Content
88%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a concise, well-structured adversary-emulation playbook with strong safety gating and clear sequencing appropriate to a destructive/ICS skill. Actionability and progressive disclosure are solid but not maximal because guidance points to external skill paths rather than bundled, self-contained detail files.
Suggestions
Add a short in-bundle references/ file (e.g. apt-groups.md or an OT-safety checklist) so the cross-referenced detail lives within this skill's bundle rather than only outside it.
For the ICS-write and canary-destruction phases, include a compact inline command snippet (e.g. a read-only pymodbus read call and the canary artifact naming convention) to make those steps more directly executable.
Make the referenced external skill paths consistent (some rows use /skills/standard/... while the apt-groups reference uses ../../references/...); standardizing the path style would improve navigation clarity.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and efficient; assumes Claude's competence without explaining what ICS, LOTL, or a wiper is, and every section (ThreatProfile seed, kill-chain table, CONOPS, OPSEC, RoE gates, deconfliction, fidelity notes) earns its place. | 5 / 5 |
Actionability | Concrete, specific guidance — per-phase MITRE techniques, named tools (NetExec, Impacket, Sliver, pymodbus/python-snap7), referenced skills per row, and named artifact files — but it points to external skills/files rather than being fully self-contained executable steps, leaving minor gaps. | 4 / 5 |
Workflow Clarity | The kill chain is clearly sequenced (phases 1–10, CONOPS 1–5) with prominent validation/safety checkpoints — read-only default, explicit OT-write authorization gate, OT safety engineer requirement, abort.json EMERGENCY trigger, and maintenance-window standby — satisfying the destructive-operation validation requirement. | 5 / 5 |
Progressive Disclosure | Well-organized with clear section headers and clearly signaled one-level-deep inline references, but no in-bundle references/scripts/assets exist and the referenced paths (e.g. ../../references/apt-groups.md, /skills/standard/...) point outside this skill's bundle. | 4 / 5 |
Total | 18 / 20 Passed |