hunt-ioc
Hunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation.
92
Does it follow best practices?
Validation for skill structure
Discovery
89%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong skill description with excellent trigger terms and completeness. It clearly identifies when to use the skill and includes natural keywords security analysts would use. The main weakness is that the specific capabilities could be more concrete - 'systematic searching with enrichment and documentation' is somewhat vague compared to listing specific actions.
Suggestions
Replace 'Systematic searching with enrichment and documentation' with specific actions like 'queries SIEM logs, correlates matches across data sources, enriches findings with threat context, and generates investigation reports'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (IOC hunting, SIEM) and mentions actions like 'systematic searching with enrichment and documentation', but doesn't list multiple concrete specific actions like 'query logs', 'correlate events', or 'generate reports'. | 2 / 3 |
Completeness | Clearly answers both what ('Hunt for specific IOCs across your environment', 'Systematic searching with enrichment and documentation') and when ('Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM'). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms users would say: 'IOCs', 'IPs', 'domains', 'hashes', 'URLs', 'threat intel', 'SIEM'. These are exactly the keywords a security analyst would use when needing this capability. | 3 / 3 |
Distinctiveness Conflict Risk | Very clear niche focused on IOC hunting in SIEM environments with specific artifact types (IPs, domains, hashes, URLs). Unlikely to conflict with general security or data analysis skills due to the specific threat intel context. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
92%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a high-quality skill that provides clear, actionable guidance for IOC hunting with concrete queries, proper tool calls, and a well-structured workflow. The skill excels at actionability and workflow clarity with explicit steps and decision points. Minor improvement could be made by extracting the query reference and output templates to separate files for better progressive disclosure.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is lean and efficient, providing only necessary information without explaining concepts Claude already knows. Each section serves a clear purpose with no padding or unnecessary context. | 3 / 3 |
Actionability | Provides concrete, executable UDM queries for each IOC type, specific MCP tool calls with parameters, and copy-paste ready templates. The guidance is specific and immediately usable. | 3 / 3 |
Workflow Clarity | Clear 7-step sequence with explicit decision points (Step 7 escalate vs conclude), validation through enrichment steps, and proper handling of both positive and negative results. The workflow handles the iterative nature of IOC hunting well. | 3 / 3 |
Progressive Disclosure | Content is well-organized with clear sections, but everything is inline in a single file. References to other skills (/enrich-ioc, /document-in-case) are mentioned but the skill itself could benefit from separating the output templates or query reference into linked files for a cleaner overview. | 2 / 3 |
Total | 11 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.