Content
57%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, highly actionable payload and tool compendium with a clear five-step core workflow and responsible-use gating, but it is a monolithic single file that mixes overview content with reference material. It also carries removable padding and lacks explicit per-step validation checkpoints for a workflow whose operations are inherently risky.
Suggestions
Delete the sections that restate or pad rather than inform: the 'Purpose' section (duplicates the frontmatter description), the 'API Types Overview' table (SOAP/REST/GraphQL basics Claude already knows), and the generic 'When to Use' section.
Add explicit validation checkpoints to the Core Workflow steps, e.g., after each IDOR bypass attempt confirm the response actually contains another account's data before treating it as a finding, and re-verify authorized scope before testing write/delete methods.
Split reference-heavy material into one-level-deep bundle files (e.g., references/graphql.md for the GraphQL section, references/tools.md for the tools table) and signal them from SKILL.md to cut the token load of the main file.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The payload/tool catalog mostly earns its tokens, but the 'Purpose' section restates the description verbatim, 'API Types Overview' explains SOAP/REST/GraphQL basics Claude already knows, and 'When to Use' is generic filler. This is more than minor over-explanation, so it sits at 'mostly efficient but could be tightened' rather than the 4 anchor. | 3 / 5 |
Actionability | Concrete throughout: executable commands (kiterunner scan, curl introspection POST), specific payloads (IDOR wraps, XXE DOCTYPE, GraphQL batching), and a tools table with URLs. Not 5 because several entries are request fragments rather than runnable commands (e.g., '?url=Kernel#open → ?url=|ls', bare 'GET /api/users/1234 → GET /api/users/1235'). | 4 / 5 |
Workflow Clarity | Five clearly sequenced steps (recon → auth → IDOR → injection → methods) with a front-loaded confirmation gate and stop conditions, but per-step validation of findings is implicit at best (e.g., no 'verify the response actually contains another tenant's data before reporting IDOR'). This is a risky probing workflow, and the rubric caps clarity at 3 when validation checkpoints are missing. | 3 / 5 |
Progressive Disclosure | Well-sectioned with headers and tables, but it is a ~450-line monolith with no external references: the tools reference, GraphQL deep-dive, and payload catalogs are inline material that belongs in separate reference files. Not 2 because in-file structure and navigation are genuinely good; not 4 because nothing is split out. | 3 / 5 |
Total | 13 / 20 Passed |