Content
57%Scale 1-3Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill excels at actionability with concrete, executable payloads and techniques across REST, GraphQL, and SOAP APIs. However, it suffers from being a monolithic document that could benefit significantly from splitting into focused sub-files (GraphQL testing, injection payloads, tools reference). The workflow lacks validation checkpoints for confirming vulnerability findings, and some sections explain concepts Claude already understands.
Suggestions
Split the content into sub-files: GRAPHQL.md for GraphQL-specific testing, PAYLOADS.md for injection payloads, and TOOLS.md for the tools reference table, with clear links from the main SKILL.md
Add validation/verification steps to the workflow, such as how to confirm a true positive IDOR vs a false positive, and how to document proof-of-concept findings
Remove the 'API Types Overview' table, 'Purpose' section, 'Inputs/Prerequisites', 'Outputs/Deliverables', and 'When to Use' boilerplate — these add no actionable value and waste tokens
Add a brief step for responsible disclosure or reporting format after vulnerability confirmation to complete the workflow loop
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary elements like the 'API Types Overview' table (Claude knows this), the 'Purpose' section repeating the description, and the 'When to Use' boilerplate at the end. The 'Inputs/Prerequisites' and 'Outputs/Deliverables' sections add little value. However, the core payload/technique content is reasonably dense and useful. | 2 / 3 |
Actionability | The skill provides highly concrete, copy-paste-ready payloads, commands, and test patterns across multiple attack vectors. Examples include specific curl commands, GraphQL queries, SQL injection payloads, IDOR bypass techniques with exact JSON structures, and endpoint bypass patterns. This is immediately executable guidance. | 3 / 3 |
Workflow Clarity | The 5-step workflow provides a reasonable sequence (recon → auth → IDOR → injection → methods), but lacks validation checkpoints and feedback loops. There's no guidance on verifying findings, confirming true positives vs false positives, or documenting results at each step. For security testing involving potentially destructive operations, the absence of verification steps is a notable gap. | 2 / 3 |
Progressive Disclosure | This is a monolithic wall of content (~350+ lines) with no references to external files. The GraphQL section, tools reference table, and detailed injection payloads could all be split into separate reference files. Everything is inline, making it a large single document that consumes significant context window space when loaded. | 1 / 3 |
Total | 8 / 12 Passed |