Content
57%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The content is a well-structured, actionable adversary-emulation profile with concrete CVEs, tooling, and tradecraft, but it is verbose, lacks explicit workflow validation checkpoints, and keeps all detail inline rather than splitting long reference material into separate files.
Suggestions
Add explicit validation/verification checkpoints to the emulation guidance (e.g. confirm payload detonates, verify C2 check-in, validate collected data before exfil) to raise workflow clarity above the cap.
Move the lengthy 'Notable campaigns' histories and 'Detection & defense' detail into separate reference files (e.g. CAMPAIGNS.md, DETECTION.md) linked from the overview to improve progressive disclosure and conciseness.
Trim the campaign narrative prose to the TTP-relevant facts so the body stays focused on emulation tradecraft.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense and threat-actor-specific rather than explaining basics Claude knows, but the lengthy historical campaign narratives and broad detection section add padding that could be trimmed for an emulation-focused skill. | 3 / 5 |
Actionability | The emulation guidance gives concrete, specific direction — named CVEs (CVE-2017-11882, CVE-2017-0199), a real PowerShell pattern, target file extensions, AES+base64 encoding, and named tools (QuasarRAT/Sliver) — with only minor gaps around how to actually obtain or build the exploits. | 4 / 5 |
Workflow Clarity | TTPs are organized by ATT&CK tactic giving an implicit kill-chain sequence, but there are no explicit validation checkpoints or feedback loops, and the rubric caps destructive/batch-operation workflows at 3 when validation is missing. | 3 / 5 |
Progressive Disclosure | Section headers provide reasonable structure, but at ~180 lines the campaign histories, full TTP catalog, and detection guidance are all inlined in one file with no one-level-deep reference files, despite no bundle files existing to offload them. | 3 / 5 |
Total | 13 / 20 Passed |