Content
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a highly actionable, well-sequenced iOS red-team pipeline with concrete commands, a decision tree, and useful operational pitfalls. Its main weaknesses are redundancy between the stage content and the Anti-patterns section, and the absence of any progressive disclosure into separate reference files despite its length.
Suggestions
Collapse the Anti-patterns that restate Stage 1 and Stage 4 content (FairPlay/encryption-by-channel, 'pinning is a mitigation', WKWebView ATS exception) into brief cross-references, keeping only net-new pitfalls there.
Extract the Stage 4 ATS/pinning detail and the Stage 3 secret-grep pattern catalog into separate reference files (e.g. references/ats-pinning.md, references/secret-grep.md) and link to them from SKILL.md, turning the body into an overview.
Bundle the referenced '60-pattern catalog' (currently described as living in apk-redteam-pipeline) as a local reference file so the secret-grep stage is self-contained.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient and command-driven with high-value operational detail (FairPlay encryption by distribution channel, BoringSSL pinning layer, frida-server version skew), but the Anti-patterns section restates points already made in Stages 1 and 4 (enterprise/ad-hoc not encrypted; don't stop at 'pinning is present'; WKWebView ATS exception), so it is not the lean 'every token earns its place' level 3. | 2 / 3 |
Actionability | Packed with copy-paste-ready executable commands — `plutil -convert xml1 -o - Info.plist`, `codesign -d --entitlements :-`, `objection --gadget <bundle_id> explore`, `frida -U -f <bundle_id> -l ios-ssl-bypass.js` — plus named tools (frida-ios-dump, SSL Kill Switch 2, keychain-dumper) and specific plist keys; not level 2, which would use pseudocode or omit key details. | 3 / 3 |
Workflow Clarity | A clear Stage 0–6 sequence anchored by a finding→next-move decision tree that uses explicit 'Confirm' validation language ('Confirm a token/credential actually transits HTTP', 'Confirm scheme fallback still carries the same injectable params'), plus decision checkpoints ('Always check distribution channel before reaching for frida-ios-dump') and troubleshooting hints (frida-server version skew); not level 2, where checkpoints are only implicit. | 3 / 3 |
Progressive Disclosure | Sections are well-organized (stages, decision tree, anti-patterns, tooling, related skills), but the skill is a single ~280-line monolithic document with no bundle/reference files, and the ATS/pinning details and the secret-grep pattern catalog (referenced as 'same 60-pattern catalog as Android') are candidates for split-out reference files; it is not the simple <50-line skill that the level-3 exception covers. | 2 / 3 |
Total | 10 / 12 Passed |