Content
66%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A thorough, actionable pentest toolkit with concrete commands and a gated workflow, but it is on the verbose side and references several paths (payloads/, templates/, src-hunter/, precedent-pentest.md, scope-contract.md) that do not exist in the provided bundle, weakening progressive disclosure and conciseness.
Suggestions
Remove or move out of SKILL.md the duplicated manual-install template and full MCP docker blocks — they belong in references/ — to tighten conciseness.
Inline at least one explicit validation/verification checkpoint per workflow phase (e.g., 'confirm finding is reproducible before recording as Evidence') rather than delegating all gating to references/pentest-loop.md, to push workflow clarity to 5.
Fix broken references: either add the missing payloads/, templates/, src-hunter/ directories and the ../field-journal, ../ops, ../tool-index, ../scripts paths, or remove those citations so navigation matches the actual bundle.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is mostly efficient (tables of tools with one-line commands) but contains padded sections — the full MCP installation blocks, manual-install guidance template, and external-resource lists restate info Claude largely already knows or that lives in referenced files, which could be trimmed. | 3 / 5 |
Actionability | Concrete executable commands abound (nmap -sV -sC, sqlmap --batch --dbs, ffuf -u target/FUZZ -w, hashcat -m 0) and MCP registration JSON is copy-paste ready; minor gaps are placeholders like '通过 API 或 MCP 调用' and Metasploit needing separate install. | 4 / 5 |
Workflow Clarity | A clear 5-step standard pentest flow plus a 4-step quick-scan flow is present, with authorization/scope gating (ACTION REQUIRED: confirm scope.md auth.status=granted) and a completion self-check; it falls short of 5 because validation/verify-checkpoints within each phase are largely delegated to references rather than inline, and the pentest-loop.md framework is referenced rather than embedded. | 4 / 5 |
Progressive Disclosure | References are one-level-deep and mostly real (pentest-loop.md, recon-pipeline.md, client-side-lab-playbook.md, burpsuite-mcp-guide.md all exist in references/), but several referenced paths do not exist in the bundle (payloads/, templates/, src-hunter/, ../field-journal/precedent-pentest.md, ../ops/scope-contract.md, ../tool-index.md, ../scripts/append-evidence.ps1, automation-loop-pattern.md is referenced as a file but the '本 skill 内参考文档' lists it), and structure mixes inline tool matrices with external pointers, leaving navigation partly unclear. | 3 / 5 |
Total | 14 / 20 Passed |