Content
57%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The profile is a well-structured, information-dense adversary-emulation reference with strongly actionable emulation guidance, but it is monolithic with no progressive disclosure and lacks validation checkpoints in its destructive/batch workflows.
Suggestions
Add explicit validation/verification steps to the emulation guidance (e.g., validate the side-loading triad executes in an isolated lab before propagation testing) so workflow clarity can exceed 3.
Split the sources list and the detailed TTP/campaign catalogs into reference files (e.g., references/sources.md, references/ttps.md) and link from SKILL.md to improve progressive disclosure and conciseness.
Tighten the notable-campaigns section to the most representative operations or move the full chronology to a reference, reducing token overhead while keeping the signature plays prominent.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense, actor-specific threat intelligence (not concepts Claude already knows), but the 16-entry campaign list and 30-URL source list could be tightened or moved to references, fitting 'Mostly efficient but includes some unnecessary explanation or could be tightened'. | 3 / 5 |
Actionability | The 'Emulation guidance' section gives concrete, executable direction with specific commands and parameters (ping -n 70, rar.exe a -hp, curl to Dropbox, TLS headers '17 03 03') and named tools (Sliver, Cobalt Strike, Mimikatz), with only minor gaps. | 4 / 5 |
Workflow Clarity | Plays are organized as a categorized menu with implicit sub-sequences (the side-loading triad's steps 1-3) but lack explicit validation checkpoints or feedback loops for destructive operations (USB worm, kernel-mode driver), which caps workflow clarity at 3. | 3 / 5 |
Progressive Disclosure | Section headers are clear and well-organized, but the skill is a monolithic 250+ line file with no bundle references; content such as the sources list and full TTP catalog that could live in separate reference files is inlined. | 3 / 5 |
Total | 13 / 20 Passed |