triage-malware
Triage a suspected malicious file hash. Use when investigating malware alerts or suspicious files. Analyzes GTI file report, behavioral indicators, identifies affected hosts, enriches network IOCs, and recommends containment actions.
95
Does it follow best practices?
Validation for skill structure
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a well-crafted skill description that excels across all dimensions. It uses third person voice, provides specific concrete actions, includes natural security analyst terminology, and clearly delineates both what the skill does and when to use it. The domain-specific terms (GTI, IOCs, containment) make it highly distinctive.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'Analyzes GTI file report, behavioral indicators, identifies affected hosts, enriches network IOCs, and recommends containment actions' - these are clear, actionable capabilities. | 3 / 3 |
Completeness | Clearly answers both what ('Triage a suspected malicious file hash', 'Analyzes GTI file report...') AND when ('Use when investigating malware alerts or suspicious files') with explicit trigger guidance. | 3 / 3 |
Trigger Term Quality | Includes natural keywords users would say: 'malicious file hash', 'malware alerts', 'suspicious files', 'IOCs', 'containment'. These are terms security analysts naturally use when investigating threats. | 3 / 3 |
Distinctiveness Conflict Risk | Clear niche in malware/security investigation with distinct triggers like 'file hash', 'GTI', 'malware alerts', 'IOCs'. Unlikely to conflict with general file processing or other security skills due to specific focus on hash-based file triage. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
92%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a high-quality skill that provides clear, actionable guidance for malware triage with excellent workflow structure and concrete tool commands. The severity assessment matrix and required outputs table add significant value. Minor improvement could be made by better signaling the referenced skills and potentially splitting the severity/action guidance into a separate reference file.
Suggestions
Add explicit links or paths to the referenced skills (/enrich-ioc, /find-relevant-case, /document-in-case) so Claude can navigate to them if needed
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is lean and efficient, providing only necessary information without explaining concepts Claude already knows. No verbose explanations of what malware is or how hashes work - it jumps straight to actionable workflow. | 3 / 3 |
Actionability | Provides concrete, executable commands for each step with specific tool calls and parameters. The search queries, function calls, and output templates are copy-paste ready with clear placeholders. | 3 / 3 |
Workflow Clarity | Clear 8-step sequence with explicit validation through the severity assessment matrix. Each step has defined inputs/outputs, and the workflow includes feedback loops via IOC enrichment and cross-referencing related cases before final documentation. | 3 / 3 |
Progressive Disclosure | Content is well-organized with clear sections, but the skill is somewhat monolithic. The severity matrix and recommended actions could potentially be referenced from separate files, and the skill references other skills (/enrich-ioc, /find-relevant-case, /document-in-case) without clear navigation to them. | 2 / 3 |
Total | 11 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.