Content
76%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
Highly actionable, executable reference with strong organization, but it involves risky/destructive operations without explicit validation feedback loops, which caps workflow clarity.
Suggestions
Add an explicit validate/verify checkpoint in the Decision Gate (e.g., 'Confirm the beacon fired and captured before closing the PR; if no callback, re-check egress and trigger.').
Move the Chains, Tools, and Detection-signature tables into a reference file to keep SKILL.md as a lean overview pointing one level deep.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense and largely assumes Claude's knowledge of CI/CD concepts, using tight tables and code blocks; minor over-explanation appears in the recon comments and the 'VULNERABLE — DO NOT WRITE THIS' annotations. | 4 / 5 |
Actionability | Provides copy-paste-ready recon grep commands and concrete exploit payloads for each PPE vector (package.json postinstall, Makefile, build.gradle, pom.xml, Dangerfile, setup.py, pull_request_target), covering the common cases fully. | 5 / 5 |
Workflow Clarity | A Decision Gate sequences scope confirmation and PoC constraints, but it lacks explicit validate->fix->retry checkpoints and the destructive/risky operations cap workflow clarity at 3 per the rubric's destructive-operations rule. | 3 / 5 |
Progressive Disclosure | Well-organized into Recon/Direct/Indirect/Chains/Tools/Detection/Decision Gate/References sections with cross-links to sibling skills (cicd-secrets-exfil, self-hosted-runner-abuse); no bundle files exist, so the inlined reference tables are appropriate, though the Chains/References could be split out for a skill this long. | 4 / 5 |
Total | 16 / 20 Passed |