Content
65%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
Highly actionable and well-sequenced, but the body is over-long, lacks validation feedback loops for risky operations, and keeps reference-grade material inline instead of splitting it into bundled files.
Suggestions
Split the 60-pattern secret-grep catalog and Frida scripts into bundled references (e.g. references/secret-patterns.md, scripts/frida-pin-bypass.js) and link from SKILL.md to shrink the monolithic body and lift progressive_disclosure.
Add explicit validation checkpoints for risky batch operations — e.g. confirm a recovered credential still authenticates before mass spraying, and verify Firebase read results before escalating — to raise workflow_clarity above 2.
Trim explanations of concepts Claude already knows (XAPK structure, exported-component intent injection) and merge the two neighboring-skills chain sections into one to improve conciseness.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The ~400-line body is mostly efficient and code-dense but includes redundant twin sections ('Bridge to neighboring skills' and 'Related Skills & Chains') and explains concepts Claude already knows (what an XAPK is, how exported components expose attack surface); it is not 3 because those could be trimmed, and not 1 because the bulk is concrete commands. | 2 / 3 |
Actionability | Provides copy-paste-ready curl/jadx/grep commands, a 60-pattern secret catalog with real regexes, executable Frida JS, and mitmproxy setup — fully executable rather than pseudocode. | 3 / 3 |
Workflow Clarity | Stages 0–8 are clearly sequenced with a decision tree, but risky batch/destructive ops (credential 'Spray immediately', Firebase public-read tests) lack explicit validate→fix→retry feedback loops, capping the score at 2 per the batch-operation guideline. | 2 / 3 |
Progressive Disclosure | No bundle files exist and the skill is a monolithic single-file body where the secret-grep catalog and Frida scripts are content that should be split into reference files; it is not 1 because section headers and the decision tree give reasonable organization. | 2 / 3 |
Total | 9 / 12 Passed |