analyzing-apt-group-with-mitre-navigator

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable skill with five complete, executable code examples and a clear step sequence, weakened by explanatory prose Claude does not need, a detached validation section, and bundle files (api-reference.md, agent.py) that are never linked from the body.

Suggestions

Trim the Overview and Key Concepts sections to domain-specific detail only (layer v4.5 fields, G-code conventions) and drop generic explanations of what ATT&CK/Navigator are; rewrite the templated 'When to Use' bullets into concrete triggers.

Reference the existing bundle files from the body — e.g. 'Full layer-format and TAXII/STIX details: see [references/api-reference.md]' and 'Reusable agent: see [scripts/agent.py]' — so the inline steps can point to rather than duplicate them.

Move validation inline as checkpoints (e.g. after generating a layer, load it back / validate JSON against the v4.5 schema and only proceed when valid) to turn the criteria list into a feedback loop.

Dimension	Reasoning	Score
Conciseness	The five code blocks earn their place, but the Overview and Key Concepts sections re-explain ATT&CK/Navigator concepts Claude already knows, and the 'When to Use' bullets read as generic templated phrasing ('analyzing apt group with mitre navigator'). It is mostly efficient but could be tightened.	2 / 3
Actionability	Each of the five steps provides complete, executable Python (attackcti queries, layer JSON generation, set-based group comparison, gap-layer construction, tactic breakdown) that is copy-paste ready with real ATT&CK IDs and field names.	3 / 3
Workflow Clarity	Steps are clearly sequenced (Step 1–5), but validation lives in a separate post-hoc 'Validation Criteria' list rather than inline checkpoints, and there are no 'validate → fix → retry' feedback loops within the flow.	2 / 3
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never referenced or signaled in the body, and the inline Step 1–5 code largely duplicates what the script already provides — content that should be split out stays inline.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete tools and actions, includes explicit 'Use to...' trigger guidance, and occupies a clearly distinct threat-intelligence niche. No vague fluff or over-claims.

Dimension	Reasoning	Score
Specificity	Names the concrete tools (attackcti, mitreattack-python, stix2) and lists multiple specific actions — querying data, building Navigator layers, multi-layer heatmap overlays, mapping TTPs, and detection-gap analysis — matching the 'multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly answers 'what' (query/build/map/analyze) and 'when' via a clear 'Use to compare... find gaps... or produce Navigator visualizations' trigger clause.	3 / 3
Trigger Term Quality	Covers natural domain terms a threat-intel analyst would actually say: 'APT groups', 'TTPs', 'MITRE ATT&CK Navigator', 'detection-gap', 'threat-actor', 'threat-intel reporting'.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (ATT&CK Navigator layers + APT TTP detection-gap analysis) with distinct triggers unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-apt-group-with-mitre-navigator/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.