full-investigation

Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis.

Quality

69%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/_workflows/full-investigation/SKILL.md

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, actionable investigation workflow with concrete skill invocations, decision tables, validation, and error handling. The main inefficiency is redundancy between the ASCII diagram and the detailed steps.

Suggestions

Trim or condense the ASCII orchestration diagram since the Detailed Steps already describe the same flow, reducing token redundancy.

Replace the pseudocode IOC aggregation with a concrete, executable step or a clear data-shape description so the guidance is fully actionable.

Add an explicit 'Validate findings before disposition' checkpoint before the close/escalate actions to strengthen the feedback loop around the consequential disposition step.

Dimension	Reasoning	Score
Conciseness	The body is mostly operational and avoids explaining concepts Claude already knows, but the large ASCII orchestration diagram substantially restates the Detailed Steps that follow, adding redundant tokens that could be tightened.	3 / 5
Actionability	Provides concrete, executable invocations (secops-soar.get_case_full_details(case_id=CASE_ID), /deep-dive-ioc IOC_VALUE=$ioc CASE_ID=$CASE_ID) and alert-type routing tables, with only minor gaps such as the pseudocode aggregation ALL_DISCOVERED_IOCS = PRIMARY_IOCS + all(...).	4 / 5
Workflow Clarity	Six phases are clearly sequenced with explicit decision routing, an outcome criteria table gating disposition, an explicit validation step (Step 4.2 Validate Expanded IOCs), and an error-handling section with fallbacks, leaving only minor checkpoint gaps.	4 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ all absent) and none are needed for this self-contained orchestrator; content is well organized into Inputs, Orchestrated Workflow, Detailed Steps, Outputs, Error Handling, and Performance Targets with clear navigation.	4 / 5
	Total	15 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinct, and answers both what the skill does and when to use it with a concrete trigger phrase. Its main weakness is trigger-term breadth, which leans on domain jargon and could add more natural synonyms.

Suggestions

Broaden trigger terms with natural synonyms users actually say, e.g. 'SOC investigation', 'incident escalation', 'case escalation'.

Make the 'when' clause more specific by naming the alert or escalation contexts that warrant this skill (e.g. 'Use when Tier 1 escalates a malware, phishing, or suspicious-login case for deep analysis').

Spell out a couple of the orchestrated skills as actions rather than relying solely on slash-command names to maximize specificity.

Dimension	Reasoning	Score
Specificity	Names the Tier 2 investigation domain and enumerates several concrete orchestrated actions (deep-dive-ioc, correlate-ioc, specialized triage malware/login, pivot-on-ioc, generate comprehensive report), giving broad coverage though mostly as skill names rather than fully spelled-out actions.	4 / 5
Completeness	Clearly states what it does (complete Tier 2 investigation orchestrating named sub-skills) and provides an explicit 'Use for escalated cases requiring thorough analysis' trigger, though the 'when' could be more specific about alert types or escalation contexts.	4 / 5
Trigger Term Quality	Contains relevant natural terms ('Tier 2 investigation', 'escalated cases', 'thorough analysis') with an explicit 'Use for' trigger, but lacks common synonyms and variations a user might say (e.g. 'SOC', 'incident', 'escalation').	3 / 5
Distinctiveness Conflict Risk	Occupies a clear niche — a Tier 2/3 investigation orchestrator invoking specific named skills (deep-dive-ioc, correlate-ioc, triage-malware, etc.) — making it highly distinguishable with minimal overlap risk against other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/_workflows/full-investigation/SKILL.md
Commit: 2df8378

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.