asim-parser-create-parser

This starts the process of creating a new ASIM schema parser by generating the initial version of the parser based on the requirements gathered. Use this skill when you have gathered all necessary information for the new ASIM parser and are ready to create the initial version of the parser.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.github/skills/asim-parser-create-parser/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, actionable guide with concrete KQL queries, code snippets, specific parameters, and an explicit verification step. It is held back from top marks by minor justificatory padding, the absence of a full worked parser example, and an implicit rather than spelled-out error-recovery loop.

Suggestions

Trim justificatory asides (e.g. 'This ensures parsers follow best practices and are optimized for performance') so every token earns its place and conciseness moves toward anchor 5.

Add a brief complete worked parser example (even a 10-line skeleton) in Step 2 to make the build step fully copy-paste ready and lift actionability.

Make the verification feedback loop explicit in Step 4 (e.g. 'If syntax errors occur, fix the KQL and re-run verification; only proceed once it executes cleanly') to reach anchor 5 for workflow clarity.

Dimension	Reasoning	Score
Conciseness	The body is largely efficient with concrete KQL queries, a performance table, and tight rules, but includes minor justificatory padding such as 'This ensures parsers follow best practices and are optimized for performance' and 'This improves performance for users who do not need the extra information', matching anchor 4 rather than 5.	4 / 5
Actionability	It provides concrete executable KQL templates ('<tableName> \| getschema', '\| take <minimum of rows found or 2000>'), a copy-ready kusto snippet for EntityKey fields, specific parameters ('disabled: bool = false'), and a strict naming convention, but Step 2's parser construction stays guidance-level without a full worked parser example, so it sits at anchor 4.	4 / 5
Workflow Clarity	Steps 1-4 are clearly sequenced (sample, build, guidelines, finalize) and Step 4 includes an explicit verification checkpoint ('Verify the KQL query runs without syntax errors'), but an explicit error-recovery feedback loop (fix then re-verify) is only implicit, which is a minor validation gap at anchor 4.	4 / 5
Progressive Disclosure	The body is well-organized into Prerequisites and Steps 1-4 with clear subsections and inline external references (ASimTester.csv, Learn Microsoft docs) that are clearly signaled; no bundle files exist to evaluate, and all content lives appropriately in SKILL.md with only minor organization gaps, matching anchor 4.	4 / 5
	Total	16 / 20 Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and provides an explicit 'Use this skill when' trigger, giving it solid completeness and distinctiveness. It loses points for second-person voice and for limited, repetitive keyword coverage rather than natural synonym breadth.

Suggestions

Rewrite in third-person imperative voice (e.g. 'Creates the initial version of a new ASIM schema parser from gathered requirements') and phrase the trigger without 'you' (e.g. 'Use when ready to generate the first version of an ASIM parser') to recover the specificity penalty.

Broaden trigger terms with natural synonyms a user would say, such as 'ASIM parser', 'Sentinel normalization parser', or 'KQL parser function', rather than repeating 'ASIM parser' phrasings.

Tie the 'when' clause to a user-facing need rather than internal readiness state (e.g. 'Use when the user asks to create or generate a new ASIM parser from a source table') to lift completeness toward anchor 5.

Dimension	Reasoning	Score
Specificity	The description names the domain ('ASIM schema parser') and one concrete action ('generating the initial version of the parser') but is not comprehensive, placing the base at anchor 3; it is reduced by 1 for second-person voice ('Use this skill when you have gathered'), which the guidelines penalize.	2 / 5
Completeness	Both 'what' (creating the initial version of an ASIM parser) and 'when' ('Use this skill when you have gathered all necessary information... and are ready to create the initial version') are explicitly present, but the trigger is a process-readiness condition rather than a natural user utterance, so it falls short of anchor 5.	4 / 5
Trigger Term Quality	It includes relevant domain keywords ('ASIM schema parser', 'new ASIM parser', 'create the initial version') but offers repetitive variants of the same term rather than a breadth of distinct natural synonyms, matching anchor 3.	3 / 5
Distinctiveness Conflict Risk	The 'ASIM schema parser' niche is specific and the 'create initial version' trigger is fairly distinct, but it risks minor overlap with sibling ASIM skills (e.g. an update/modify-parser skill), matching anchor 4.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: Azure/Azure-Sentinel
Path: .github/skills/asim-parser-create-parser/SKILL.md
Commit: ba5ab1c

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.