Content
65%Weight 40%Scale 1-3Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body delivers concrete, actionable emulation and detection guidance grounded in specific CVEs and tradecraft, but it is verbose with background narrative, lacks validation checkpoints in its kill-chain workflow, and is monolithic with no progressive disclosure.
Suggestions
Condense the attribution, targeting, and campaign-narrative sections to only what drives emulation decisions, trimming the threat-intel-report prose to improve token efficiency.
Add explicit validation checkpoints to the emulation workflow (e.g., verify the document exploit fires, confirm the C2 beacon before exfiltrating) to add the missing feedback loops.
Split the detailed TTP catalog, campaign history, and detection guidance into reference files (e.g., TTPS.md, CAMPAIGNS.md, DETECTION.md) with a concise overview in SKILL.md for proper progressive disclosure.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is well-organized and accurate, but the lengthy attribution rationale, vendor-consensus lists, and dated campaign-by-campaign narratives read like a threat-intel report and could be condensed without losing emulation value, fitting the 'mostly efficient but could be tightened' anchor. | 2 / 3 |
Actionability | The emulation and detection guidance is concrete and specific — exact CVEs (CVE-2017-11882, CVE-2017-0199), command patterns (`powershell -ExecutionPolicy Bypass -WindowStyle Hidden`), file paths, masquerade names, and target extension lists — which is actionable for an instruction-only profile skill per the scoring notes. | 3 / 3 |
Workflow Clarity | The emulation plays are ordered across the kill chain (initial access → execution → C2 → collection → exfiltration), giving a clear sequence, but there are no explicit validation checkpoints or feedback loops (e.g., verify exploit fires, confirm C2 beacon) for destructive/batch-style operations, capping the score at 2. | 2 / 3 |
Progressive Disclosure | The single ~180-line SKILL.md is monolithic with no bundle files or external references; sections are well-organized, but the detailed TTP catalog, campaign history, and detection guidance are inline content that could be split into reference files for a document this large. | 2 / 3 |
Total | 9 / 12 Passed |