Conciseness

The body is lean and assumes Claude's competence — terse command blocks with inline comments, tables, and no explanation of concepts Claude already knows. It is not a 5 because of redundancy: 'Golden Ticket' and 'Golden Ticket with Scheduled Tasks' overlap heavily, and the Examples section repeats Core Techniques content (sudo vim shell, GetUserSPNs.py Kerberoasting).

Actionability

Nearly every technique ships copy-paste-ready commands with real flags ('sudo find /etc/passwd -exec /bin/bash \;', 'GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request', 'hashcat -m 13100'), plus a technique-selection table and concrete troubleshooting pairs. Minor contextual gaps (e.g. 'execute-assembly sweetpotato.exe' assumes a C2 framework) do not detract from covering the common cases.

Workflow Clarity

Order is implicit (prerequisites → technique catalog → selection table → constraints → examples → troubleshooting) and the Constraints section says to verify the target OS before selecting a technique, but there is no explicit enumerate → select → exploit → verify-success sequence, and success verification ('id') appears only in Example 1. Per the rubric guideline, destructive operations (chmod +s /bin/bash, GPO-created admin user, persistence) without validation checkpoints cap workflow clarity at 3.

Progressive Disclosure

No bundle files exist and all ~330 lines live in SKILL.md. The per-OS technique catalogs (Linux, Windows, AD) are natural candidates for one-level-deep reference files, and the 'Additional Resources' pointers are external tools rather than navigable skill files. In-file structure is good (clear headers, quick-reference table), which keeps this at the midpoint rather than 2.

Specificity

The description names the domain ('post-exploitation privilege escalation for Linux or Windows systems') and lists concrete technique names ('abuse sudo', 'exploit SUID binaries', 'Kerberoasting', 'pass-the-ticket'), but only as trigger phrases — it never states what the skill itself does (e.g., enumerates misconfigurations, provides ready-to-run commands per technique). This matches the anchor for naming the domain with limited concrete action coverage; it falls short of 4 because the skill's own capabilities are unstated.

Completeness

The 'when' half is explicit and trigger-rich ('This skill should be used when the user asks to...'), but the 'what' half is only the generic phrase 'needs guidance on post-exploitation privilege escalation' — no statement of deliverables such as enumeration, technique reference, or commands. One half is strong while the other is weak, which sits at the midpoint rather than clearly answering both.

Trigger Term Quality

Comprehensive natural trigger coverage including slang and synonyms a user would actually say: 'escalate privileges', 'get root access', 'become administrator', 'privesc techniques', 'abuse sudo', plus named techniques like 'Kerberoasting' and 'token impersonation'. No common variation is missing.

Distinctiveness Conflict Risk

Clear niche (post-exploitation privilege escalation on Linux/Windows) with distinct technique-named triggers ('Kerberoasting', 'pass-the-ticket', 'exploit SUID binaries') that are unlikely to fire for unrelated skills.