hunt-threat

Conduct proactive, hypothesis-driven threat hunting. Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies. For Tier 3 analysts or dedicated threat hunters. Supports iterative search, pivoting, and comprehensive documentation.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable threat-hunting skill with a clear sequenced workflow and concrete query examples. Main improvement is replacing placeholder queries in Step 3 with real executable examples and trimming redundant input examples.

Suggestions

Replace the placeholder queries in Step 3 ('Advanced UDM query targeting specific behaviors', 'Complex analytical query') with concrete executable examples like the ones already in the Example Hunt Queries section.

Trim the three HUNT_HYPOTHESIS example bullets to one or two to reduce token overhead without losing clarity.

Add an explicit validation checkpoint in the hunt loop (e.g., confirm a lead is not noise before pivoting) to strengthen the existing feedback loop.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence (no explanation of what threat hunting or TTPs are), though the three example lines for HUNT_HYPOTHESIS could be trimmed.	4 / 5
Actionability	Provides concrete MCP calls and fully-formed UDM example queries, but some Step 3 queries are placeholders ('Advanced UDM query targeting specific behaviors', 'Complex analytical query') rather than executable.	4 / 5
Workflow Clarity	An eight-step sequence is clearly laid out with an iterative hunt loop acting as a feedback mechanism; it is analysis rather than destructive work, so the missing hard validation checkpoint is a minor gap.	4 / 5
Progressive Disclosure	Well-organized single-file skill with clear section headers and no nested references; no bundle files are needed or referenced, and structure is easy to navigate.	4 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that clearly states capability and trigger conditions in third person with concrete natural-language keywords. Minor room to add synonyms/file-extension-style triggers, but it already satisfies both what and when explicitly.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('hypothesis-driven threat hunting', 'iterative search, pivoting, and comprehensive documentation') rather than vague language, with only minor gaps in coverage.	4 / 5
Completeness	Explicitly answers both what ('Conduct proactive, hypothesis-driven threat hunting...') and when ('Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural analyst-facing terms ('threat hunting', 'threat intelligence', 'TTPs', 'anomalies') a user would say, with a few common synonyms missing.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche ('threat hunting' for 'Tier 3 analysts or dedicated threat hunters') with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/hunt-threat/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.