Content
85%Weight 40%Scale 1-3Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A well-organized, lean instruction-only skill with a clear phased workflow, explicit verification gates, and a properly signaled one-level-deep reference. Its main weakness is actionability: it tells Claude which boundaries to hook and what to capture but supplies no executable Frida/jadx commands or hook-script templates.
Suggestions
Add a small executable example for the narrowest-boundary hook step — e.g., a minimal Frida command or hook-script snippet showing how to intercept the request signer and log plaintext input + signed output — so the guidance is copy-paste ready rather than target-only.
Include the specific tool invocations for static triage (e.g., jadx/apktool commands) alongside the existing 'map manifest, exported components, deeplinks, native libs' targets to close the gap between what to target and how to target it.
Surface one concrete replay/verification command or check in the 'Replay The Accepted Path' section so the 'reproduce the accepted server-side branch' gate has an executable checkpoint rather than only a description.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is lean and assumes Claude's competence — terse imperative bullets with no explanations of what an APK/Frida/JNI is, matching the 'lean and efficient; assumes Claude's competence' anchor rather than the 'mostly efficient but could be tightened' level below. | 3 / 3 |
Actionability | Guidance names specific targets ('hook request signers, crypto helpers, keystore access, protobuf encode or decode, or JNI marshaling') and specific evidence ('plaintext inputs, signed strings, headers, nonces'), but provides no executable tool commands or hook-script templates, so it is concrete-but-incomplete rather than copy-paste ready. | 2 / 3 |
Workflow Clarity | A clear numbered sequence (Static Triage → Hook The Narrowest Boundary → Replay The Accepted Path) with explicit gates ('Correlate static evidence and dynamic traces before claiming a trust edge is understood' and 'Reproduce... from the smallest hook set') matches the 'clear sequence with explicit validation steps' anchor; the operation is non-destructive so the missing-feedback-loop cap does not apply. | 3 / 3 |
Progressive Disclosure | The body is a concise overview with one clearly signaled, one-level-deep reference ('Load `references/android-hooking.md` for hook targets, storage checklist, and evidence packaging'), and the referenced file exists and is not nested, matching the 'clear overview with well-signaled one-level-deep references' anchor. | 3 / 3 |
Total | 11 / 12 Passed |