Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tightly written, highly actionable hunting playbook with copy-paste commands, inline false-positive guards, and a validation section. Structure is clear and self-contained; the main weakness is the absence of any progressive-disclosure split for a fairly long single file.
Suggestions
Add explicit error-recovery guidance after the validation criteria (e.g., 'if SSRF callback not received, verify remotePatterns allowlist before reporting negative').
Consider moving the longer per-phase exploitation recipes into a references/ file linked from a shorter overview to reduce inline length.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly lean command-first phases that assume Claude knows curl/grep; the FALSE-POSITIVE GUARD and precondition notes earn their place as domain-specific knowledge Claude cannot reliably infer, though a few prose passages could be trimmed. | 4 / 5 |
Actionability | Copy-paste-ready curl commands with concrete headers (Next-Action, x-middleware-subrequest), specific paths (/_next/image, /_next/data/BUILD_ID), and clearly marked variables ($TARGET, $BUILD_ID, ACTION_ID_HERE) covering the common exploitation cases. | 5 / 5 |
Workflow Clarity | Eight phases are sequenced (fingerprint first, then per-surface exploitation) with a closing Validation section of ✅ confirmation criteria and inline false-positive guards; minor gaps in explicit error-recovery loops between phases. | 4 / 5 |
Progressive Disclosure | Well-organized into clearly headed phases with no nested references and no bundle files present; everything is inline in a ~256-line file, which is defensible for a single-playbook hunting skill though some phases could theoretically be split into reference files. | 4 / 5 |
Total | 17 / 20 Passed |