Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, highly actionable attack matrix with strong executable coverage and good structural organization, appropriately cautious about destructive operations. It loses points only on conciseness trim and the absence of a formal validation feedback loop and external reference split for the large CVE tables.
Suggestions
Move the per-vendor CVE tables into a one-level-deep reference file (e.g. references/VPN_CVE_MATRIX.md) and keep SKILL.md as an overview that links to it, improving progressive disclosure for the bulk content.
Add an explicit validate→retry feedback loop to the probe sequence (e.g. after nuclei triage, confirm each candidate CVE with a second independent technique before declaring it exploitable) to lift workflow clarity.
Trim the few narrative/justification lines (e.g. 'Most enterprise VPNs now use SAML for SSO. Check SP metadata:') down to imperative commands to tighten conciseness.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is mostly lean curl commands, tables, and tight prose that assumes Claude's competence without explaining what a VPN or SAML is, but a few narrative lines ('Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape' is in the frontmatter, and inline rationales like 'Most enterprise VPNs now use SAML for SSO') could be trimmed. | 4 / 5 |
Actionability | Provides copy-paste-ready, executable curl/nuclei commands with exact paths, cookies, and crafted headers (e.g. the CVE-2023-4966 Host-header leak, CVE-2024-3400 cookie injection), covering the common cases across all vendors. | 5 / 5 |
Workflow Clarity | The 'Common probe sequence (5-minute fingerprint)' gives a clear ordered workflow and the 'Anti-patterns'/'Operational discipline' sections act as checklists with verification guidance ('test 3+ CVEs per vendor', 'Don't trust the version banner alone'), but there is no explicit validate→fix→retry feedback loop for error recovery. | 4 / 5 |
Progressive Disclosure | Well-organized into clearly headed sections (When to use, Vendor identification, CVE matrix, SAML, Default credentials, Probe sequence) with no nested references and easy navigation, but everything is inlined into one ~350-line file with no one-level-deep reference files for the bulky CVE matrix. | 4 / 5 |
Total | 17 / 20 Passed |