analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-campaign-attribution-evidence/SKILL.md

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable and reasonably well-sequenced with executable code, but it underutilizes the provided bundle — detailed API reference, standards, workflows, scripts, and the report template are never referenced from the body, and inline content duplicates bundle material. Conciseness is good though the Overview/Key Concepts add some redundancy.

Suggestions

Replace the inlined Key Concepts and duplicated ACH/confidence material with signaled links to references/api-reference.md and references/standards.md (e.g. '## API reference — See [api-reference.md](references/api-reference.md)') to expose the bundle.

Point the workflow at the ready-made scripts (scripts/agent.py, scripts/process.py) and the report template (assets/template.md) instead of re-implementing parallel inline code, so the body becomes an overview rather than a second implementation.

Add explicit inline validation/feedback checkpoints to the workflow steps (e.g. 'Verify evidence covers all six categories before ranking; if a hypothesis is inconsistent, re-evaluate the evidence') to reach the workflow_clarity 5 anchor.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with executable code dominating, but the Overview paragraph and Key Concepts section restate the description and explain ACH/Diamond Model concepts Claude already knows; above the 3 anchor (efficient) with only minor trimmable padding, below the lean 5 anchor.	4 / 5
Actionability	Provides concrete, mostly copy-paste-ready Python across four workflow steps (AttributionAnalyzer, infrastructure overlap, TTP comparison, report generation); minor gaps — the inline analyzer is not fully wired end-to-end and example inputs are not shown — keep it below the fully-executable 5 anchor.	4 / 5
Workflow Clarity	Clear four-step sequence with a separate Validation Criteria list, but no inline validation/feedback checkpoints within the steps ('validate, fix, retry'); above the 3 anchor because the sequence and criteria are explicit, below the 5 anchor which requires explicit inline validation loops.	4 / 5
Progressive Disclosure	Bundle files exist (references/api-reference.md, standards.md, workflows.md; scripts/agent.py, process.py; assets/template.md) but the body never links to or signals them, instead inlining duplicated ACH/confidence/API material that clearly belongs in the bundle; references are effectively buried/absent — below the 3 anchor (which requires at least some signaled references), slightly above the fully-monolithic 1 anchor because section headers provide minimal structure.	2 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both the capability and the use-trigger, with concrete attribution actions and a well-scoped niche. Trigger-term coverage is good but could add a few more natural synonyms an analyst might say.

Dimension	Reasoning	Score
Specificity	Names the domain and lists multiple concrete actions — 'weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments' — with comprehensive coverage; not the 4 anchor because no coverage gap exists.	5 / 5
Completeness	Explicitly answers both what ('Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor...') and when ('Use when an incident investigation needs a defensible attribution confidence level') with a concrete trigger phrase.	5 / 5
Trigger Term Quality	Good keyword coverage with natural terms ('threat actor', 'cyber-campaign', 'attribution', 'TTP', 'infrastructure overlaps') but a few natural user phrasings and synonyms are missing (e.g. 'APT', 'IOC', 'threat intel', 'who is behind this attack'); above the 3 anchor yet short of the comprehensive 5 anchor.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (campaign attribution / threat-intelligence) with distinct, domain-specific triggers and minimal overlap risk with unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-campaign-attribution-evidence/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.