enrich-ioc

Enrich an IOC (IP, domain, hash, URL) with threat intelligence. Use when you need to look up reputation and context for an indicator using GTI and SIEM. Returns threat intel findings, SIEM entity summary, and IOC match status.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/enrich-ioc/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, mostly executable enrichment playbook with clear sequencing and an explicit error-handling checkpoint. The main gaps are duplicated tool listings in Quick Reference, an under-specified get_ioc_matches() call, and no explicit verification step for the IOC match check.

Suggestions

Remove or trim the 'Quick Reference' section since it duplicates the Step 1 tool table, or replace it with genuinely new content (e.g. argument types or response fields).

Show get_ioc_matches() with the realistic parameters needed to filter by IOC_VALUE, and clarify how to confirm a match (e.g. 'compare IOC_VALUE against returned indicator fields').

Add a brief validation/verification note after Step 3 confirming the IOC match status before reporting outputs.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence, using tight tables and short field lists instead of explaining what an IOC or SIEM is; the only padding is the 'Quick Reference' section, which restates the tool calls already shown in Step 1, keeping it just below the fully lean 5.	4 / 5
Actionability	Provides concrete, near-executable tool calls with example arguments (e.g. get_ip_address_report(ip_address="198.51.100.10")), but get_ioc_matches() is shown with no arguments and lookup_entity uses a placeholder variable, leaving minor gaps that fit the 'mostly executable' anchor rather than fully copy-paste ready 5.	4 / 5
Workflow Clarity	The three-step sequence is clearly ordered with an explicit error-handling checkpoint in Step 1 ('If GTI fails...note the limitation and proceed with SIEM enrichment'); since this is read-only enrichment (not destructive/batch), the validation cap does not apply, but Step 3's match check lacks an explicit verification step, fitting the 4 anchor.	4 / 5
Progressive Disclosure	No bundle files exist, and the body is well-organized into Inputs, Workflow, Required Outputs, and Quick Reference with clear section headers and no nested references; it slightly exceeds the 'under 50 lines' simple-skill allowance and the Quick Reference mildly duplicates earlier content, so it sits at 4 rather than 5.	4 / 5
	Total	16 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that covers what and when with concrete tool and IOC-type keywords. The main weakness is the 'when' clause being slightly generic rather than listing concrete user trigger phrases, which keeps completeness and trigger quality at 4 instead of 5.

Suggestions

Tighten the 'Use when' clause with concrete user trigger phrases, e.g. 'Use when the user asks to look up or enrich an IP, domain, hash, or URL, or wants threat intel/reputation on an indicator.'

Add a couple of natural synonyms (e.g. 'threat intel', 'reputation lookup') to broaden trigger-term coverage.

Consider naming Chronicle SIEM explicitly alongside GTI and SIEM to further sharpen distinctiveness.

Dimension	Reasoning	Score
Specificity	Names the domain (IOC enrichment) and several concrete actions ('Enrich...with threat intelligence', 'look up reputation and context', 'Returns threat intel findings, SIEM entity summary, and IOC match status'), with only minor coverage gaps, fitting the 'several specific actions' anchor rather than the fully comprehensive 5.	4 / 5
Completeness	It explicitly answers both 'what' (enrich an IOC, returns findings/summary/match status) and 'when' ('Use when you need to look up reputation and context for an indicator using GTI and SIEM'), but the 'when' clause is general rather than tied to concrete trigger phrases, matching the 4 anchor and not the fully explicit 5.	4 / 5
Trigger Term Quality	Good keyword coverage with natural terms users would say ('IOC', 'IP, domain, hash, URL', 'threat intelligence', 'reputation and context', 'indicator') plus tool names, but a few common synonyms (e.g. 'threat intel', 'look up an IP') are missing so it sits below the comprehensive 5.	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche (IOC enrichment via GTI and Chronicle SIEM) with distinct, tool-specific triggers and minimal overlap risk with other skills, matching the 'clear niche with distinct triggers' anchor.	5 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
referenced_paths_exist	Referenced path issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/enrich-ioc/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.