Content
92%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong audit-skill body: fully executable commands and platform-specific checks, a coherent pipeline with an explicit validate-until-passes loop and a mandatory refutation pass, and clean one-level-deep offloading of the heavy format/severity/verification detail into real bundle files. The only weakness is minor: a date-qualified PBKDF2 threshold and a few editorial asides that could be trimmed.
Suggestions
Drop the "(OWASP 2024)" qualifier on the PBKDF2 iteration threshold (or move it into severity-calibration.md with the rest of the dated guidance) so the number doesn't read as time-sensitive inline guidance.
Trim judgment asides whose reasoning is already obvious from the check (e.g. "that's worse than no encryption (reveals plaintext patterns)", "they buy time, they don't prevent") to bare rules, keeping the token budget for checks.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is efficient — dense per-category checklists of exact API names and thresholds (kSecAttrAccessibleWhenUnlockedThisDeviceOnly, setUserAuthenticationRequired, allowBackup="false"), a tool table, and no explanation of concepts Claude already knows. Not 5 because of minor trims available: the date-qualified "PBKDF2 with ≥ 600,000 iterations (OWASP 2024)" reads as time-sensitive, and a few rhetorical asides ("that's worse than no encryption (reveals plaintext patterns)", "they buy time, they don't prevent") pad slightly. Not 3: there is no noticeable verbosity block — every section adds checks or commands Claude would not reliably produce unaided. | 4 / 5 |
Actionability | Executable commands appear throughout: `strings <app>.ipa`, `otool -hv`, `readelf -h`, the tools table (MobSF, jadx, apktool, Frida + objection), and copy-paste-ready `node references/validate-findings.mjs findings.json` / `node references/to-sarif.mjs findings.json -o findings.sarif`. Concrete specifics (pin in native code, not Swift/Kotlin; ASWebAuthenticationSession / Custom Tabs; fingerprint format with worked examples) cover the common cases fully. Not 4: no meaningful gap — even the output template and `ext` field conventions are given verbatim. | 5 / 5 |
Workflow Clarity | A coherent, ordered pipeline: Authorization Check → per-MASVS checklists → static tools → runtime testing → the refutation pass in references/verification.md → write findings.json sorted by fingerprint → "validate and fix until it passes" (explicit command) → render the report. This matches the anchor with explicit validation steps, a validate→fix→retry feedback loop, and checklists for the complex process. Not 4: the validation checkpoint and error-recovery loop are explicit, not implicit. | 5 / 5 |
Progressive Disclosure | Scored against the actual bundle: every referenced path — references/verification.md, references/findings-format.md, references/severity-calibration.md, references/validate-findings.mjs, references/to-sarif.mjs — exists in references/ and is substantive. The main file keeps the audit-time checklists inline (where they belong) and pushes verification rules, findings format, and severity calibration one level deep with clear markdown signals and direct commands. Not 4: navigation is easy and nothing that belongs in a separate file is inlined — no nested (2+ level) reference chains exist. | 5 / 5 |
Total | 19 / 20 Passed |