Content
86%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A concise, well-structured investigative skill that assumes competence and delegates detail to a real one-level reference. Adding concrete tool/command examples and an explicit verification feedback loop would raise actionability and workflow clarity.
Suggestions
Add one or two concrete tool/command examples per workflow step (e.g. ticket extraction and replay commands) to lift actionability toward fully executable guidance.
Insert an explicit validate→fix→retry checkpoint after replay (e.g. confirm the destination-side logon/token change before claiming the pivot succeeded) to strengthen workflow clarity for risky replay operations.
Optionally surface a couple of natural trigger synonyms (lateral movement, pass-the-ticket) in the description to round out trigger-term coverage.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Lean and efficient with no concept padding; it assumes Claude's knowledge and every line directs action ('Inspect SAM, SECURITY, SYSTEM, NTDS, DPAPI...'). | 5 / 5 |
Actionability | Concrete targets and fields to capture are named explicitly, but as an instruction-only skill it lacks specific tool/command examples (e.g. mimikatz/sekurlsa, crackmapexec invocations), leaving minor execution gaps. | 4 / 5 |
Workflow Clarity | A clear 3-step workflow (Recover → Trace → Report) plus a 5-step Quick Start with verify-framed steps ('Reproduce the smallest pivot that still proves the privilege edge'), though no explicit validate→fix→retry feedback loop is given. | 4 / 5 |
Progressive Disclosure | Well-organized overview with a clearly signaled, verified one-level-deep reference ('Load `references/windows-pivot.md` for the pivot checklist...') that exists and is not nested. | 5 / 5 |
Total | 18 / 20 Passed |