close-case-artifact

Close a case or alert with proper reason and documentation. Use when triage determines an alert is FP/BTP or investigation is complete. Requires artifact ID, type, closure reason, and root cause.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is lean, actionable, and well-organized for a single-purpose closure skill. The main weakness is the absence of any success verification or error-recovery checkpoint for a destructive operation, which caps workflow clarity.

Suggestions

Add a post-closure verification step that checks the returned status (e.g., confirm CLOSURE_STATUS indicates success) and retries or surfaces errors on failure.

Include brief error-handling guidance for common failure modes (invalid ARTIFACT_ID, ROOT_CAUSE not in allowed list, permission errors) so Claude can recover rather than abort.

Note the expected shape/value of CLOSURE_STATUS so the verification step is actionable rather than vague.

Dimension	Reasoning	Score
Conciseness	The body is lean: clean input list, two short code blocks, a patterns table, and a root-cause lookup hint, with no padding or explanations of concepts Claude already knows. Every section earns its place.	5 / 5
Actionability	Concrete, executable calls (siemplify_close_case, siemplify_close_alert) with named parameters cover both the case and alert common cases, and the inputs section defines each value unambiguously.	5 / 5
Workflow Clarity	The single "Step 1: Execute Closure" is sequenced with case/alert branches, but closing a case is a destructive state change and there is no verification of success or error-handling checkpoint, so per the destructive-operation cap workflow clarity cannot exceed 3.	3 / 5
Progressive Disclosure	A self-contained, single-purpose skill with well-organized sections (Inputs, Workflow, Outputs, Patterns, Root Causes) and no bundle files or nested references; structure is clear and easy to navigate.	5 / 5
	Total	18 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states what the skill does and gives explicit, natural trigger guidance. Required inputs are enumerated, and the niche is well-scoped with low conflict risk.

Dimension	Reasoning	Score
Specificity	"Close a case or alert with proper reason and documentation" names the domain and concrete actions, and "Requires artifact ID, type, closure reason, and root cause" enumerates specific required inputs; minor coverage gaps (e.g., the optional alert-specific fields) keep it just below comprehensive.	4 / 5
Completeness	It explicitly answers "what" (close a case/alert with reason, documentation, and required inputs) and "when" with concrete trigger phrases (triage determines FP/BTP, investigation complete), matching the top anchor.	5 / 5
Trigger Term Quality	"Use when triage determines an alert is FP/BTP or investigation is complete" supplies natural analyst phrases (triage, FP/BTP, investigation complete); a few common synonyms or phrasings are missing, so it is not a full 5.	4 / 5
Distinctiveness Conflict Risk	Closing SOAR cases/alerts with FP/BTP and investigation-complete triggers is a clear niche with distinct triggers and minimal overlap risk with unrelated skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/close-case-artifact/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.