ti-ioc-extraction

Automated IOC extraction from threat reports, logs, and unstructured text — parse hashes, IPs, domains, URLs, email addresses, and CVEs. Covers regex-based extraction, defanging/refanging, bulk hash lookup, IOC deduplication, YARA rule generation from IOCs, and STIX/TAXII formatting for sharing.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, code-rich skill that covers IOC extraction end-to-end with strong copy-paste examples. Its gaps are the absence of validation/retry feedback loops around batch operations and no use of separate reference files for the long reference-style material.

Suggestions

Add explicit validation checkpoints and retry loops for batch operations — e.g., check the VT/MISP HTTP response status and retry with backoff on rate-limit or auth failure rather than silently appending empty results.

Move large reference material (CyberChef recipes, the full regex catalog, and the STIX/MISP pipelines) into separate files under references/ and link to them from SKILL.md so the main file stays an overview.

De-duplicate the grep patterns that appear in both the Quick Reference and Section 1 to tighten token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is dense with executable code and mostly assumes competence (no 'what is an IOC' preamble), with only minor duplication between the Quick Reference grep patterns and Section 1's regex catalog — efficient but trimmable, matching the 4 anchor rather than 3 (which needs noticeable padding) or 5 (every token earning its place).	4 / 5
Actionability	Copy-paste-ready bash grep, python3 pipelines (ioc-finder, stix2, pymisp), and curl lookups cover the common cases concretely; placeholders like <REPORT>/<API_KEY> are explicit substitution points, matching the 5 anchor.	5 / 5
Workflow Clarity	Sections form an extract→refang→dedupe→STIX/MISP pipeline and a Decision Gate routes by source, but batch operations (VirusTotal loop, MISP upload) lack explicit validate→fix→retry feedback loops, so the destructive/batch cap holds at 3.	3 / 5
Progressive Disclosure	No bundle files exist and the ~430-line skill is entirely inline; section headers give structure but material that could live in separate references (CyberChef recipes, full regex catalog, STIX/MISP pipelines) is inlined with no one-level-deep links, matching the 3 anchor.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-scoped description with strong action coverage and clear niche distinctiveness. Its main weakness is the absence of an explicit 'Use when…' trigger clause, which caps completeness at 3.

Suggestions

Add an explicit 'Use when…' clause with concrete trigger phrases, e.g. 'Use when extracting indicators of compromise from threat reports, paste dumps, or incident logs, or when the user mentions IOCs, defanging, or STIX/TAXII sharing.'

Include the full phrase 'indicators of compromise' and 'threat intelligence' as natural synonyms alongside 'IOC extraction' to broaden trigger-term coverage.

Note: the description advertises 'YARA rule generation from IOCs' which is not covered in the body — either add that section or trim the claim to avoid an over-claim.

Dimension	Reasoning	Score
Specificity	Quotes 'parse hashes, IPs, domains, URLs, email addresses, and CVEs' plus 'regex-based extraction, defanging/refanging, bulk hash lookup, IOC deduplication, YARA rule generation … STIX/TAXII formatting' — multiple specific concrete actions with comprehensive coverage, matching the 5 anchor rather than 4 (which requires minor coverage gaps).	5 / 5
Completeness	The 'what' is explicit and detailed, but there is no 'Use when…' clause; 'when' is only weakly implied by 'from threat reports, logs, and unstructured text', so per the missing-trigger-guidance cap it cannot exceed 3.	3 / 5
Trigger Term Quality	Natural terms present — 'IOC extraction', 'defanging/refanging' (synonyms), 'STIX/TAXII', 'YARA' — but the full phrase 'indicators of compromise' and 'threat intelligence' are absent, so it sits above the 3 anchor (good coverage) but just below the 5 anchor (comprehensive synonyms/extensions).	4 / 5
Distinctiveness Conflict Risk	A clearly delineated IOC-extraction niche with distinctive triggers (STIX/TAXII, defang/refang, YARA-from-IOCs) and minimal overlap with other skills, matching the 5 anchor.	5 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md
Commit: a04f96b

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.