Content
68%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a well-structured, action-oriented adversary-emulation reference that respects Claude's competence, but it inlines substantial reference bulk and lacks the validation/feedback checkpoints the rubric requires for destructive operations.
Suggestions
Add explicit validation/scope-verification checkpoints to the emulation workflow (e.g., confirm target is in-scope and isolated before each destructive step, with a stop-and-revert path) to lift the workflow_clarity cap.
Move the full campaign catalog, TTP-by-tactic listing, and tooling table into reference files (e.g., CAMPAIGNS.md, TTPS.md) with a concise overview and one-level links in SKILL.md to improve progressive disclosure.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Dense, factual reference content that assumes Claude's competence (no basic concept explanations), with only minor prose in the campaign narratives that restates TTP-list implications and could be trimmed. | 4 / 5 |
Actionability | Emulation guidance maps each TTP to specific, executable actions (base64 ASPXSpy in a Certificate text file, Plink renamed systems.exe, staging in C:\windows\temp\s\, enumerated wiper chain), with only minor gaps expected for an emulation profile. | 4 / 5 |
Workflow Clarity | The wiper deployment chain is sequenced, but this is a destructive/batch skill with no validate→fix→retry checkpoints or mid-execution scope-verification, so the rubric's destructive-operations cap of 3 applies. | 3 / 5 |
Progressive Disclosure | Well-organized single-file structure with clear one-level sections and no nested references, but ~170 lines of inlined campaign/TTP/tooling reference content could be split into separate reference files. | 4 / 5 |
Total | 15 / 20 Passed |