Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, executable Android pentest playbook that respects token budget and provides concrete commands for every phase. Its main weaknesses are a handful of placeholder/vague commands and mostly implicit validation checkpoints rather than explicit ones, especially around the destructive PoC suggestion.
Suggestions
Replace placeholder paths and versions with concrete examples — e.g., show the 'adb pull' step consuming the 'pm path' output, and give a real frida-server filename pattern with the exact adb push/chmod sequence.
Add explicit validation checkpoints in the dynamic phase (confirm frida-server is running and the app is attached before hooking; verify the SSL pinning bypass took effect before intercepting traffic) and a caution note before destructive PoCs like the 'rm -rf' intent-injection example.
Consider moving the tools cheat-sheet and known-exemplars sections into a reference file so SKILL.md stays a lean overview with well-signaled one-level-deep references.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is a lean playbook of terse commands, annotated manifest signals, and compact tables that assumes Claude's competence — no padding, no explanation of concepts Claude already knows. Version references ('Android 14+', 'frida-server-16.x.x', exemplar years) carry technique-relevant signal rather than time-sensitive API-switching guidance. | 5 / 5 |
Actionability | Nearly all guidance is copy-paste ready (adb/apktool/jadx/objection commands, a complete Frida hook script, MobSF docker run, abe.jar unpack), but a few spots are placeholders or vague: 'adb pull /data/app/.../base.apk', 'frida-server-16.x.x-android-arm64', 'Or via Frida script — patches common checks', and 'TEE exploitation (rare, advanced)'. | 4 / 5 |
Workflow Clarity | Clear numbered methodology (static triage → dynamic instrumentation → attack surface → PoC framing → severity → defender) with the PoC-framing section acting as an impact-verification stage. Checkpoints are mostly implicit (confirming frida-server is running, verifying a bypass took effect before intercepting traffic) and no caution/validation precedes the destructive PoC example ('--es cmd 'rm -rf''). | 4 / 5 |
Progressive Disclosure | No bundle files exist and all content lives in a well-sectioned ~210-line body with clear headers and cross-references to sibling skills; navigation is easy. A few sections (tools cheat-sheet, known exemplars, WebView/keystore detail) could be split into reference files to keep SKILL.md a leaner overview. | 4 / 5 |
Total | 17 / 20 Passed |