Content
65%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, command-first analyst field guide covering the full workflow (family ID, crypto analysis, key recovery, recovery inhibition, IOC extraction) with mostly copy-paste-ready code. Main weaknesses: a systematic grep -E '\|' alternation bug that breaks most triage commands, no validation checkpoints before destructive/batch steps like running decryptors, and a fully monolithic structure with no progressive disclosure.
Suggestions
Fix the grep alternation bug: under `grep -E`, '\|' matches a literal pipe, so replace `grep -iE 'lockbit\|revil\|conti'` with plain `|` (as the Quick Reference section already does) so the strings-based triage commands in sections 1–6 actually match.
Add validation checkpoints before destructive/batch operations: e.g., 'Test the decryptor on a single copied file and verify the output opens before batch-decrypting' and 'Confirm shadow copies exist via `vssadmin list shadows` before mounting for recovery'.
Move the lookup tables (MITRE ATT&CK mapping, tools, detection signatures, edge cases) into a references/ file (e.g., references/tables.md) to slim the core workflow and establish progressive disclosure.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is command-dense with almost no conceptual padding — nearly all prose is domain-specific value (mutex names, crypto patterns, trailer layouts) rather than concepts Claude already knows. It falls short of 5 because NoMoreRansom/Emsisoft decryptor URLs appear three times (Quick Reference, Technique 5, Tools table) and the Tools/Detection tables partially duplicate inline content. | 4 / 5 |
Actionability | Mostly executable, copy-paste-ready guidance: complete Python heredocs for entropy analysis, import-table enumeration, and IOC regex extraction, plus concrete vssadmin/strings commands. It is not fully executable (5) because the pervasive `grep -iE 'lockbit\|revil\|...'` patterns use '\|' which matches a literal pipe under ERE — those triage commands silently return nothing (the Quick Reference already uses the correct plain '|') — and `yara -r /opt/yara-rules/ransomware/` assumes an unverified environment path. | 4 / 5 |
Workflow Clarity | A clear sequence exists (numbered sections 1–6 from family identification through IOC extraction) and the Decision Gate adds explicit IF-branches. However, there are no validation checkpoints for destructive/batch operations — running a decryptor over victim files or mounting shadow copies — such as testing the decryptor on a single copied file and verifying output before batch decryption, so workflow clarity is capped at 3. | 3 / 5 |
Progressive Disclosure | The skill is a single ~330-line monolithic file with no bundle files and no references signaled anywhere; peripheral lookup tables (MITRE mapping, tools, detection signatures, edge cases) that would suit separate reference files are inlined. Structure within the file is good, but content that should be separate is inline, matching the 3 anchor. | 3 / 5 |
Total | 14 / 20 Passed |