Conciseness

The templates, CVSS calibration table, file layout, and checklist are the skill's real payload and earn their tokens. But it could be tightened: the ~35-line MITRE ATT&CK mapping tables restate technique IDs and tools Claude already knows, the shared YAML frontmatter schema (explicitly noted as identical across templates) is repeated in full four times, and four complete worked templates could be one full example plus per-phase deltas.

Actionability

Fully executable and copy-paste ready: exact frontmatter field schemas, exact commands (nanodump, impacket-psexec, pypykatz invocations), exact table formats, concrete file paths and naming conventions (findings/FIND-{NNN}.md, findings/evidence/FIND-{NNN}_{description}.txt), and specific CVSS v4.0 vectors. Every common case (cred access, privesc, lateral movement, exfiltration) has a worked example.

Workflow Clarity

The content is organized by deliverable type rather than as an explicit reporting workflow; the sequence (pick template → fill finding → complete detection gap table → save to findings/FIND-{NNN}.md → verify against checklist) is implicit. The Evidence Collection Checklist provides a genuine verification mechanism, but no validation checkpoints (e.g., confirm detection gap table and frontmatter fields are complete before saving) are stated in the process itself.

Progressive Disclosure

The body has clear numbered section structure and consistent internal navigation, but it is a single ~550-line monolith with no bundle files at all. Content that naturally belongs in separate reference files — the MITRE mapping tables, the CVSS score table, and the individual phase templates — is inlined in SKILL.md rather than split into references/ with one-level-deep links.

Specificity

The description lists several specific capability areas — "credential access, privilege escalation, lateral movement reports, detection gap analysis, attack path documentation, CVSS v4.0 scoring" — which map directly onto the skill's actual deliverables. Not a 5 because the coverage has minor gaps (e.g., data exfiltration/PII findings and evidence collection are in the body but not the description), and the items are nominal categories rather than explicit concrete actions.

Completeness

The "what" is clear and specific (post-exploitation finding documentation with an enumerated capability list), but there is no "Use when..." clause or equivalent explicit trigger guidance in the description, which caps this dimension at 3. Per the judging guideline, the metadata `when_to_use` field is separate from the description field being evaluated.

Trigger Term Quality

Strong natural domain keywords: "post-exploitation", "credential access", "privilege escalation", "lateral movement", "detection gap", "attack path", "CVSS v4.0" — phrases a red-team operator would genuinely say when asking for finding write-ups. Not a 5 because common synonyms and abbreviations users would naturally type ("privesc", "post-exploit", "creds", "finding write-up") are absent from the description itself, though several appear only in the metadata tags.

Distinctiveness Conflict Risk

The post-exploitation niche is well-marked with distinctive triggers like "detection gap analysis", "attack path documentation", and "CVSS v4.0 scoring". Not a 5 because generic phrases like "finding documentation" and "CVSS scoring" overlap with a general vulnerability-reporting or reconnaissance-reporting sibling skill; a request like "write up this finding" would not unambiguously select this skill.