hunt-credential-access

Hunt for credential access techniques like LSASS dumping or browser credential theft. Use when searching for evidence of credential harvesting. Takes MITRE technique IDs and searches for behavioral indicators in SIEM.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-credential-access/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable hunt skill with concrete executable queries and a clear workflow, weakened only by absent validation checkpoints in its batch SIEM operations. Adding explicit verify/retry steps would lift workflow clarity.

Suggestions

Add an explicit validation checkpoint after Step 3 (e.g., confirm the search returned parseable results and that each UDM query matched the intended event type) before proceeding to enrichment.

Define or replace placeholders such as @known_domain_controllers, USER_OR_HOST, and HASH with concrete guidance or a note on where their values come from.

Trim the tutorial-style 'Understand:' bullets in Step 1 to a single line referencing the threat-intel call, since Claude already knows what MITRE techniques are.

Dimension	Reasoning	Score
Conciseness	Mostly lean with concrete UDM queries and MCP calls; a few mild tutorial-style bullets ('Understand: What the technique does...') could be trimmed but do not pad heavily.	4 / 5
Actionability	Provides copy-paste-ready UDM queries and specific MCP tool calls for the common techniques, with minor unresolved placeholders like @known_domain_controllers, USER_OR_HOST, and HASH.	4 / 5
Workflow Clarity	A clear 7-step sequence is present, but batch SIEM operations lack explicit validation checkpoints or failure feedback loops, which caps this dimension per the rubric guidance.	3 / 5
Progressive Disclosure	A single self-contained SKILL.md under ~150 lines with no bundle files and clean, well-organized section headers; the simple-skill exception applies so well-organized sections earn the top score.	5 / 5
	Total	16 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly conveys a specialized credential-access threat-hunting skill with explicit trigger guidance. Minor improvements could broaden trigger synonyms and enumerate more technique families.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions ('hunt for credential access techniques', 'takes MITRE technique IDs', 'searches for behavioral indicators in SIEM') with only minor coverage gaps.	4 / 5
Completeness	Explicitly answers both what ('hunt for credential access techniques... searches for behavioral indicators in SIEM') and when ('Use when searching for evidence of credential harvesting'), with the 'when' slightly more specific than anchor 3 but not fully comprehensive.	4 / 5
Trigger Term Quality	Good natural keyword coverage ('LSASS dumping', 'browser credential theft', 'credential harvesting', 'SIEM') that a threat hunter would actually say, though a few synonyms are missing.	4 / 5
Distinctiveness Conflict Risk	Clear specialized niche (MITRE credential-access hunting in a SIEM) with distinct, specific triggers that minimize overlap with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/hunt-credential-access/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.