Tessl • The management layer for AI agent skills

SkillPublic

secops-investigate

Expert guidance for deep security investigations. Use this when the user asks to "investigate" a case, entity, or incident.

1.46x

Quality

78%

Does it follow best practices?

Impact

97%

1.46x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./extensions/google-secops/skills/investigate/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a strong, highly actionable SOC investigation playbook with concrete UDM queries, environment-aware tool selection, and reusable common procedures. Its main weaknesses are the lack of explicit validate/retry feedback loops on batch SIEM operations and the absence of an actual referenced bundle file for the query catalog.

Suggestions

Add explicit validation checkpoints to the Malware and Lateral Movement workflows (e.g., verify affected-host list is non-empty before enrichment; confirm redaction passed before generating the report file) to enable workflow_clarity 5.

Create the referenced extensions/google-secops/TOOL_MAPPING.md bundle file (or move the query catalog into a separate reference) so progressive disclosure references resolve to real files.

Trim the repeated Remote/Local tool-name annotations where a single mapping table would suffice, to push conciseness toward 5.

Dimension	Reasoning	Score
Conciseness	The body is largely lean — concrete query strings, tool names, and a compact severity matrix — and avoids explaining concepts Claude already knows, fitting 'efficient; minor instances of over-explanation'; it is not a 5 because the CRITICAL availability banner and some repeated Remote/Local splits could be trimmed further.	4 / 5
Actionability	It provides fully executable guidance: concrete UDM query strings (e.g. 'metadata.product_event_type = "ServiceInstalled" AND target.process.file.full_path CONTAINS "PSEXESVC.exe"'), exact tool names per environment, filename templates, and a severity matrix, matching 'fully executable; copy-paste ready; specific examples cover the common cases'.	5 / 5
Workflow Clarity	Each procedure has a clearly numbered sequence with inputs, Remote/Local branches, and a final 'Document in SOAR' step, matching 'clear sequence with most checkpoints present'; it is capped below 5 because the Malware and Lateral Movement workflows involve batch/destructive-adjacent SIEM actions and redaction without explicit validate-then-fix feedback loops.	4 / 5
Progressive Disclosure	The SKILL.md is a well-organized overview with distinct sections (Tool Selection, Procedures, Common Procedures) and one-level-deep references such as extensions/google-secops/TOOL_MAPPING.md, fitting 'good structure; references mostly clear'; it is not a 5 because no bundle files are actually present, so the single referenced path is unverified and there is no separate reference file for the bulk query catalog.	4 / 5
	Total	17 / 20 Passed

Description

65%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description cleanly pairs a 'what' with an explicit 'when' trigger clause and uses natural user language, but it is light on concrete capability specifics. Adding one or two enumerated actions (e.g., query SIEM, enrich IOCs, triage malware) would lift specificity and completeness.

Suggestions

Enumerate 1-2 concrete capabilities in the 'what' clause, e.g. 'query SIEM events, enrich IOCs, and triage malware' to raise specificity.

Tighten the 'when' clause to the security context to reduce overlap, e.g. 'Use when the user asks to investigate a security case, entity, or incident.'

Consider adding a synonym such as 'incident response' or 'SOC triage' to broaden natural trigger coverage.

Dimension	Reasoning	Score
Specificity	It names the security-investigation domain but the only action stated is the generic 'investigate'; no concrete actions (query SIEM, enrich IOCs, triage malware) are enumerated, matching the 'names the domain but actions are minimal or generic' anchor rather than the 3-anchor which requires 1-2 concrete actions.	2 / 5
Completeness	Both 'what' ('Expert guidance for deep security investigations') and 'when' ('Use this when the user asks to "investigate" a case, entity, or incident') are present with concrete trigger phrases, fitting the 4-anchor; it stops short of 5 because the 'what' is relatively high-level without enumerating the investigation capabilities.	4 / 5
Trigger Term Quality	The natural verb 'investigate' plus the concrete object variations 'case, entity, or incident' give good keyword coverage that a user would actually say, landing at the 'good keyword coverage; a few natural terms missing' anchor rather than 3 (which would miss common variations) or 5 (which would need synonyms/extensions).	4 / 5
Distinctiveness Conflict Risk	The trigger 'investigate a case, entity, or incident' carves a recognizable security-operations niche with minimal overlap, matching 'mostly distinct; minor overlap risk'; it is not a 5 because the bare verb 'investigate' could still plausibly fire for non-security investigative requests.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: google/mcp-security
Path: extensions/google-secops/skills/investigate/SKILL.md
Revision: 9cc13ca

Reviewed: 29 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

secops-investigate

Table of Contents

Is this your skill?