Content
67%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A thorough, well-structured adversary profile with actionable emulation guidance and strong safety/authorization gating for its destructive content; its main weakness is verbosity from re-explaining ATT&CK techniques Claude already knows and the absence of formal validation feedback loops.
Suggestions
Trim the per-technique ATT&CK glosses in the TTP section to just the actor-specific behavior (e.g., drop generic 'Vulnerability-scans target infrastructure' and keep only the Sandworm-specific application), improving conciseness without losing the mapping.
Add a brief validate-fix-retry loop to the emulation guidance (e.g., 'verify the beacon checked in and the GPO payload executed on a sample host before fleet-wide deployment') to push workflow clarity toward 5.
Consider moving the full TTP-by-tactic enumeration and signature-tooling table into a references/ file (e.g. TTPS.md) referenced one level deep, so SKILL.md stays a lean overview.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient dense reference content (specific dates, CVEs, malware families earn their place), but the per-tactic TTP section re-explains ATT&CK techniques Claude already knows ('Vulnerability-scans target infrastructure', 'profiles software in use'), which could be tightened to just the actor-specific mapping. | 3 / 5 |
Actionability | Emulation guidance gives concrete, specific direction referencing named tools and skills ('Stand up c2/sliver with HTTPS and TLS-tunneled profiles', 'Use the AD skills to enumerate via LDAP, dump LSASS/NTDS'), with minor gaps (no literal copy-paste commands, but instruction-style guidance is actionable). | 4 / 5 |
Workflow Clarity | The emulation guidance follows a clear attack-lifecycle sequence (initial access → phishing → AD escalation → C2 → evasion → lateral → cloud → impact → OT) with prominent authorization and safety verification gates ('Authorized use only', 'ONLY in an isolated lab range', 'never issue control commands against real equipment'); the destructive-safety validation is present so the cap at 3 does not trigger, though formal validate-fix-retry loops are absent. | 4 / 5 |
Progressive Disclosure | Well-organized with clear section headers and a single-level self-contained structure (no nested references); the large TTP-by-tactic enumeration and tooling table could plausibly split into a reference file, a minor organization gap rather than a structural defect. | 4 / 5 |
Total | 15 / 20 Passed |