triage-suspicious-login

Triage suspicious login alerts like impossible travel, untrusted location, or multiple failures. Use when investigating authentication anomalies. Analyzes user history, source IP reputation, login patterns, and determines if escalation is needed.

1.01x

Quality

71%

Does it follow best practices?

Impact

89%

1.01x

Average score across 2 eval scenarios

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/triage-suspicious-login/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, lean triage workflow with concrete SecOps tool calls and a useful decision matrix. Its main weakness is the absence of validation/verification checkpoints in the workflow, which caps workflow clarity.

Suggestions

Add explicit validation checkpoints: e.g., after Step 6, instruct handling empty search results; before Step 9 synthesis, require confirming key entities (USER_ID, SOURCE_IP) were successfully enriched.

Resolve the ALERT_ID placeholder used in Step 2 against the declared Inputs (which list ALERT_GROUP_IDENTIFIERS) so the guidance is internally consistent and copy-paste ready.

Consider externalizing the 'Decision Matrix' and 'Key Patterns to Detect' sections into a bundled reference file to improve progressive disclosure, since the body exceeds the ~50-line simple-skill threshold.

Dimension	Reasoning	Score
Conciseness	Lean body with terse tool-call snippets and no tutorials explaining concepts Claude already knows; not a 5 because the intro line restates the description and 'Key Patterns to Detect' re-explains patterns already implied by the workflow.	4 / 5
Actionability	Concrete named tool calls (secops-soar, secops-mcp) and delegate sub-skills give mostly executable guidance; not a 5 because some placeholders mismatch the Inputs (ALERT_ID vs ALERT_GROUP_IDENTIFIERS) and delegate sub-skills are referenced by name only.	4 / 5
Workflow Clarity	A clear 9-step sequence with a decision matrix and required-outputs table, but no validation checkpoints or feedback loops (e.g., handle empty search results, verify before escalating), which fits the 'steps listed but validation gaps' anchor.	3 / 5
Progressive Disclosure	Well-organized into clearly signaled sections (Inputs, Workflow, Required Outputs, Decision Matrix, Key Patterns); not a 5 because the body exceeds 50 lines and inlines reference-style content (Decision Matrix, Key Patterns) that could be split into a bundled file.	4 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both what the skill does and when to use it, with natural trigger terms. It falls just short of top marks due to slightly abstract 'when' phrasing and minor gaps in trigger-term synonyms.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions (analyze user history, source IP reputation, login patterns, determine escalation), matching the 'several specific actions; minor gaps' anchor; not a 5 because 'triage' is umbrella-like and coverage is not exhaustive.	4 / 5
Completeness	Both 'what' (triage actions) and 'when' ('Use when investigating authentication anomalies') are present; not a 5 because the 'when' clause is somewhat abstract rather than enumerating concrete trigger phrases.	4 / 5
Trigger Term Quality	Natural analyst trigger terms like 'suspicious login alerts', 'impossible travel', 'untrusted location', and 'multiple failures' give good coverage; not a 5 because some common synonyms (brute force, account takeover, MFA fatigue) are absent.	4 / 5
Distinctiveness Conflict Risk	Clear login-triage niche with specific triggers and low overlap risk; not a 5 because the phrase 'authentication anomalies' is broad enough to lightly overlap a general auth-investigation skill.	4 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/triage-suspicious-login/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.