hunt-ioc

Hunt for specific IOCs across your environment. Use when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM. Systematic searching with enrichment and documentation.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-ioc/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, actionable hunting runbook with concrete MCP calls and per-IOC-type query templates. Its main weakness is workflow validation: a batch search across many IOCs needs an explicit verify-all-searched checkpoint and retry loop rather than only input-format validation and a post-hoc checklist.

Suggestions

Add an explicit verification checkpoint after Step 3 that confirms every IOC in IOC_LIST was searched (e.g., a checklist comparing searched IOCs against IOC_LIST) with a retry loop for any missed or failed searches — this lifts the batch-operation cap on workflow_clarity.

Consolidate the redundant documentation sections (Step 6 Document Hunt template, Output Summary Template, and Required Outputs table) into a single output contract to reduce token overlap.

Make placeholder substitution explicit in the UDM examples (e.g., note that 'IOC' is replaced per-item and show the loop over IOC_LIST) so the search step is copy-paste ready rather than implicit.

Dimension	Reasoning	Score
Conciseness	Mostly lean — concrete MCP calls and UDM snippets with no padding about what IOCs or SIEMs are — though the Output Summary Template, Required Outputs, and Step 6 Document Hunt section overlap and could be consolidated.	4 / 5
Actionability	Provides concrete executable guidance — 'secops-mcp.get_ioc_matches(hours_back=...)', per-IOC-type UDM query templates, 'secops-mcp.lookup_entity(entity_value=ENTITY)' — with only minor gaps (placeholder substitution and loop structure left implicit).	4 / 5
Workflow Clarity	Seven clearly sequenced steps with input validation in Step 1 and a closing Critical Requirements checklist, but this batch operation (search ALL IOCs) lacks an explicit verification checkpoint or error-recovery loop confirming every IOC was searched, so the batch-validation cap at 3 applies.	3 / 5
Progressive Disclosure	Single, well-organized file with clear section headers and no nested references; the UDM query library and output templates are reasonable inline, though either could be factored into a reference file for a cleaner overview.	4 / 5
	Total	15 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that concretely states what the skill does and gives an explicit, scenario-based 'Use when' trigger with natural threat-intel vocabulary. Minor room to tighten the action list and reduce overlap with sibling enrichment/documentation skills.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions — 'Hunt for specific IOCs', 'check if they appear in your SIEM', 'Systematic searching with enrichment and documentation' — listing search, enrichment, and documentation with only minor gaps in coverage.	4 / 5
Completeness	Clearly states what it does ('Hunt for specific IOCs... Systematic searching with enrichment and documentation') and an explicit 'Use when' trigger clause with concrete conditions ('when you have a list of IPs, domains, hashes, or URLs from threat intel and want to check if they appear in your SIEM').	5 / 5
Trigger Term Quality	Good natural keyword coverage — 'IOCs', 'IPs, domains, hashes, or URLs', 'threat intel', 'SIEM' — that a threat-hunter would actually say, though a few synonyms or file-extension equivalents are missing.	4 / 5
Distinctiveness Conflict Risk	The IOC-hunt-in-SIEM niche has distinct triggers and low conflict risk, but 'enrichment and documentation' overlap with adjacent skills (enrich-ioc, document-in-case), leaving minor overlap risk.	4 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/hunt-ioc/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.