Content
93%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a tight, actionable playbook: concrete payloads, framework-specific leak signatures, and a clear recon-to-validation sequence with no padding. The only minor gap is the absence of an explicit retry/feedback loop in the validation section.
Suggestions
Add a brief validate->retry feedback loop in 'Validation discipline' (e.g., 'if the response is a clean generic error, vary the payload/parameter and re-test') to push workflow clarity to 5.
Consider one line noting how to escalate a confirmed leak into a chained finding (it references hunt-sqli/hunt-lfi but could state the handoff step explicitly).
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and efficient; assumes Claude's competence without explaining what a stack trace or ORM is, and every line earns its place — recon targets, attack payloads, and leak signatures are delivered directly. | 5 / 5 |
Actionability | Provides fully copy-paste-ready payloads ('{"rating":"notanumber","comment":[1,2,3]}', '/item/%00') and specific per-framework leak signatures (SequelizeDatabaseError, 'Traceback (most recent call last)', 'Server Error in / Application) covering the common cases. | 5 / 5 |
Workflow Clarity | Clear sequence (Recon -> Attack -> what counts as a leak -> Validation discipline) with an evidence-capture checkpoint, but it stops short of an explicit validate->fix->retry feedback loop; still well above the anchor for a 4. | 4 / 5 |
Progressive Disclosure | A single self-contained file well under 50 lines with clear section headers and no external references needed; per the simple-skills note this scores 5 with just well-organized sections. | 5 / 5 |
Total | 19 / 20 Passed |