Content
27%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill reads more like a comprehensive cheat sheet or reference document than a focused, actionable skill for Claude. While it contains genuinely useful payloads and techniques, it suffers from being monolithic, overly verbose, and lacking validation/verification steps. The content would benefit significantly from being split into a concise overview with references to detailed sub-files for each attack category.
Suggestions
Split the content into a concise SKILL.md overview (~50-80 lines) with references to separate files like GRAPHQL.md, IDOR.md, INJECTION.md, and TOOLS.md for detailed payloads and techniques.
Remove sections that explain concepts Claude already knows (API Types Overview table, IDOR definition, Purpose/Inputs/Outputs boilerplate, 'When to Use' section).
Add explicit validation checkpoints: how to confirm a finding is a true positive (e.g., 'If response contains different user data, IDOR confirmed'), and what constitutes sufficient evidence for a report.
Add a feedback loop for the core workflow: after each test category, include a step to document findings and verify exploitability before proceeding to the next category.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose at ~350+ lines, includes unnecessary sections like 'API Types Overview' table (Claude knows this), explains what IDOR is, lists extensive tool URLs that could be in a separate reference file, and includes a meaningless 'When to Use' section. The 'Purpose', 'Inputs/Prerequisites', and 'Outputs/Deliverables' sections restate obvious information. | 1 / 3 |
Actionability | Provides concrete payloads and example commands that are useful (IDOR bypass techniques, GraphQL introspection queries, SQL injection in JSON), but many examples are incomplete snippets rather than fully executable workflows. The payloads are copy-paste ready but lack context on how to interpret results or chain attacks together. | 2 / 3 |
Workflow Clarity | Steps 1-5 provide a reasonable sequence for API testing, but there are no validation checkpoints or feedback loops. There's no guidance on verifying findings, confirming true positives vs false positives, or what to do when a step fails beyond the basic troubleshooting table. For security testing involving potentially destructive operations, this lack of verification is a significant gap. | 2 / 3 |
Progressive Disclosure | This is a monolithic wall of content with no references to external files despite being well over 300 lines. The tools reference table, detailed GraphQL testing, endpoint bypass techniques, and PDF export attacks could all be separate reference files. Everything is crammed into a single document with no layered navigation. | 1 / 3 |
Total | 6 / 12 Passed |