Content
47%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill is richly sourced and actionable for emulation mapping, but it is an over-long monolithic dossier with no progressive disclosure and no sequenced validation workflow, which hurt conciseness, progressive disclosure, and workflow clarity.
Suggestions
Split the campaign chronology, full ATT&CK technique catalogue, and tooling table into reference files (e.g., references/campaigns.md, references/ttps.md, references/tooling.md) and keep SKILL.md as a concise overview that links to them.
Add an ordered end-to-end emulation workflow with explicit validation checkpoints (e.g., build payload → validate in isolated lab → execute → collect → verify telemetry) instead of tactic-grouped bullet lists.
Trim background explanation Claude already knows (group history prose, exhaustive sector/region enumerations) to reduce token load.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is a ~270-line encyclopedic dossier that explains background Claude can largely infer (group history, full campaign chronology, sector/region lists) and reproduces near-complete ATT&CK technique catalogues — substantial padding that competes with context budget. | 2 / 5 |
Actionability | The 'Emulation guidance' section provides concrete, executable mappings (specific tools like Sliver, Mimikatz, CrackMapExec, Rclone; named registry keys; command examples like net user /domain and makecab.exe) with only minor gaps in copy-paste-ready code. | 4 / 5 |
Workflow Clarity | TTPs are organized by ATT&CK tactic and emulation guidance is grouped by objective, but there is no sequenced end-to-end emulation workflow with validation checkpoints — the destructive/batch caveat (ransomware/DarkBit) is noted but no validate→fix→retry feedback loop is specified, capping the score at 3. | 3 / 5 |
Progressive Disclosure | No bundle files exist (references/, scripts/, assets/ absent) and all content is inlined into a single monolithic file; large reference material (full tooling table, campaign list, ATT&CK catalogue) that belongs in separate files is inlined with limited internal navigation beyond tactic headers. | 2 / 5 |
Total | 11 / 20 Passed |