Content
57%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is a well-organized, highly actionable routing guide with strong command examples, explicit pivot rules to sibling skills, and a clear pattern map. Its weaknesses are duplicated PAT/field-notes content inflating token cost, missing validation and stop conditions in the batch brute-force workflow, and a reference index whose targets largely do not exist in the actual bundle.
Suggestions
Collapse the PayloadsAllTheThings on-demand block into one place (the Bulk payloads section), remove the duplicated graceful-degrade/clone text from Prerequisites, and trim per-reference blurbs to one line so detailed technique/CVE catalogs live only in the referenced files.
Add validation to the Login Brute-Force hard rules: a concrete success indicator to check per response (e.g., grep for a login-success string), a stop-on-first-hit condition, and an error-recovery step — this batch operation currently caps workflow clarity at 3.
Fix progressive disclosure against the real bundle: ensure every referenced file (sql-injection.md, server-side*.md, auth-*.md, pat-reference.md, scripts/install_ctf_tools.sh, etc.) actually ships alongside SKILL.md, and add a body reference to the existing scripts/async_fuzz.py so it is discoverable.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly lean command blocks and checklists, but the PayloadsAllTheThings on-demand/clone material is duplicated nearly verbatim in both Prerequisites and the Bulk payloads section, the Deep-Dive Notes section restates field-notes.md's contents already listed in Additional Resources, and several reference blurbs (tools-mcp.md, server-side-advanced-3/4.md) inline exhaustive technique/CVE catalogs that belong in the referenced files. Several padded sections keep it at "mostly efficient but could be tightened". | 3 / 5 |
Actionability | Mostly executable, copy-paste-ready commands (sqlmap --batch --dbs, flask-unsign --unsign --wordlist, JWT decode pipeline, SSTI probes, webhook.site token create/retrieve curls) plus a concrete default wordlist path for brute-force rules. Minor gap: the "XSS payload with webhook callback" example embeds JavaScript ("+ document.cookie") inside a bash curl -d JSON string and is not executable as written, matching the "minor gaps" anchor rather than fully copy-paste ready. | 4 / 5 |
Workflow Clarity | The First-Pass Workflow is a coherent five-step sequence with one explicit gate ("Build the smallest proof first... Save full exploit chaining for later"), but other checkpoints are implicit and there are no validate-fix-retry feedback loops. The Login Brute-Force section is a batch operation governed by hard rules yet includes no success-indicator or stop condition, so the batch-operation cap applies. | 3 / 5 |
Progressive Disclosure | The index design is good — one-level-deep references with per-file descriptions plus a Fast Pattern Map routing table — but scored against the actual bundle almost none of the ~20 referenced .md files or scripts/install_ctf_tools.sh exist, and the one real bundle script (scripts/async_fuzz.py) is never referenced from the body. Dangling references plus an orphaned bundle file exceed "minor organization gaps", while the clear signaling keeps it above the buried-references anchors. | 3 / 5 |
Total | 13 / 20 Passed |