CtrlK
BlogDocsLog inGet started
Tessl Logo

ti-ioc-extraction

Automated IOC extraction from threat reports, logs, and unstructured text — parse hashes, IPs, domains, URLs, email addresses, and CVEs. Covers regex-based extraction, defanging/refanging, bulk hash lookup, IOC deduplication, YARA rule generation from IOCs, and STIX/TAXII formatting for sharing.

61

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/ti-ioc-extraction/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is highly actionable with copy-paste-ready executable code and a useful decision gate, but it is held back by duplicated extraction blocks, missing validation checkpoints for batch operations, and a monolithic structure with no progressive disclosure to reference files.

Suggestions

Add explicit validation feedback loops for batch operations (e.g., verify each VT/MISP response succeeded and retry on failure before proceeding).

Move the detailed STIX/TAXII, MISP push, and CyberChef recipe sections into separate reference files linked from the body to enable progressive disclosure.

De-duplicate the regex extraction blocks that appear in both Quick Reference and Section 1, keeping one canonical set.

DimensionReasoningScore

Conciseness

The body is dense and mostly executable code with minimal concept explanation, but the hash/IP grep blocks are duplicated between the Quick Reference section and Section 1, so not every token earns its place.

2 / 3

Actionability

Provides fully executable pip installs, working Python scripts, concrete grep regexes, and curl calls with rate-limit handling; placeholders like <REPORT> and <API_KEY> are clearly marked, making examples copy-paste ready.

3 / 3

Workflow Clarity

The Decision Gate sequences choices by source type and condition and sections are numbered, but batch operations like bulk hash lookup and MISP upload lack explicit validate-then-retry checkpoints, which caps workflow clarity at 2.

2 / 3

Progressive Disclosure

Sections are well-organized, but the skill is a single ~440-line monolithic file with all content inline and no bundle/reference files; detailed STIX/MISP scripts and CyberChef recipes that could live in separate reference files are kept inline.

2 / 3

Total

9

/

12

Passed

Description

82%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and distinctive with strong natural trigger terms, but it omits an explicit "Use when..." trigger clause, which limits its completeness score.

Suggestions

Add an explicit trigger clause such as "Use when extracting indicators of compromise from threat reports, paste dumps, or incident logs, or when the user mentions IOCs, defanging, or STIX/TAXII sharing."

Spell out "indicators of compromise" alongside "IOC" once in the description to broaden natural-language matching.

DimensionReasoningScore

Specificity

Lists many concrete actions — "parse hashes, IPs, domains, URLs, email addresses, and CVEs" and "regex-based extraction, defanging/refanging, bulk hash lookup, IOC deduplication, YARA rule generation from IOCs, and STIX/TAXII formatting" — matching the multiple-specific-actions anchor.

3 / 3

Completeness

Clearly answers "what" (extract, parse, dedup, format IOCs) but lacks an explicit "Use when..." clause; the source phrase "from threat reports, logs, and unstructured text" describes inputs rather than an explicit trigger, which caps completeness at 2 per the judging guideline.

2 / 3

Trigger Term Quality

Embeds natural terms users would say — "IOC extraction", "threat reports", "hashes", "IPs", "domains", "defang", "refang", "STIX/TAXII", "YARA", "CVEs" — giving good coverage of natural trigger phrasing.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear niche (IOC extraction) with distinctive terms like STIX/TAXII, YARA, defang/refang, and IOC, making it unlikely to trigger for the wrong skill.

3 / 3

Total

11

/

12

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

relative_links

Relative link issues: 1 missing

Warning

Total

14

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.