Content
72%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a highly actionable SAML/SSO hunting playbook with executable commands, exact payloads, and a useful triage table, well-organized into clear sections. Its weaknesses are verbosity in the Related Skills chain primitives (which restate already-shown attacks) and the absence of in-workflow validate/verify feedback loops for the XML-manipulation steps.
Suggestions
Tighten the 'Related Skills & Chains' entries: name the chain primitive in one line instead of re-narrating the full XSW/signature-stripping flow that the body already demonstrates.
Add an explicit validation checkpoint inside each attack workflow (e.g., 'Confirm the altered assertion is accepted AND that the resulting session has elevated privileges before claiming severity') rather than deferring all validation to the triage-validation skill.
In the Attack 3 signature-stripping steps, add a verify step between re-encode and submit (e.g., confirm the stripped response no longer contains a Signature element) so the destructive change is checked before submission.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The attack sections are dense and assume SAML/XML knowledge, but the 'Related Skills & Chains' block re-explains the full XSW/signature-stripping mechanics in prose for each linked skill, restating attacks already shown above rather than just naming the chain primitive. | 2 / 3 |
Actionability | Provides copy-paste-ready commands (`echo "BASE64" | base64 -d | xmllint --format -`, `base64 -w0 saml.xml`), exact XML payloads, concrete tool instructions (SAML Raider Burp tab), and specific NameID test values with CVE references. | 3 / 3 |
Workflow Clarity | Attack 3 has a clear 1-5 numbered sequence and a triage table maps outcomes to severity, but the XML-manipulation workflows lack an explicit validate→fix→retry feedback loop inside the workflow — validation is deferred out to the referenced triage-validation skill. | 2 / 3 |
Progressive Disclosure | Single-file skill with no bundle directories; content is organized into clean, navigable sections (Attack Surface, Attacks 1-5, Tools, Triage, Related Skills) and cross-references other skills at one level deep with no nested indirection. | 3 / 3 |
Total | 10 / 12 Passed |