hunt-apt

Hunt for a specific APT/threat actor in your environment. Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs. Gathers intelligence from GTI, searches SIEM for IOCs and TTP-based indicators, and documents findings.

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-apt/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, mostly lean hunt workflow with concrete tool calls, but it is held back by placeholder code in Step 5, template UDM queries in Step 3, and the absence of an explicit validation checkpoint in the batch search flow.

Suggestions

Replace the Step 5 placeholder 'gti-mcp.get_..._report(identifier=FOUND_ITEM)' with the actual tool call(s) for entity/IOC enrichment so the guidance is executable.

Add an explicit validation checkpoint in the workflow (e.g., before Step 8) requiring enrichment/confirmation of candidate hits before classifying them, rather than only listing 'Don't report false positives' as a bullet.

Provide at least one concrete example UDM query string for an IOC type in Step 3 instead of the generic text="UDM query for IOC" template, or remove the redundant 'Key Intelligence Sources' table that duplicates Step 1's tool calls.

Dimension	Reasoning	Score
Conciseness	Mostly lean and assumes Claude's competence (no padding about what APT/MITRE/SIEM are), but the 'Key Intelligence Sources' table largely duplicates the tool calls already shown in Step 1 and could be trimmed.	4 / 5
Actionability	Provides concrete MCP calls with parameters, but Step 5 uses an explicit placeholder ('gti-mcp.get_..._report(identifier=FOUND_ITEM)') and Step 3's text="UDM query for IOC" is a template rather than an executable query.	3 / 5
Workflow Clarity	Eight steps are clearly sequenced with decision branching in Step 8, but this batch IOC-search workflow lacks an explicit validation checkpoint in the flow; the false-positive caution lives only in a bullet list, capping clarity at 3.	3 / 5
Progressive Disclosure	Well-organized into clear sections (Inputs, Workflow, Required Outputs, Key Intelligence Sources, Critical Requirements) with no nested references and no bundle files; structure is clean though the body is self-contained rather than split across files.	4 / 5
	Total	14 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names the domain, concrete actions, and an explicit trigger clause. It is distinctive and complete, with only minor gaps in action coverage and trigger synonyms.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('Gathers intelligence from GTI', 'searches SIEM for IOCs and TTP-based indicators', 'documents findings') with minor gaps (enrichment and escalation not mentioned).	4 / 5
Completeness	Explicitly answers both what (hunt, gather intel, search SIEM, document) and when ('Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Good natural keyword coverage ('APT', 'threat actor', 'GTI collection ID', 'TTPs', 'IOCs') a threat hunter would say, though a few synonyms like 'indicators of compromise' or 'campaign' are missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (APT/threat-actor hunting) with distinct triggers (threat actor name, GTI collection ID) and minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/hunt-apt/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.