Content
75%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong, phase-structured attack playbook with genuinely executable asyncua code, sensible safety gates on write-class and DoS operations, and dense OPSEC detail. The main weaknesses are minor: a few snippets have small correctness gaps (credential timing, undefined variables), a touch of intro padding, and some long material that could be split into reference files.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is code-dominant and lean, with prose that adds non-obvious intel (SecurityMode/token enum values, audit NodeIds like ns=0;i=2994, NDR detection notes). Minor over-explanation remains — the vendor-listing intro sentence and a couple of asides like 'GetEndpoints is always available without a session' restate knowledge Claude already has or could be trimmed. | 4 / 5 |
Actionability | Real asyncua idioms throughout — correct exception types (uaerrors.BadUserAccessDenied, BadIdentityTokenRejected), enum decoding, and per-phase runnable scripts. Minor gaps: the brute-force snippet sets credentials inside 'async with Client(...)' where asyncua connects at __aenter__, so the credentials apply after the session is already open, and the Phase 4 fingerprint and Phase 6 method-enumeration snippets reference an undefined 'url' variable. | 4 / 5 |
Workflow Clarity | A clear Phase 1–7 sequence with authorization safety gates ('STOP. Write-class authorization required before executing this phase') and version-check verification before DoS testing, plus exception branches that interpret results ('server may be saturated'). Not fully a 5 because there are no explicit validate→fix→retry feedback loops and some checkpoints exist only as prose gates rather than in-workflow steps. | 4 / 5 |
Progressive Disclosure | Single-file skill with no bundle; sections are well-organized (phases, findings table, evidence, OPSEC, references), navigation is flat, and no references are nested or buried. At ~360 lines, extended material such as the browse-recursion code, credential list, and CVE details could arguably live in reference files, which keeps this below a 5. | 4 / 5 |
Total | 16 / 20 Passed |