CtrlK
BlogDocsLog inGet started
Tessl Logo

ti-anyrun-lookup

ANY.RUN Threat Intelligence Lookup workflow — query hashes, domains, IPs, and behavioral indicators against ANY.RUN's sandbox corpus. Covers TI Lookup query syntax, search operators, free tier constraints, result correlation with engagement findings, and integration with sandbox analysis.

63

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/ti-anyrun-lookup/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, actionable reference with executable API examples and well-sequenced correlation workflows; it is concise and well-structured, with only minor room to tighten prose and to split the query-syntax/detection catalogs into a referenced file.

Suggestions

Add an explicit validation/retry checkpoint inside the correlation workflows (e.g. 'If the API returns 0 tasks, fall back to the Decision Gate and submit the sample to the sandbox') so the feedback loop is inline rather than only in a separate table.

Consider moving the full query-syntax field catalog and detection-signatures table into a references file (e.g. references/query_syntax.md) and linking from SKILL.md to reduce inline length while keeping the overview lean.

Trim contextual prose such as the opening 'Unlike static hash databases ...' paragraph to tighten token efficiency.

DimensionReasoningScore

Conciseness

The body is mostly efficient reference material with dense, useful code blocks and assumes Claude's competence; only minor prose such as 'Unlike static hash databases, results link directly to interactive sandbox sessions' could be trimmed.

4 / 5

Actionability

Provides fully executable curl commands against the real API endpoint and complete Python heredoc scripts that parse the JSON response and extract fields, copy-paste ready and covering the common hash/domain/IP cases.

5 / 5

Workflow Clarity

Numbered multi-step workflows (hash, domain, C2 IP pivots) plus a Decision Gate give a clear sequence with recovery guidance via the Error Handling table; minor validation gaps but operations are read-only so the destructive cap does not apply.

4 / 5

Progressive Disclosure

No bundle files exist, so all content is inlined, but it is well organized into clearly headed single-level sections (syntax, recipes, workflows, tools, error handling, decision gate) that make navigation easy; some catalog content could move to a reference file but inlining is reasonable for a lookup skill.

4 / 5

Total

17

/

20

Passed

Description

67%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description that clearly conveys what the skill does and is highly distinct, but it lacks an explicit 'Use when...' trigger clause and leans on metadata rather than the description for natural trigger terms.

Suggestions

Add an explicit 'Use when ...' clause to the description (e.g. 'Use when enriching IOCs against ANY.RUN sandbox sessions, or when the user mentions any.run, TI lookup, or IOC/hash/domain lookups.') to lift completeness above 3.

Surface one or two natural user phrasings such as 'IOC lookup' or 'any.run' directly in the description rather than only in metadata.when_to_use.

DimensionReasoningScore

Specificity

Names multiple concrete actions — 'query hashes, domains, IPs, and behavioral indicators' plus 'query syntax, search operators, free tier constraints, result correlation ... and integration with sandbox analysis' — giving comprehensive coverage of the workflow's scope.

5 / 5

Completeness

The 'what' is clear and detailed, but there is no explicit 'Use when...' trigger clause; per the rubric a missing trigger clause caps completeness at 3 even though the 'what' is strong.

3 / 5

Trigger Term Quality

The description includes some relevant natural keywords ('hashes, domains, IPs', 'TI Lookup', 'sandbox') but misses common user phrasings like 'IOC lookup' or 'any.run' that live only in metadata.when_to_use, so coverage is partial.

3 / 5

Distinctiveness Conflict Risk

The ANY.RUN-specific naming ('ANY.RUN Threat Intelligence Lookup', 'ANY.RUN's sandbox corpus', 'TI Lookup') carves out a clear niche with minimal overlap risk against other skills.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.