full-alert-triage

Complete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.

Quality

62%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/_workflows/full-alert-triage/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A clearly structured, actionable orchestration skill with concrete sub-skill invocations and a helpful decision table. Its main weaknesses are duplicated workflow representation (diagram + steps), missing validation/feedback checkpoints for batch and disposition actions, and a monolithic layout with no external references.

Suggestions

Add explicit validation checkpoints, e.g. after enrichment confirm IOC_MATCH_STATUS before classifying, and verify close-case-artifact succeeded before ending.

Collapse the ASCII diagram and 'Detailed Steps' into a single representation (or move the diagram to a reference file) to remove duplicated content.

Extract the per-sub-skill argument details and decision criteria into reference files linked one level deep from SKILL.md to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Mostly efficient prose, but the ~45-line ASCII diagram and the subsequent 'Detailed Steps' section re-cover the same flow, adding tokens that could be tightened without losing clarity.	3 / 5
Actionability	Provides concrete, copy-pasteable invocations like '/check-duplicates CASE_ID=$CASE_ID' and '/enrich-ioc IOC_VALUE=$entity' plus a decision table, with minor gaps in fully specifying args for /document-in-case and /close-case-artifact.	4 / 5
Workflow Clarity	Steps are clearly sequenced into five phases with a decision table and error handling, but the workflow performs batch enrichment and a destructive disposition (close-case-artifact) without explicit validate→fix→retry checkpoints, which caps this dimension at 3 per the rubric.	3 / 5
Progressive Disclosure	Well-organized into labeled sections, but at ~173 lines it is a monolithic SKILL.md with no bundle files and no one-level-deep references; content such as decision criteria or per-sub-skill argument details is inlined rather than split out.	3 / 5
	Total	13 / 20 Passed

Description

67%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A solid workflow-orchestrator description that names concrete sub-skills and dispositions and includes a 'Use for' trigger. It is held back from a top score by a somewhat generic trigger clause and limited synonym coverage.

Suggestions

Broaden the 'Use for' clause with natural trigger variations, e.g. 'Use for end-to-end Tier 1 alert triage, investigating or dispositioning SIEM/security alerts.'

Clarify the 'when' boundary so it is distinguishable from the individual triage-alert sub-skill (e.g., 'Use when you need the full pre-check → triage → enrich → disposition flow, not a single step.').

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'check-duplicates, triage-alert, enrich-ioc for each entity', 'close (FP/BTP)', 'escalate (TP/Suspicious)' — giving comprehensive coverage of the orchestration, with only minor gaps in describing each sub-skill's effect.	4 / 5
Completeness	Clearly states what it does ('Orchestrates the full alert triage process: ...') and when to use it ('Use for end-to-end alert processing'), but the 'when' trigger is generic and could be more specific.	4 / 5
Trigger Term Quality	Includes natural phrases like 'Tier 1 triage', 'alert triage', and 'end-to-end alert processing', but misses common synonyms a user might say such as 'investigate alert', 'SIEM alert', or 'security alert'.	3 / 5
Distinctiveness Conflict Risk	The 'Complete Tier 1 triage workflow' framing and named sub-skills carve a clear niche, with only minor overlap risk against the individual sub-skills it orchestrates (e.g., triage-alert).	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/_workflows/full-alert-triage/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.