Content
75%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a well-structured, actionable adversary-emulation playbook with concrete kill-chain mapping and strong safety gating for its destructive operations. It is held back from top marks only by minor time-sensitive CTI verbosity, implicit rather than explicit validation feedback loops, and external references that cannot be verified against a bundle.
Suggestions
Move or isolate the dated CTI claims ('most prolific RaaS of 2022-2023', 'Operation Cronos in Feb 2024') into a 'CTI snapshot / may drift' note so the main flow stays evergreen and maximizes conciseness.
Add an explicit validation feedback loop for the destructive steps (e.g., 'after gating defense evasion, confirm canary-only scope before mass deployment; if scope check fails, abort and re-verify') rather than relying on the implicit deconfliction record.
Either add a references/ bundle file for apt-groups.md or reword the in-body pointers so navigation targets are unambiguous and verifiable within the skill bundle.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and assumes Claude's competence — MITRE TTPs are named without explanation and there is no concept padding — but time-sensitive CTI phrasing ('most prolific RaaS of 2022-2023, disrupted by Operation Cronos in Feb 2024') is not isolated in a deprecated section, which the rubric flags. Not a 5 due to that minor time-sensitive verbosity; not a 3 because the body is otherwise efficient. | 4 / 5 |
Actionability | A concrete kill-chain table maps each phase to MITRE, an emulated action, and a specific executing-agent skill path, plus a copy-paste ThreatProfile JSON seed and numbered CONOPS — mostly executable guidance. Minor gaps: the referenced paths point to other skills rather than inline commands, so not fully copy-paste ready. | 4 / 5 |
Workflow Clarity | The kill chain is clearly sequenced via the 10-phase table and numbered CONOPS, and destructive steps have explicit safety gates (lab/canary-only markers, an EMERGENCY abort, deconfliction recording). Not a 5 because the validate-fix-retry loop is only implicit via cleanup/deconfliction rather than an explicit re-check step. | 4 / 5 |
Progressive Disclosure | A single self-contained body with well-organized section headers; the two apt-groups.md references are clearly signaled one-level-deep pointers. Not a 5 because those references point outside this skill's bundle (no references/ dir exists to verify), leaving minor navigation ambiguity. | 4 / 5 |
Total | 16 / 20 Passed |