Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A highly actionable, well-structured offensive-security playbook whose grep recipes, payload library, and validation contract give Claude everything it needs to execute. The only notable gaps are the absence of an explicit fix-and-retry loop in the audit workflow and the lack of any one-level-deep reference files for the payload and CVSS material.
Suggestions
Number the audit workflow end-to-end (inventory → grep sweep → tool-by-tool review → PoC → validate_finding) and add an explicit retry step for when a payload fails to trigger a success pattern.
Move the PoC payload library and/or the default CVSS table into a references/ file (e.g., references/payloads.md) and signal it from the body, keeping SKILL.md as the overview.
Trim the motivational opening paragraph and drop the '2026' framing so the content is not time-sensitive.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is a lean, dense playbook that assumes Claude's competence — no basic-concept explanations, just target inventory, vectors, grep recipes, payload tables, and CVSS vectors, matching the 'efficient; minor instances of over-explanation' anchor. The motivational intro ('Every product shipping an LLM interface in 2026 has this surface. The bug bounty payouts are high...') and the time-sensitive '2026' date reference are the minor trimming candidates that keep it below anchor 5. | 4 / 5 |
Actionability | Fully executable throughout: concrete grep -rE commands for finding LLM call sites and tool definitions, five copy-paste-ready PoC payloads covering distinct vectors (HTML-comment indirect exfil, RAG poisoning, tool-call hijack, markdown image exfil, cross-plugin forgery), explicit success/negative patterns for validate_finding, and exact CVSS vectors per variant. This matches the 'fully executable; copy-paste ready' anchor. | 5 / 5 |
Workflow Clarity | The sectioned flow (inventory → vectors → audit → exploitation goals ranked by impact → PoC → validate_finding contract → CVSS → chains) is a coherent sequence with a concrete per-tool checklist ('Does the tool perform filesystem/network/shell/DB operations?' etc.) and a validation checkpoint via the negative-command/negative-pattern contract. It sits below anchor 5 because the audit workflow is presented as sections with embedded questions rather than a numbered end-to-end procedure, and there is no explicit fix-and-retry error-recovery loop. | 4 / 5 |
Progressive Disclosure | No bundle files exist and the body references none, so there are no broken or nested references; the ~130 lines are organized into 8 clearly labeled, well-scoped sections, matching the 'good structure; most content is appropriately placed' anchor. It does not reach anchor 5 because the PoC payload library and CVSS table are reference-grade material that could be split into a references/ file at the top level, and the skill is somewhat over the under-50-lines threshold where inline-only organization would merit a 5. | 4 / 5 |
Total | 17 / 20 Passed |