triage-alert

Triage a security alert or case. Use when given an ALERT_ID or CASE_ID to assess if it's a real threat. Enriches IOCs, searches SIEM for context, and determines if the alert should be closed (false positive) or escalated for investigation.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/triage-alert/SKILL.md

Quality

Content

64%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, mostly lean triage procedure with concrete tool guidance, but it has two real defects: no validation checkpoint before the destructive case-closure action, and a dangling reference to a non-existent reference.md. These pull workflow clarity and progressive disclosure down to 3.

Suggestions

Add an explicit verification checkpoint before closing a case (e.g., confirm the FP/BTP classification is corroborated by enrichment + SIEM evidence, and re-confirm status) so the destructive close is gated by validation.

Either create the referenced reference.md (with the promised workflow diagrams, completion criteria, and evaluation rubric) or remove the broken '[reference.md](./reference.md)' link so navigation is not broken.

Tighten Step 3 by specifying the actual SIEM query pattern per alert type instead of 'search_security_events with relevant query', removing the last actionability gap.

Dimension	Reasoning	Score
Conciseness	The body is efficient and assumes domain competence (no explaining what a SIEM or IOC is), with the only redundancy being the Quick Reference section re-listing tools already named in the steps.	4 / 5
Actionability	Names specific tools with parameters (get_case_full_details, get_ip_address_report, siemplify_close_case) giving actionable guidance for an agent; minor gaps remain such as Step 3's 'search_security_events with relevant query' leaving the query unspecified.	4 / 5
Workflow Clarity	Steps 1–6 are clearly sequenced with a classification table, but the workflow performs a destructive action (closing a case) with no explicit validation/verification checkpoint before the irreversible close, which caps this dimension at 3 per the destructive-operation rule.	3 / 5
Progressive Disclosure	Internal structure is well organized into Inputs, Workflow, Output Requirements, and Quick Reference, but the sole external reference — 'see [reference.md](./reference.md)' — points to a file that does not exist in any bundle directory, breaking the navigation it promises.	3 / 5
	Total	14 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities, gives an explicit 'Use when' trigger tied to ALERT_ID/CASE_ID, and carves out a distinct triage niche. It sits just below top marks because the trigger is ID-conditioned rather than phrased in natural user terms and it borders on overlapping sibling triage skills.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'Enriches IOCs, searches SIEM for context, and determines if the alert should be closed (false positive) or escalated' — covering enrichment, SIEM search, and the close/escalate decision, with only minor gaps in coverage.	4 / 5
Completeness	Explicitly answers both what ('Triage a security alert or case') and when ('Use when given an ALERT_ID or CASE_ID'), but the trigger is narrow and ID-based rather than enumerating natural user scenarios, keeping it just below a 5.	4 / 5
Trigger Term Quality	Includes natural terms a user would say ('security alert or case', 'ALERT_ID or CASE_ID', 'real threat', 'false positive', 'escalated'); coverage is good but omits common synonyms like 'incident'.	4 / 5
Distinctiveness Conflict Risk	Clear niche (alert/case triage with specific identifiers) with distinct triggers, but sibling skills referenced in the body (full-triage-alert, suspicious_login_triage, malware_triage) create minor overlap risk.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/triage-alert/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.