deep-dive-ioc

Perform exhaustive analysis of a critical IOC. Use when an IOC needs Tier 2+ investigation beyond basic enrichment - includes GTI pivoting, deep SIEM searches, correlation with related entities, and threat attribution. For escalated IOCs requiring comprehensive investigation.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable investigative workflow that stays lean and self-contained. The main gaps are placeholder query text and the absence of explicit validation/verification checkpoints between steps.

Suggestions

Replace the placeholder text="UDM query for IOC_VALUE" in Step 4 with a concrete UDM query example or a parameterized template so the SIEM search is copy-paste ready.

Add explicit validation checkpoints between steps (e.g. 'Confirm OBSERVED_RELATED_IOCS is populated before proceeding to Step 5 enrichment') to strengthen the workflow's feedback structure.

Dedupe the 'Required Outputs' table with the 'Additionally provide' bullet list, or fold the bullets into the table, to remove the small conciseness redundancy.

Dimension	Reasoning	Score
Conciseness	Lean, table-and-code-driven body that assumes analyst competence and avoids explaining what IOCs are; minor redundancy between the 'Required Outputs' table and the 'Additionally provide' list keeps it just below the level-5 lean anchor.	4 / 5
Actionability	Mostly executable with concrete tool calls and parameters (e.g. gti-mcp.get_ip_address_report(ip_address=IOC_VALUE)), but the SIEM step's text="UDM query for IOC_VALUE" is a placeholder rather than a real query, a minor gap below level 5.	4 / 5
Workflow Clarity	A clear 7-step sequence with inter-step data artifacts (ASSOCIATED_THREAT_IDS, OBSERVED_RELATED_IOCS) and a Required Outputs checklist; it lacks explicit validate-then-proceed checkpoints, but the operation is read-only so the destructive-cap does not apply.	4 / 5
Progressive Disclosure	A single self-contained file, well-sectioned into Inputs, Workflow, Required Outputs, and a usage-contrast table with no nested references; at >50 lines it sits just outside the simple-skill level-5 exception.	4 / 5
	Total	16 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that clearly states both what exhaustive IOC analysis entails and when to invoke it, with concrete enumerated capabilities. Trigger phrasing and distinctiveness from the basic enrichment skill are good but could be sharper.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'GTI pivoting, deep SIEM searches, correlation with related entities, and threat attribution' — giving comprehensive coverage of what the skill does, matching the level-5 anchor rather than the 4-anchor's 'minor gaps'.	5 / 5
Completeness	Explicitly answers both what ('Perform exhaustive analysis of a critical IOC…includes GTI pivoting…') and when ('Use when an IOC needs Tier 2+ investigation beyond basic enrichment', 'For escalated IOCs requiring comprehensive investigation') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Good domain keyword coverage ('IOC', 'Tier 2+ investigation', 'enrichment', 'escalated IOCs', 'comprehensive investigation') an analyst would naturally say, but lacks synonyms/variations that would push it to 5.	4 / 5
Distinctiveness Conflict Risk	The 'beyond basic enrichment' and 'Tier 2+' framing carves a clear niche from /enrich-ioc, but both skills handle IOCs so minor overlap risk remains rather than the minimal-conflict level-5 anchor.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/deep-dive-ioc/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.