asim-parser-create-parser

This starts the process of creating a new ASIM schema parser by generating the initial version of the parser based on the requirements gathered. Use this skill when you have gathered all necessary information for the new ASIM parser and are ready to create the initial version of the parser.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.github/skills/asim-parser-create-parser/SKILL.md

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is a lean, well-sequenced KQL/ASIM parser-building workflow with a strong final validation checkpoint and no token waste. Its main weakness is actionability in the central build step, which gives placeholders and external links rather than a complete executable example.

Suggestions

Add one complete, copy-paste-ready minimal ASIM parser example (with the Filter -> Parse -> Map flow, Type column, and disabled parameter) so the central Step 2 instruction is executable rather than templated.

Consider moving the parsing-operator performance table and the Step 3 guideline list into a references file (e.g. references/parser-guidelines.md) referenced one level deep, so SKILL.md stays a tight overview.

Make the validation step an explicit feedback loop: 'If syntax errors occur, fix them and re-run until it executes cleanly' to reinforce the retry path.

Dimension	Reasoning	Score
Conciseness	The body is lean and directive with no padding or explanation of concepts Claude already knows; it uses tight prose, a compact performance-ranking table, and bulleted guidelines where every token earns its place.	3 / 3
Actionability	It gives concrete KQL snippets (e.g. `<tableName> \| getschema`, `<tableName> \| take <minimum of rows found or 2000>`) and concrete naming (`ASimNetworkSessionCiscoASA.kql`), but the core build step (Step 2) is templated/pseudocode with placeholders and no complete executable parser example, leaving the central instruction incomplete.	2 / 3
Workflow Clarity	The four steps are clearly sequenced (Data sampling -> Build -> Guidelines -> Finalize) with a final explicit validation checkpoint ('Verify the KQL query runs without syntax errors... This step is crucial'), satisfying the feedback-loop requirement for the build operation.	3 / 3
Progressive Disclosure	No bundle files (references/, scripts/, assets/) exist and all content is inline in a single ~50-line SKILL.md; the inline external CSV/docs URLs are appropriate, but the guideline's per-rubric note allows a 3 for simple short skills with well-organized sections, and the dense Step 3 guideline block plus table could arguably be split into a reference file.	2 / 3
	Total	10 / 12 Passed

Description

52%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description has a clear "Use when..." clause answering both what and when, but it is repetitive and padded with vague process language while lacking natural trigger-term coverage. Tightening it to lead with concrete actions and common user phrases would raise specificity and trigger quality.

Suggestions

Lead with the concrete action in third person and drop the repeated 'initial version of the parser' phrasing, e.g. 'Generates the initial version of a new ASIM schema parser from gathered source-data and target-schema requirements.'

Add natural trigger terms users would say, such as 'ASIM parser', 'Sentinel normalization parser', or 'create a KQL ASIM parser', instead of process-state language like 'when you have gathered all necessary information'.

Replace vague phrasing ('starts the process of', 'based on the requirements gathered') with specific capabilities to avoid overlap with related ASIM skills.

Dimension	Reasoning	Score
Specificity	The description names a concrete domain (ASIM schema parser) and a concrete action ("generating the initial version of the parser") but does not list multiple distinct specific actions; it restates the same creation action twice rather than enumerating capabilities.	2 / 3
Completeness	It explicitly states what it does ("generating the initial version of the parser") and provides an explicit "Use this skill when..." clause stating the trigger condition, satisfying both what and when.	3 / 3
Trigger Term Quality	The only natural trigger phrase is "creating a new ASIM schema parser"; beyond that the text uses abstract internal-process language ("starts the process of", "requirements gathered", "ready to create the initial version") with no common keyword variations a user would naturally say.	1 / 3
Distinctiveness Conflict Risk	The niche (creating ASIM parsers) is fairly specific, but the trigger condition ("when you have gathered all necessary information") is process-state based rather than keyword based, so it could overlap with adjacent ASIM skills that also operate once information is gathered.	2 / 3
	Total	8 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: Azure/Azure-Sentinel
Path: .github/skills/asim-parser-create-parser/SKILL.md
Commit: fd26ba7

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.