hunt-credential-access
Hunt for credential access techniques like LSASS dumping or browser credential theft. Use when searching for evidence of credential harvesting. Takes MITRE technique IDs and searches for behavioral indicators in SIEM.
90
88%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong, well-crafted skill description that clearly defines its domain (credential access hunting), lists specific techniques and capabilities, includes an explicit 'Use when' clause, and uses natural security analyst terminology. It follows third-person voice throughout and provides enough specificity to be easily distinguishable from other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'LSASS dumping', 'browser credential theft', 'credential harvesting', takes 'MITRE technique IDs', and 'searches for behavioral indicators in SIEM'. These are concrete, specific capabilities. | 3 / 3 |
Completeness | Clearly answers both what ('Hunt for credential access techniques like LSASS dumping or browser credential theft', 'Takes MITRE technique IDs and searches for behavioral indicators in SIEM') and when ('Use when searching for evidence of credential harvesting') with an explicit trigger clause. | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords a security analyst would use: 'credential access', 'LSASS dumping', 'browser credential theft', 'credential harvesting', 'MITRE technique IDs', 'SIEM', 'behavioral indicators'. Good coverage of domain-specific terms users would naturally say. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche focused on credential access hunting in SIEM using MITRE technique IDs. The specific mention of LSASS dumping, browser credential theft, and MITRE IDs makes it very unlikely to conflict with other security or general-purpose skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, actionable skill with concrete UDM queries and clear MCP tool invocations for hunting credential access techniques. The workflow is well-sequenced with appropriate escalation paths and documentation requirements. Minor improvements could be made in conciseness and progressive disclosure by extracting the technique-specific query library into a separate reference file.
Suggestions
Consider extracting the technique-specific UDM queries into a separate reference file (e.g., CREDENTIAL_ACCESS_QUERIES.md) and keeping only one example query inline to reduce the main skill's length.
Remove the 'Understand: What the technique does / Common procedures/tools / Detection methods' bullet list in Step 1 as this is implicit in researching a technique.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The technique reference table and common techniques section add useful context, but some explanations are slightly verbose (e.g., 'Understand: What the technique does, Common procedures/tools, Detection methods' is somewhat obvious). The skill is reasonably efficient but could be tightened in places. | 2 / 3 |
Actionability | Provides concrete, executable UDM queries for each technique, specific MCP tool calls with parameters, and clear examples of what to search for. The queries are copy-paste ready and cover multiple credential access scenarios. | 3 / 3 |
Workflow Clarity | The 7-step workflow is clearly sequenced with logical progression from research through execution to documentation. It includes validation/enrichment steps (Steps 4-5), explicit escalation criteria with branching paths (Step 7), and guidance on handling both positive and negative findings. | 3 / 3 |
Progressive Disclosure | The content is well-structured with clear sections and tables, but it's a fairly long monolithic document. The inline UDM queries for multiple techniques could potentially be split into a reference file, and the cross-references to other skills (/respond-compromised-account, /document-in-case) are mentioned but not linked to files. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- dandye/ai-runbooks
- Commit
086cbf6
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.