CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

log-analytics-workspace-queryer

Queries Log Analytics workspaces through an advertised official Sentinel Triage MCP tool first, with the REST API script as fallback.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.github/skills/log-analytics-workspace-queryer/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exemplary lean, well-structured instruction for a simple single-purpose skill: concrete inputs, an MCP-first decision rule with explicit fallback conditions and error discrimination, a copy-paste-ready script invocation, and a verified one-level-deep script reference. The only notable gaps are the absence of a concrete MCP invocation example and any output-verification guidance.

DimensionReasoningScore

Conciseness

The ~30-line body is lean and efficient with no explanations of concepts Claude already knows; even the note that inputs come from another skill is operationally useful rather than padding, so every token earns its place.

5 / 5

Actionability

The fallback path is copy-paste ready (".\\scripts\\queryLogAnalytics.ps1 -WorkspaceId \"<workspaceId>\" -Query \"<KQL query>\"") with an explicit relative path, and the MCP-first step is appropriately conditional ("Do not invent a tool name or assume the capability exists"), but it lacks a concrete example invocation of the MCP tool — a minor gap keeping it below fully-executable.

4 / 5

Workflow Clarity

The three steps are clearly sequenced with an explicit decision branch: fallback conditions are enumerated ("availability, authentication, permission, connectivity, timeout, or provider-service failure") and error discrimination is explicit ("A genuine KQL error... must not be retried through another provider"). It is a read-only query so the destructive/batch validation cap does not apply, but there is no output-verification or empty-result handling step, which keeps it below anchor 5.

4 / 5

Progressive Disclosure

The skill is under 50 lines with well-organized sections (Inputs, Step 1-3) and its single bundle reference ("scripts/queryLogAnalytics.ps1", verified to exist) is one level deep and clearly signaled, satisfying the simple-skill exception for a top score.

5 / 5

Total

18

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, in third person, and clearly states what the skill does and through which mechanisms, with low conflict risk. Its main weaknesses are the complete absence of a "when to use" trigger clause and missing natural trigger terms like "KQL" and "Azure Monitor".

Suggestions

Append an explicit trigger clause, e.g. "Use when a KQL query needs to run against an Azure Log Analytics or Sentinel workspace."

Include natural trigger terms users would actually say — "KQL", "Azure Monitor", "Sentinel" — so the description surfaces when those words appear.

Optionally enumerate the concrete capabilities (run KQL queries, retrieve table results) to lift specificity beyond a single stated action.

DimensionReasoningScore

Specificity

"Queries Log Analytics workspaces through an advertised official Sentinel Triage MCP tool first, with the REST API script as fallback" names the domain and a concrete action plus mechanism, but covers only a single capability rather than several specific actions, matching the 1-2 concrete actions anchor rather than the comprehensive coverage anchor.

3 / 5

Completeness

The "what" is clear (query Log Analytics workspaces via MCP-first with REST fallback), but there is no "Use when..." clause or equivalent explicit trigger guidance for when to invoke the skill, which caps completeness at 3 per the judging guidelines.

3 / 5

Trigger Term Quality

"Log Analytics", "Sentinel Triage", "REST API", and "workspaces" are relevant domain keywords, but the description omits common natural variations users would say — most notably "KQL", plus "Azure Monitor" — so keyword coverage is partial rather than good.

3 / 5

Distinctiveness Conflict Risk

The pairing of "Sentinel Triage MCP" with "Log Analytics workspaces" carves a distinct niche with only minor overlap risk against other Azure/Sentinel query skills, though no explicit distinct triggers are stated to reach a 5.

4 / 5

Total

13

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Azure/Azure-Sentinel

Path

.github/skills/log-analytics-workspace-queryer/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.