Content
50%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A thorough, well-organized adversary-emulation profile with concrete TTP mappings and useful detection guidance, but it is verbose, delegates execution to other skills without executable commands, lacks validation checkpoints in the emulation workflow, and is monolithic with no progressive disclosure.
Suggestions
Trim the attribution/campaign narrative to the minimum needed for emulation and move detailed historical campaigns to a references/ file, keeping SKILL.md as a lean overview.
Add explicit validation/checkpoint steps to the emulation workflow (e.g., verify lure renders, confirm side-load DLL resolves, validate C2 callback before proceeding) to satisfy the feedback-loop requirement for offensive operations.
Provide at least minimal executable snippets or exact command skeletons for the key chain stages rather than only referencing external skills, so the guidance is copy-paste actionable.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is substantive and domain-specific (not generic filler), but the extensive attribution, decade-long campaign narrative, and targeting background exceed what is needed to drive emulation and could be tightened. | 2 / 3 |
Actionability | Guidance is concrete in places — named binaries (rekeywiz.exe), CVEs (CVE-2017-11882), pipe names, ATT&CK mappings — but it delegates execution to other skills ('Use the phishing skill', 'payload-builder skill') and provides no copy-paste executable commands, leaving key implementation details implicit. | 2 / 3 |
Workflow Clarity | The signature chain (LNK → HTA → JavaScript → .NET) is sequenced and organized by tactic, but there are no explicit validation checkpoints or error-recovery loops; for offensive/destructive operations the rubric caps workflow clarity at 2 when validation is missing. | 2 / 3 |
Progressive Disclosure | The body is well-sectioned with clear headings, but it is a single monolithic file with no bundle references; the ~145-line TTP catalog and campaign history are inline content that could be split into reference files, and the under-50-line simple-skill exception does not apply. | 2 / 3 |
Total | 8 / 12 Passed |