Content
65%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The body is an actionable, reference-dense API fuzzing playbook with concrete payloads and a clear core workflow. Its main weaknesses are length/redundancy, the absence of validation checkpoints in the workflow, and the lack of progressive disclosure via separate reference files.
Suggestions
Add explicit verification checkpoints to the Core Workflow (e.g., 'Confirm the IDOR by reading the response body for another user's data; capture a proof-of-concept') to lift workflow_clarity.
Split the GraphQL-Specific Testing section and the Tools Reference table into separate reference files (e.g., graphql.md, tools.md) referenced one level deep from SKILL.md to improve progressive disclosure.
Remove the redundant Quick Reference and Common API Vulnerabilities summary tables (or merge them) and deduplicate the SSRF coverage between Step 4 and Output Exploitation to tighten conciseness.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient reference-style content (commands, payloads, tables) with little conceptual padding, but ~430 lines with redundant summary tables (Common API Vulnerabilities, Quick Reference, Tools Reference) and repeated coverage (SSRF appears in both Step 4 and Output Exploitation) keep it from being fully lean. | 2 / 3 |
Actionability | Highly actionable with copy-paste-ready payloads and commands, e.g. {"id":[111]}, ?url=|ls, the XXE DOCTYPE entity, and `kr scan https://target.com -w routes-large.kite`. | 3 / 3 |
Workflow Clarity | A clear Core Workflow sequence (Recon -> Auth -> IDOR -> Injection -> Method) is present, but there are no explicit validation/verification checkpoints such as confirming a finding or verifying impact, which caps the score. | 2 / 3 |
Progressive Disclosure | Content is well organized into sections but lives entirely inline in one ~430-line SKILL.md with no bundle/reference files; material that could be split out (GraphQL testing, Tools Reference) is not progressively disclosed. | 2 / 3 |
Total | 9 / 12 Passed |