CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

sentinel-xdr-dependency-helper

Help authors review and fill XDR YAML workload and connector dependencies using exact-query Log Analytics lab metadata. Conversion remains offline.

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.github/skills/sentinel-xdr-dependency-helper/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, highly actionable runbook with exact commands, request/response schemas, and strong validation and consent guardrails; its main weaknesses are organizational. The workflow is implicit in section order rather than explicitly sequenced, and reference material that belongs in separate one-level-deep files is inlined.

Suggestions

Open with a short numbered workflow overview (offline proposal → approved lab metadata → review and YAML update → validate) so the section order reads as an explicit sequence.

Move the parser/function caveat reference (ASIM `_ASim_*`/`_Im_*`, `_GetWatchlist`, `Watchlist` handling) and the workbook review command details into clearly signaled reference files, keeping SKILL.md as an overview.

Consolidate the repeated no-authentication/no-write constraint statements into a single 'Safety boundaries' section to tighten the prose.

DimensionReasoningScore

Conciseness

The body is dense, imperative, and free of explanations of concepts Claude already knows; commands and schemas carry all the weight. A few constraints (no-auth/no-write rules, "Static/manual review") are repeated or fragmented across sections and could be trimmed, keeping it below anchor 5's 'every token earns its place'.

4 / 5

Actionability

Guidance is fully executable: exact CLI invocations with flags (`sentinel-xdr-migration dependency-plan --solution ... --results ... --workspace-id ...`, `workbook-review --plan ... --decisions ... --plan-sha256 ...`), a complete REST request with headers and body, and concrete JSON/YAML record schemas. These are copy-paste ready and cover the common cases.

5 / 5

Workflow Clarity

A clear offline → lab-metadata → review → update → validate sequence is present across sections, with explicit checkpoints (inspect every proposal and unresolved reason, record failures explicitly, clear `dependencyReviewRequired` only after review, "Run offline `validate`, then repeat the imported lab comparison") and error-handling rules for fallbacks. It falls short of anchor 5 because the flow is never laid out as an explicit ordered sequence, and the opening workbook paragraphs arrive before the workflow is established.

4 / 5

Progressive Disclosure

The body is ~155 lines with clear ## sections but no bundle files and no external references at all; reference-like material (workbook review commands and flags, the ASIM/`_GetWatchlist`/`Watchlist` parser caveats, fallback-scanner rules) is inlined where a one-level reference file would serve better. There is genuine structure, so anchor 2's 'minimal structure' does not fit, but 'content that should be separate is inline' does.

3 / 5

Total

16

/

20

Passed

Description

57%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is precise and highly distinctive, with a clear statement of what the skill does, but it omits any 'when to use' trigger guidance and lacks the natural vocabulary (Sentinel, Defender, migration) users would most likely say. Adding an explicit 'Use when...' clause with those terms would lift the two weakest dimensions.

Suggestions

Append an explicit trigger clause, e.g. "Use when migrating Sentinel detection rules to Defender XDR and YAML prerequisite workloads or data connectors are missing or uncertain."

Include the natural synonyms users would actually say — Sentinel, Defender XDR, detection rules, migration, contentProvenance — alongside the current technical terms.

Mention the full scope of concrete actions (offline dependency-plan proposals, lab-assisted metadata validation, post-review validate) so the capability list is comprehensive rather than two actions.

DimensionReasoningScore

Specificity

The description names the domain and two concrete actions — "review and fill XDR YAML workload and connector dependencies using exact-query Log Analytics lab metadata" — but coverage is not comprehensive (workbook review, validation, and the dependency-plan workflow are absent). Anchor 4 requires several specific actions; anchor 2 requires generic actions, which these are not.

3 / 5

Completeness

The 'what' is clear (review and fill dependency fields in XDR YAML using lab metadata), but there is no 'Use when...' clause or equivalent trigger guidance, capping completeness at 3 per the judging guidelines. "Conversion remains offline" states a constraint, not a 'when'.

3 / 5

Trigger Term Quality

Relevant keywords exist ("XDR YAML", "workload and connector dependencies", "Log Analytics lab metadata") but the most natural user phrasings — "Sentinel", "Defender", "migration", "detection rules" — are missing. This matches 'some relevant keywords but missing common variations or synonyms' rather than anchor 4's 'a few natural terms missing'.

3 / 5

Distinctiveness Conflict Risk

The niche is unmistakable — XDR YAML dependency provenance with Log Analytics lab metadata — so it is clearly distinguishable from other skills and unlikely to trigger for the wrong one. No overlap risk with generic YAML or migration skills.

5 / 5

Total

14

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Azure/Azure-Sentinel

Path

.github/skills/sentinel-xdr-dependency-helper/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.