Content
65%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is highly actionable with comprehensive, copy-paste-ready AD attack commands and a clearly signaled reference file, but it is verbose and monolithic with weak validation checkpoints for its destructive operations.
Suggestions
Move the per-technique command catalogs (Critical CVEs, Kerberos Ticket Attacks, AD CS) into reference files and keep SKILL.md a concise overview with the Core Workflow and Quick Reference, improving both conciseness and progressive disclosure.
Add explicit validation/checkpoint steps for destructive ops — e.g., confirm the ZeroLogon password reset took effect and verify restore afterward; check account-lockout thresholds before spraying — to raise workflow clarity above 2.
Remove the duplicated Quick Reference table or the Examples that restate commands already shown in the technique sections to cut redundancy.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Sections are mostly lean command blocks rather than concept explanations, but the ~380-line body carries redundancy — the Quick Reference table and the Examples section restate commands already shown in Credential Attacks and Ticket Attacks — plus Purpose/Inputs/Outputs overhead that could be tightened. | 2 / 3 |
Actionability | It provides dense, executable, copy-paste-ready commands across impacket, mimikatz, rubeus, certipy, hashcat, and crackmapexec with concrete flags and targets, matching the fully-executable anchor. | 3 / 3 |
Workflow Clarity | A Core Workflow and numbered examples give a sequence, but destructive/batch operations such as the ZeroLogon DC password reset and password spraying lack explicit validate-then-proceed feedback loops, capping clarity at 2 per the destructive-operations rule. | 2 / 3 |
Progressive Disclosure | There is one real, clearly signaled one-level reference (references/advanced-attacks.md), but SKILL.md itself is monolithic — CVE exploits, ticket attacks, ADCS, and relay sections are all inline rather than split into references — so content that should be separate stays inline. | 2 / 3 |
Total | 9 / 12 Passed |