Content
78%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
An excellent, dense operational reference: nearly every line is an executable command or a high-signal table, with a clear staged workflow, decision gate, and error-recovery table. The two weaknesses are mild duplication in the Quick Reference and a monolithic structure — the inline Frida scripts and indicator tables belong in scripts/ and references/ files to slim the SKILL.md overview.
Suggestions
Move the Frida hook scripts (hook_crypto.js, ssl_bypass.js) into a scripts/ directory and reference them by path, converting ~50 lines of inline JavaScript into a one-line pointer.
Split the MITRE ATT&CK mapping, Detection Signatures, and Tools & Resources tables into a references/ file (e.g. references/indicators.md), keeping the SKILL.md body as a lean workflow overview with well-signaled one-level-deep pointers.
Drop or shrink the Quick Reference section since it duplicates the apktool, jadx, apksigner, and MobSF commands already shown in sections 1, 2, and 7.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is almost entirely executable commands, terse comments, and dense tables that assume Claude's competence. Minor redundancy exists: the Quick Reference section repeats the apktool, jadx, apksigner, and MobSF commands that appear again in sections 1, 2, and 7. Fits the 4 anchor (efficient with minor trimmable content) rather than 5 (duplication present). | 4 / 5 |
Actionability | Fully executable, copy-paste-ready guidance throughout: concrete bash commands, a complete working Frida JS hook script, MobSF REST API curl calls, specific grep patterns, and readelf/strings recipes. Common cases including obfuscation, SSL pinning, and native packers are covered, matching the 5 anchor. | 5 / 5 |
Workflow Clarity | A clear numbered sequence (static structure → decompile → smali → dynamic → network → native → automated) plus a Decision Gate for branching and an Error Handling table with explicit recovery paths. Matches the 4 anchor: most checkpoints present, but minor gaps — e.g., no explicit verification that decompilation output exists before grep, and section ordering is implied rather than justified. Not 5 because validation checkpoints are implicit; not 3 because error-recovery feedback loops are explicitly tabulated. | 4 / 5 |
Progressive Disclosure | The 320-line body is well-sectioned with clear headers, but there are no bundle files at all: the ~40-line Frida hook script is inlined even though it is invoked as a file ('frida -U -l hook_crypto.js'), and the MITRE mapping, detection signatures, and error-handling tables would naturally live in reference files. Matches the 3 anchor (content that should be separate is inline); not 4 because no one-level-deep references exist and the body is substantial. | 3 / 5 |
Total | 16 / 20 Passed |