Content
68%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A lean, highly actionable command catalog for mobile security reconnaissance that stays terse and assumes Claude's competence. Its weaknesses are the absence of a sequenced analysis workflow with validation/triage checkpoints, and a couple of commands that are slightly inaccurate or reference tools (openssl, yara) never demonstrated.
Suggestions
Add an explicit workflow ordering the sections (e.g., extract package info → decompile → scan manifest/config → grep for secrets and insecure storage → triage findings), since the current smali/ greps silently presume a prior apktool decompile.
Include a findings-triage step — e.g., distinguishing real AWS keys from false positives when grepping strings output — to give the recon process validation checkpoints.
Fix or demonstrate the tools listed without usage (openssl, yara) and correct commands that treat an .ipa as a directory ('plutil -p {ipa_path}/Payload/*.app/Info.plist' needs an extracted Payload first).
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is a lean command catalog that assumes Claude's competence — no explanations of what APKs, certificates, or SharedPreferences are. Minor trimmable padding exists: the meta-sentence 'This skill enables autonomous agents to analyze mobile applications for security issues' and repeated `strings` usage across sections 2 and 4. Matches the score-4 anchor (efficient, minor instances that could be trimmed), not 5. | 4 / 5 |
Actionability | Predominantly concrete, executable bash commands with parameterized paths (e.g., 'apktool d {apk_path} -o output_dir', 'grep -E "(AKIA|ASIA)[0-9A-Z]{16,}" strings_output.txt'). Minor gaps keep it below 5: 'openssl' and 'yara' appear in the tools table with no usage shown, and 'plutil -p {ipa_path}/Payload/*.app/Info.plist' treats an .ipa archive as a directory rather than an extracted payload. | 4 / 5 |
Workflow Clarity | The body is organized as ten parallel reference sections rather than a sequenced analysis workflow — ordering is only implicit (the smali/ greps presume a prior apktool decompile) and there are no validation or triage checkpoints (e.g., confirming grep hits are not false positives). Matches the score-3 anchor (sequence present but implicit, checkpoints missing); not 4, which requires most checkpoints present. Operations are read-only, so the destructive/batch cap does not apply. | 3 / 5 |
Progressive Disclosure | Well-organized numbered sections with clear headers and a tools summary table make the ~6KB catalog easy to navigate, with everything one level deep in SKILL.md (no bundle files exist, so nothing is nested or buried). Matches the score-4 anchor (good structure, most content appropriately placed, minor organization gaps — Android/iOS detail could arguably live in references/); not 3 since navigation is easy and no reference is unclear. | 4 / 5 |
Total | 15 / 20 Passed |