Content
71%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
Well-organized, lean security-analysis skill with a clear workflow and a properly signaled single reference. The main gap is actionability: it tells Claude what to observe but not which concrete commands or tools to use.
Suggestions
Add a short list of concrete commands/tools for the isolation mapping step (e.g. capsh --print, nsenter, cat /proc/self/status, findmnt, seccomp-tools dump) to lift actionability.
Merge the Quick Start and Workflow step 1 ('Map isolation') to remove redundancy and tighten conciseness.
Include one short before/after evidence-capture example (e.g. expected namespace/capability diff) to make the boundary-crossing proof step more executable.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean checklist-style body that assumes Claude's competence and avoids explaining known concepts; the Quick Start and Workflow sections overlap slightly, which could be tightened. | 4 / 5 |
Actionability | Gives concrete targets ('Record namespace map, cgroup mode, capabilities, seccomp profile...', 'Capture before and after identity, namespace, mount...') but no specific commands or tools (e.g. capsh, nsenter, /proc paths, seccomp-tools) to execute them. | 3 / 5 |
Workflow Clarity | A clear three-stage sequence (Map -> Prove -> Reduce) with verification checkpoints such as 'Reproduce one minimal primitive-to-boundary-crossing chain' and 'Distinguish crash-only behavior from stable capability gain'. | 4 / 5 |
Progressive Disclosure | Overview body with a single, clearly signaled one-level-deep reference ('Load references/kernel-container-escape.md for isolation checklist, primitive checklist, and parity guidance') that exists in the bundle. | 5 / 5 |
Total | 16 / 20 Passed |