Content
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is thorough, accurate and well-organized with concrete ATT&CK mappings and per-phase emulation guidance, but it is verbose with all detail inline (no progressive disclosure), gives descriptive rather than executable instruction, and lacks explicit validation checkpoints. Splitting reference material into bundle files and adding executable examples or validation gates would lift it.
Suggestions
Move the detailed campaign timeline and full TTP-by-tactic catalog into reference files (e.g. references/campaigns.md, references/ttps.md) and keep SKILL.md as a concise overview with one-level-deep pointers.
Add executable or copy-paste-ready snippets for the signature emulation steps (e.g. example vishing/MFA-fatigue emulation commands, Entra ID federation-trust commands) instead of descriptive guidance.
Insert explicit validation checkpoints in the emulation workflow (e.g. 'confirm scope/authorization before each phase', 'verify controls detected the simulated TTP before proceeding').
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is information-dense rather than padded with basics Claude knows, but it is long — full campaign timelines, a complete TTP-by-tactic catalog, tool lists and detection rules are all inline with no offloading, so it could be tightened; not the lean level-3 anchor. | 2 / 3 |
Actionability | It gives concrete guidance (specific ATT&CK IDs, named tooling, per-phase emulation steps in the 'Emulation guidance' section) but instructs via description ('emulate...', 'use the cloud skills to emulate...') rather than copy-paste-ready executable code or commands, so it is not at level 3. | 2 / 3 |
Workflow Clarity | The 'Emulation guidance' section sequences phases (initial access -> cloud pivot -> AD -> lateral/C2 -> virtualization -> exfil -> impact) with safety cautions ('Authorized use only', 'stop short of encryption'), but there are no explicit validate->fix->retry checkpoints and the gates are cautionary rather than validation steps, so it sits at the mid anchor. | 2 / 3 |
Progressive Disclosure | No bundle files exist (references/scripts/assets are empty) and the body references no external files; all reference material (campaign timeline, full TTP catalog, detection guidance) is inline in a single document, which is content that could be split out, so it is not the clean overview-with-one-level-references level-3 anchor. | 2 / 3 |
Total | 8 / 12 Passed |