Content
80%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A concise, highly actionable deserialization hunting playbook with executable code for every major language. Its weakness is workflow structure: validation sits as a terminal checklist rather than embedded feedback loops, and the monolithic single-file layout leaves no room for progressive disclosure.
Suggestions
Add per-phase validation checkpoints with explicit retry guidance (e.g., 'If no DNS callback, try alternate gadget chain and re-test') instead of a single terminal Validation section.
Consider splitting the six per-language phases into a references/ directory (e.g., java.md, php.md) with a one-level-deep pointer from SKILL.md to improve progressive disclosure.
Add an explicit 'confirm exploit' feedback loop after each RCE PoC step (verify /etc/passwd + id output before declaring Critical).
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean, code-dense playbook that assumes Claude's competence — it never explains what deserialization is and every section earns its tokens with actionable signals or commands. | 3 / 3 |
Actionability | Fully executable, copy-paste-ready commands and code: ysoserial generation, phpggc chains, a complete pickle `__reduce__` exploit, and curl-based JNDI payloads with concrete headers. | 3 / 3 |
Workflow Clarity | Phases 1–6 are clearly sequenced by language and a terminal Validation section gives confirmation criteria, but validation is a final checklist rather than embedded per-phase 'validate → fix → retry' feedback loops for these destructive RCE operations. | 2 / 3 |
Progressive Disclosure | Well-organized into named sections with header navigation, but it is a single self-contained ~160-line document with no bundle files or one-level-deep references to split out the per-language playbooks. | 2 / 3 |
Total | 10 / 12 Passed |