Name: cortex-xsoar
Rating: 52.8 (1 reviews)
Author: membranedev

cortex-xsoar

Cortex XSOAR integration. Manage data, records, and automate workflows. Use when the user wants to interact with Cortex XSOAR data.

Quality

59%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/cortex-xsoar/SKILL.md

Quality

Content

56%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The operational sections are concrete and sequenced with useful connection-state checkpoints, but the document is bloated by a large padded entity list and uses no progressive disclosure to separate files. Trimming the overview and tightening the workflow labels would materially improve it.

Suggestions

Delete the auto-generated 'Content *' portion of the Overview list and keep only entities the integration actually exposes as actions; remove 'Use action names and parameters as needed.' in favor of a real example.

Fix the workflow numbering (define Step 1a/Step 2 or relabel '1b') and add a brief validation step after running an action (e.g. check the `output`/`error` field before proceeding).

Move the full entity/action catalogue into a references file (e.g. references/actions.md) and link to it from a concise overview, enabling one-level-deep progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Roughly half the body is a ~150-entry 'Cortex XSOAR Overview' bullet list, including an auto-generated 'Content *' run ('Content Ethics', 'Content Human Rights', 'Content Justice') that is padded, non-actionable, and not accurate to the platform. It is below anchor 3 because the padding is extensive, though the command sections are efficient so it is not a full anchor 1.	2 / 5
Actionability	The body provides concrete, executable commands (npm install, membrane login, connection ensure, action list/run, request with a flags table). It is not anchor 5 because examples use placeholders (CONNECTION_ID, <actionId>) and 'Popular actions' only says to discover actions rather than showing real ones; not anchor 3 because the given commands are genuinely executable.	4 / 5
Workflow Clarity	There is a clear Install → Authenticate → Connect → poll-for-state → search → run sequence, with explicit state-based checkpoints (READY/BUILDING/CLIENT_ACTION_REQUIRED/CONFIGURATION_ERROR) and a re-poll feedback loop. It is not anchor 5 because of labeling gaps ('skip to Step 2' with no Step 2, '1b' with no 1a) and no validation of action results; not anchor 3 because the connection state handling supplies real checkpoints.	4 / 5
Progressive Disclosure	The body uses section headers and is organized, but it is monolithic with no external reference files (references/scripts/assets absent) and a huge inline entity list that should be trimmed or split out. It is not anchor 4 because no one-level-deep references are signalled and bulk content is inlined; not anchor 2 because real section structure does exist.	3 / 5
	Total	13 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description answers both what and when and is tied to a distinctive named product, but its action list is generic and its trigger keyword coverage is thin. It is solid but lacks the concrete, synonym-rich phrasing of the top anchors.

Suggestions

Replace generic verbs ('Manage data, records, and automate workflows') with concrete Cortex XSOAR capabilities such as 'investigate incidents, run playbooks, manage indicators and lists'.

Expand the trigger clause with natural variations users would say, e.g. 'Use when the user wants to work with XSOAR incidents, playbooks, indicators, or threat-intel data.'

Dimension	Reasoning	Score
Specificity	Names the domain ('Cortex XSOAR integration') and a few actions ('Manage data, records, and automate workflows'), but the actions are generic and abstract rather than concrete capabilities. It sits above anchor 2 because multiple verbs are listed, but below anchor 4 because none are specific concrete actions like 'extract text' or 'fill forms'.	3 / 5
Completeness	Both 'what' ('Manage data, records, and automate workflows') and 'when' ('Use when the user wants to interact with Cortex XSOAR data') are present. It is not anchor 5 because the 'when' clause is generic and lacks concrete trigger phrases; not anchor 3 because 'when' is explicitly stated rather than merely implied.	4 / 5
Trigger Term Quality	The natural keyword 'Cortex XSOAR' appears and is reused in the trigger clause, but there is no synonym or variation coverage (e.g. SOAR, incident response, playbooks). It matches anchor 3's 'some relevant keywords but missing common variations' rather than anchor 4's broader keyword set.	3 / 5
Distinctiveness Conflict Risk	'Cortex XSOAR integration' targets a clearly named product niche with low conflict risk. It is not anchor 5 because the trigger ('interact with Cortex XSOAR data') is narrow and does not enumerate the platform's distinctive use cases, leaving minor overlap with broader security-tooling skills.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: membranedev/application-skills
Path: skills/cortex-xsoar/SKILL.md
Commit: f484c82

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.