respond-malware

Respond to a malware incident following PICERL methodology. Use when malware is detected on endpoints. Orchestrates triage, containment, eradication, and recovery. Works with triage-malware skill for analysis.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/respond-malware/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is well-structured and sequenced around PICERL with useful tables and confirm-action gates, but several phases (notably eradication and recovery) replace executable guidance with placeholder tool notes and lack explicit validation checkpoints for destructive actions. Progressive disclosure is clean for a self-contained single-file skill.

Suggestions

Replace '*(Requires EDR/endpoint tools)*' placeholders in Eradication with concrete, executable EDR/MCP commands or named tool calls so the guidance is copy-paste ready.

Add explicit validation checkpoints for destructive operations (e.g., 'Re-scan after removal; only proceed to Recovery when scan is clean') to lift workflow_clarity above 3.

Consolidate the duplicated output tables and inline output reminders into one location to reduce token redundancy.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with clear tables and lean step descriptions, but it restates PICERL phase structure and repeats output expectations across both a 'Required Outputs' section and the inline phase steps, which could be tightened.	3 / 5
Actionability	It provides concrete tool invocations (e.g., '/triage-malware FILE_HASH=abc123', 'secops-soar.get_case_full_details(case_id=CASE_ID)'), but key phases like eradication are left as '(Requires EDR/endpoint tools)' with pseudocode-style plans ('Terminate malicious processes', 'Delete malware files') rather than executable commands.	3 / 5
Workflow Clarity	The PICERL phases are clearly sequenced with '/confirm-action' checkpoints before containment and 'Verify Containment' steps, but eradication and recovery rely on unverified 'Execute removal plan' and 'Lift Containment once confidence is high' without explicit validation gates for these destructive operations, which caps the score at 3 per the destructive-operations guideline.	3 / 5
Progressive Disclosure	The body is well-organized into clearly signaled sections (Inputs, Required Outputs, PICERL Phases, Critical Warnings, Quick Reference) with no bundle files needed and no nested references, so the single-file structure is appropriately self-contained and navigable.	5 / 5
	Total	14 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is solid and well-scoped: it names the PICERL methodology, concrete phases, an explicit 'Use when' trigger, and a sibling-skill integration. It falls just short of the top anchor because the listed actions are phase-level rather than multiple granular concrete operations, and trigger synonyms are limited.

Suggestions

Expand the action list from phase names to concrete operations (e.g., 'isolates endpoints, blocks network IOCs, removes persistence') to push specificity toward 5.

Add natural trigger synonyms such as 'virus', 'infection', or 'endpoint compromise' so the skill surfaces for a wider range of user phrasings.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('triage, containment, eradication, and recovery') that name the domain and specific IR phases, but the actions stay at the phase-level rather than naming granular executable operations.	4 / 5
Completeness	Clearly states what it does ('Respond to a malware incident following PICERL methodology...Orchestrates triage, containment, eradication, and recovery') and provides a 'Use when malware is detected on endpoints' trigger; the trigger is concrete but could be more explicit about the SOAR/alert context.	4 / 5
Trigger Term Quality	Natural trigger terms ('malware is detected on endpoints', 'malware incident') match what a user would say, though common synonyms like 'virus', 'infection', or 'endpoint compromise' are not covered.	4 / 5
Distinctiveness Conflict Risk	Scoped to malware incident response with explicit integration with the triage-malware skill, giving it a clear niche with only minor overlap risk against adjacent IR skills.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/respond-malware/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.