Name: threat-detection
Rating: 68 (1 reviews)
Author: alirezarezvani

threat-detection

Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

The canonical home for this skill is threat-detection in alirezarezvani/claude-skills

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and well-sequenced workflows, and it respects Claude's competence without over-explaining basics. Its main weakness is progressive disclosure: large reference tables are inlined and the referenced bundle files (hunt-playbooks.md, the analyzer script) are absent.

Suggestions

Provide the missing bundle files referenced in the body (`scripts/threat_signal_analyzer.py` and `references/hunt-playbooks.md`) or remove the references, since broken paths undermine navigation.

Move the large reference tables (Tactic Coverage Matrix, High-Value Hunt Hypotheses, Deception Asset Types) into a `references/` file and link to it from SKILL.md to keep the overview lean.

Add an explicit validate→fix→retry loop to the workflows (e.g., re-run the analyzer after adjusting baselines or pruning stale IOCs) to strengthen error recovery for batch operations.

Dimension	Reasoning	Score
Conciseness	The body assumes Claude's competence (no explanations of what IOCs, z-scores, or MITRE ATT&CK are) and is dense with operational specifics, but some large reference tables (Tactic Coverage Matrix, hunt hypotheses) could be trimmed or moved to reference files.	4 / 5
Actionability	Provides fully executable, copy-paste-ready commands for all three analyzer modes with concrete flags, file-format examples, exit-code semantics, and three end-to-end workflows covering common cases.	5 / 5
Workflow Clarity	Three workflows are clearly sequenced with validation checkpoints (Decision gate, triage confirm/dismiss, exit-code-based escalation) and a feedback loop to detection engineering, but an explicit validate→fix→retry error-recovery loop is not strongly present.	4 / 5
Progressive Disclosure	Has a TOC and clear sections, but inlines substantial reference data that could live in separate files, and references `references/hunt-playbooks.md` and `scripts/threat_signal_analyzer.py` which do not exist in the bundle — a broken, not-clearly-signaled reference path.	3 / 5
	Total	16 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that explicitly states both what the skill does and when to use it, with concrete, specific capabilities and natural trigger terms. The only minor gap is some synonym coverage and slight overlap risk with adjacent security skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "hunting for threats", "analyzing IOCs", "detecting behavioral anomalies", "IOC sweep generation", "z-score anomaly detection", "MITRE ATT&CK-mapped signal prioritization" — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly answers both: the "Use when..." clause provides concrete trigger guidance, and "Covers hypothesis-driven threat hunting, IOC sweep generation..." states what the skill does.	5 / 5
Trigger Term Quality	Includes natural phrases users would say ("hunting for threats", "analyzing IOCs", "behavioral anomalies in telemetry"), but a few common synonyms are absent (e.g. "threat intelligence", "indicators of compromise" spelled out, "TTPs").	4 / 5
Distinctiveness Conflict Risk	The proactive "hunting" framing and IOC/anomaly triggers carve a clear niche distinct from incident-response, but there is minor overlap risk with incident-response since both involve IOCs and threat analysis.	4 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 4 suspicious	Warning
referenced_paths_exist	Referenced path issues: 9 missing	Warning

	Total	14 / 16 Passed

Repository: alirezarezvani/claude-skills
Path: .gemini/skills/threat-detection/SKILL.md
Commit: 19392f7

Reviewed: ~16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.