hunt-apt
Hunt for a specific APT/threat actor in your environment. Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs. Gathers intelligence from GTI, searches SIEM for IOCs and TTP-based indicators, and documents findings.
86
Does it follow best practices?
If you maintain this skill, you can automatically optimize it using the tessl CLI to improve its score:
npx tessl skill review --optimize ./path/to/skillValidation for skill structure
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a well-crafted skill description that excels across all dimensions. It clearly specifies the capability (APT/threat actor hunting), provides explicit trigger conditions (threat actor name or GTI collection ID), and uses domain-appropriate terminology that security professionals would naturally use. The description is concise yet comprehensive.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'Hunt for a specific APT/threat actor', 'Gathers intelligence from GTI', 'searches SIEM for IOCs and TTP-based indicators', and 'documents findings'. | 3 / 3 |
Completeness | Clearly answers both what ('Hunt for APT/threat actor, gathers intelligence, searches SIEM, documents findings') and when ('Use when you have a threat actor name or GTI collection ID and want to search for their TTPs and IOCs'). | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'APT', 'threat actor', 'GTI collection ID', 'TTPs', 'IOCs', 'SIEM', 'threat hunting'. These are terms security professionals naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with clear niche in threat hunting/APT investigation. The specific triggers (threat actor name, GTI collection ID, TTPs, IOCs) make it unlikely to conflict with general security or document skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
72%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured APT hunting skill with efficient token usage and clear workflow organization. The main weaknesses are the lack of concrete UDM query examples (using placeholders instead of executable patterns) and missing validation checkpoints between steps. The skill would benefit from specific query templates and explicit error handling guidance.
Suggestions
Add concrete UDM query examples for common IOC types (e.g., domain lookups, file hash searches) instead of placeholder text like 'UDM query for IOC'
Include validation checkpoints after Step 1 to verify GTI data was retrieved successfully before proceeding to SIEM searches
Add specific guidance on how to translate MITRE techniques into UDM queries in Step 4, with at least one worked example
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is lean and efficient, avoiding explanations of concepts Claude already knows. Every section serves a purpose with no padding or unnecessary context about what APTs are or how threat hunting works. | 3 / 3 |
Actionability | Provides concrete tool calls and a clear workflow, but UDM query examples are placeholders ('UDM query for IOC') rather than executable examples. The TTP-based search section is vague about how to 'formulate TTP-specific UDM queries'. | 2 / 3 |
Workflow Clarity | Steps are clearly sequenced with good logical flow, but lacks explicit validation checkpoints. No verification that GTI data was successfully retrieved before proceeding, and no error handling guidance if searches return unexpected results. | 2 / 3 |
Progressive Disclosure | Well-organized with clear sections, summary tables for outputs and intelligence sources, and appropriate references to other skills (/find-relevant-case, /document-in-case, /generate-report). Content is appropriately structured for a single file. | 3 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.