Content
57%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The content is highly actionable with concrete payloads and a clearly sequenced six-phase workflow, but it is over-long for a single file, restates material Claude already knows, and lacks the explicit validation/verification checkpoints a destructive testing workflow requires. Splitting payload catalogs and examples into reference files would improve both conciseness and progressive disclosure.
Suggestions
Add explicit validation/verification checkpoints to the workflow (e.g., confirm payload executed in the target context, re-confirm scope before exploiting stored XSS against real users, verify no unintended users are affected) to satisfy the destructive/batch-operation feedback-loop requirement.
Move the large payload catalogs (filter bypasses, encoding bypasses, common payloads table) and worked Examples into separate reference files in ./references/, keeping SKILL.md as a lean overview with one-level-deep links.
Trim redundant restatements of common knowledge (lists of generic dangerous sinks/sources, basic XSS payload forms) to assume Claude's competence and reduce token cost.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The ~490-line body is mostly efficient reference-style payload catalogs rather than basic-concept prose, but it still spends many tokens restating common XSS payloads, dangerous sinks/sources, and filter-bypass techniques Claude already knows, and could be tightened. | 3 / 5 |
Actionability | Provides extensive concrete, copy-paste-ready payloads and worked examples (cookie theft, keylogger, session hijack, CSP/JSONP bypass, encoding bypasses), covering common cases with minor gaps around tool-driven end-to-end workflows. | 4 / 5 |
Workflow Clarity | Six phases are clearly sequenced, but for a destructive/attack skill with batch operations the workflow lacks explicit validation/verification checkpoints and feedback loops (confirm payload executed, verify scope before stored-XSS exploitation), capping this at 3 per the rubric. | 3 / 5 |
Progressive Disclosure | No bundle files exist, and the entire payload catalog, examples, and troubleshooting are inlined in a single ~490-line SKILL.md with no file-level split, though section headers provide reasonable internal structure. | 3 / 5 |
Total | 13 / 20 Passed |