Content
78%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A lean, well-structured runtime-analysis skill that sequences its workflow clearly and offloads detail to one real reference file. Its main weakness is actionability: it tells Claude what to hook but not how to invoke the tooling to do so.
Suggestions
Add a minimal executable Frida invocation and a small hook-script template (e.g. Interceptor.attach on a request-builder selector) so the runtime-boundary step is copy-paste runnable, not just described.
Include an explicit error-recovery feedback loop in the Hook The Runtime Boundary phase (e.g. 'if the hook misses the signer, re-trace the call chain from the accepted response before patching pinning').
Show one concrete replay example with the actual fields to capture (token, device id, body, signature, headers) so the Replay The Accepted Path step moves from a checklist to an executable pattern.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The ~45-line body is lean and assumes Claude's competence, never explaining what Frida, Keychain, or SSL pinning are; every section earns its tokens. | 5 / 5 |
Actionability | It names concrete hook boundaries and evidence to record, but provides no executable commands or hook scripts (no frida invocation, no hook template), leaving the execution layer incomplete. | 3 / 5 |
Workflow Clarity | A clear sequence exists (5-step Quick Start plus a 3-phase workflow) with a validation checkpoint ('correlate static bundle evidence and live hook output before claiming the trust path is understood'), but there is no explicit error-recovery feedback loop. | 4 / 5 |
Progressive Disclosure | A concise overview points to a single clearly-signaled, one-level-deep reference (references/ios-runtime.md, verified present) with content appropriately split and easy navigation. | 5 / 5 |
Total | 17 / 20 Passed |