log") proceed without verify-success-before-continue steps or error-recovery guidance. Per the batch-operations cap, this holds at the score-3 anchor (sequence present but checkpoints missing), not 4.

Progressive Disclosure

The body is well-sectioned with headers, quick reference, comparison tables, and a decision gate — so it is well above the score-2 anchor (which presumes no section structure). However, all ~450 lines live in a single SKILL.md with no references/ bundle: per-technique detail (e.g., the full Rubeus/Mimikatz command sets) and the Detection Signatures reference are inlined where they could be split into one-level-deep reference files. This matches the score-3 anchor (content that should be separate is inline despite good internal structure) rather than 4.

Specificity

"Pass-the-Hash, Pass-the-Ticket, WMI/WinRM/PsExec/RDP execution, ... network tunneling with Ligolo-ng and Chisel" names concrete techniques, protocols, and tools, but items like "SMB operations" and "network tunneling" are domain labels rather than enumerated actions. This matches the score-4 anchor (several specific capabilities, minor gaps) rather than 5, which expects a comprehensive list of concrete actions.

Completeness

The "what" is clear (technique and tool enumeration for network lateral movement) and the "when" is explicitly provided via metadata.when_to_use with concrete trigger phrases, so the missing-trigger cap at 3 does not apply. Both parts are explicit and specific, matching the score-5 anchor rather than 4 (where the "when" would be only loosely specified).

Trigger Term Quality

The description plus the explicit metadata.when_to_use list ("lateral movement, pass the hash, pass the ticket, WMI exec, evil-winrm, psexec, pivot, tunnel, Ligolo, Chisel, smbexec") comprehensively covers the natural phrases a user would say, including synonyms and tool names. It fits the score-5 anchor; score 4 would require noticeable missing variations, which are not present.

Distinctiveness Conflict Risk

"Network lateral movement" scoped by PtH/PtT/WMI/WinRM/PsExec/RDP/Ligolo-ng/Chisel is a clear niche with distinct trigger terms; a user mentioning these terms would not be routed to a different skill. Minimal conflict risk, matching the score-5 anchor.