Content
86%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A lean, high-signal guardrail skill: every line is a directive or validation gate with zero padding, and the Input→Process→Output structure makes the working sequence clear. The main gaps are the absence of any worked example or output template and of an explicit error-recovery step when coverage is blocked.
Suggestions
Add a minimal worked example — e.g., a short Sigma rule snippet showing correct `level`/`status` usage alongside a matching benign-case record — so the output spec ("rule/spec, prerequisites, ... evidence record") has a copy-paste-ready shape and actionability reaches anchor 5.
Add an explicit error-recovery step for the telemetry gate in the Structure section: what to do when coverage is `blocked` or `not-tested` (e.g., record the prerequisite gap, request telemetry, then re-evaluate) to close the workflow feedback loop.
Show or explicitly point to the format for "expected matches, exclusions and benign/false-positive cases with rationale" — currently only "Reuse `cyber-evidence`" hints at where it lives — so the recording rule is directly executable.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body never explains concepts Claude already knows — it does not define Sigma, ATT&CK, correlation, or cardinality — and goes straight to directives like "never substitute Boolean OR across unrelated single events" and "never write `severity: high` as Sigma metadata". The `level`/`status` value enumerations earn their place by supporting the level-vs-status disambiguation the skill targets; every token is a rule or gate, matching the lean anchor 5. | 5 / 5 |
Actionability | Guidance is concrete and domain-executable: exact verdict values ("`blocked` or `not-tested`"), exact Sigma fields (`level`, `status`), and a named output artifact list ("rule/spec, prerequisites, severity, lifecycle status, fixtures, limitations, evidence record"). However, there is no worked example or template (e.g., a minimal Sigma rule snippet or a benign-case record format) covering the common cases, which keeps it below the copy-paste-ready anchor 5 for an instruction-only skill. | 4 / 5 |
Workflow Clarity | The Structure section gives a clear ordered Input→Process→Output sequence ("define predicates, entity keys, window, cardinality, ordered correlation, suppression, benign cases") with real validation gates (telemetry prerequisite gating, "documented authorization and runtime-proven controls; offline fixtures only"). But there is no explicit error-recovery feedback loop (e.g., what to do when coverage is `blocked`), matching anchor 4's 'most checkpoints present; minor validation gaps' rather than anchor 5's recovery loops. The destructive/batch cap does not apply since validation steps for the risky production path are present. | 4 / 5 |
Progressive Disclosure | At roughly 24 lines, the skill is under 50 lines with clean sections (Priority, Structure, Rules, Anti-Patterns, References) and only clearly signaled one-level-deep references (Sigma spec URL, MITRE ATT&CK URL, sibling `cyber-authorization`/`cyber-evidence`/`cyber-framework-mapping` skills). No bundle directories exist and no body reference points to a missing local file, so per the simple-skill note, well-organized sections with no need for external bundle files score 5. | 5 / 5 |
Total | 18 / 20 Passed |