Content
61%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a well-structured, actor-specific intelligence profile with actionable emulation guidance mapped to ATT&CK and specific commands. Its main weaknesses are verbosity in prose sections and missing validation/feedback-loop checkpoints for destructive credential and log-clearing operations.
Suggestions
Add explicit validation checkpoints and a fix-and-retry feedback loop to the emulation guidance for destructive/batch steps (e.g. verify ntds.dit extraction and archive integrity before exfil; confirm log-clear actions are within scope and reversible via blue-cell snapshots).
Tighten the intro, attribution, and campaign prose to bullet-style facts to reduce token overhead while preserving the intelligence value.
Consider moving the full ATT&CK ID catalog and signature-tooling list into a references file (e.g. TTPS.md / TOOLING.md) with a one-line pointer, keeping SKILL.md as a lean overview.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is detailed and mostly focused on actor-specific intelligence Claude could not derive, but the lengthy attribution prose and dense prose paragraphs in sections like the intro and campaigns could be tightened; it sits at the mostly-efficient-with-some-padding anchor. | 3 / 5 |
Actionability | "Emulation guidance (Decepticon)" provides concrete, mapped steps (edge-device-first exploitation, bash/LOTL execution, ntds.dit staging in C:\Windows\Temp, Sliver HTTPS C2 on 443) with specific commands and ATT&CK IDs, leaving only minor gaps versus fully copy-paste-ready procedures. | 4 / 5 |
Workflow Clarity | TTPs are organized by tactic and the emulation guidance is a clear narrative list, but destructive/batch credential operations (ntds.dit capture, multi-volume 7-Zip archives, log clearing) lack explicit validation/verification checkpoints and feedback loops, which caps workflow clarity at 3 per the rubric. | 3 / 5 |
Progressive Disclosure | No bundle files exist and the skill is a single self-contained overview with well-organized section headers (attribution, targeting, campaigns, TTPs by tactic, tooling, emulation, detection, sources); structure is good and navigation is easy, though some dense reference material (full ATT&CK ID list, tool catalog) could be split out. | 4 / 5 |
Total | 14 / 20 Passed |