analyzing-apt-group-with-mitre-navigator

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-apt-group-with-mitre-navigator/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable code across a clear 5-step workflow, but it over-explains familiar ATT&CK concepts, lacks inline validation checkpoints for file-writing steps, and fails to signpost its own bundle files.

Suggestions

Add inline validation checkpoints in the workflow (e.g., verify technique_map is populated and that apt29_layer.json parses as JSON before proceeding to gap analysis) to convert batch file-writing steps into a validate->fix->retry loop.

Trim the Overview and Key Concepts sections to remove background Claude already knows (what Navigator layers are, the 140-group count) and keep only non-obvious operational detail.

Signpost the existing bundle files from the body — e.g., "See references/api-reference.md for the full layer format and STIX/TAXII access" and "scripts/agent.py runs the full pipeline" — instead of inlining that material.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with code-driven steps, but the Overview and Key Concepts sections explain ATT&CK Navigator layers, APT profiles, and group counts that Claude largely already knows, adding unnecessary explanation.	3 / 5
Actionability	Five steps provide full, copy-paste-ready executable Python (attackcti client, Navigator layer JSON builder, gap-layer generation, tactic breakdown) covering the common cases with concrete code.	5 / 5
Workflow Clarity	A clear 5-step sequence exists, but file-writing/batch operations lack inline validation checkpoints; the Validation Criteria section is descriptive rather than embedded feedback loops, so the batch-operation cap applies.	3 / 5
Progressive Disclosure	Sections are well-organized and bundle files exist (references/api-reference.md, scripts/agent.py), but the body inlines the Navigator JSON format and API details instead of signposting to api-reference.md, and the References section lists external URLs rather than the bundle files.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, specific, and explicitly pairs a clear what with explicit when-guidance and trigger phrases. Its only weakness is mild technical-leaning trigger terms that could add casual synonyms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "Query ATT&CK data", "build MITRE ATT&CK Navigator layers", "multi-layer heatmap overlays", "detection-gap analysis" — with named libraries, matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both what (query + build layers + heatmap overlays for detection-gap analysis) and when ("Use to compare... find gaps... produce Navigator visualizations") with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural terms ("APT groups", "threat-actor technique coverage", "detection engineering", "threat-intel reporting") but leans technical and omits some casual synonyms; a few natural terms missing.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche — ATT&CK Navigator layer generation for APT TTP detection-gap analysis — with distinct triggers and minimal overlap with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-apt-group-with-mitre-navigator/SKILL.md
Commit: 54a7988

Reviewed: ~3 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.