analyzing-campaign-attribution-evidence

Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-campaign-attribution-evidence/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with complete, executable Python for every workflow step, but it loses points for re-explaining frameworks Claude already knows and for failing to surface the substantial bundle files that duplicate and extend its inline material. Validation exists but is siloed outside the workflow rather than woven in as checkpoints.

Suggestions

Trim the Overview and Key Concepts sections to remove re-explanation of the Diamond Model and ACH that Claude already knows; keep only the skill-specific weighting scheme.

Link the existing bundle files from the body — e.g. 'See references/api-reference.md for the ACH matrix format and STIX attribution objects' and 'Report template: assets/template.md' — so progressive disclosure is one level deep and clearly signaled.

Insert an inline validation checkpoint in the workflow (e.g. 'Before ranking hypotheses, confirm evidence covers ≥3 of the 6 categories') so validation gates the flow rather than appearing only at the end.

Dimension	Reasoning	Score
Conciseness	The body is dominated by executable code, but the Overview paragraph and the 'Key Concepts' section re-explain the Diamond Model and ACH — frameworks Claude already knows — so it is 'mostly efficient but includes some unnecessary explanation'; not score 3 because of this redundant conceptual padding.	2 / 3
Actionability	Provides fully executable, copy-paste-ready Python — the AttributionAnalyzer class, analyze_infrastructure_overlap, compare_campaign_ttps, and generate_attribution_report — with specific method signatures and return shapes, matching the 'fully executable code' anchor.	3 / 3
Workflow Clarity	Four numbered steps are clearly sequenced, but validation lives in a separate 'Validation Criteria' section rather than as inline checkpoints within the workflow (no 'validate evidence before ranking' gate), fitting the 'steps listed but validation gaps' anchor; not score 3 because checkpoints are absent from the flow itself.	2 / 3
Progressive Disclosure	Sections are well-organized, but real bundle files exist (references/api-reference.md, references/workflows.md, references/standards.md, assets/template.md, scripts/agent.py, scripts/process.py) and none are referenced or linked from the body, while inline material (ACH matrix, STIX objects, report format) duplicates what those files hold — the 'content that should be separate is inline' and 'references present but not clearly signaled' anchor; not score 1 because the body itself is cleanly sectioned.	2 / 3
	Total	9 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and clearly distinguishable, with an explicit Use-when trigger and concrete enumeration of the evidence categories it weighs. Its only weakness is trigger-term breadth, which leans on technical CTI phrasing rather than the plain-language terms a user might naturally say.

Suggestions

Broaden the trigger clause with plain-language phrasings users actually say, e.g. 'Use when the user asks who is behind an attack, requests APT/threat-actor attribution, or needs a defensible attribution confidence level.'

Consider adding a short alias list ('campaign attribution', 'threat actor attribution', 'APT attribution') so the description surfaces more natural search terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'evaluate cyber-campaign evidence', 'weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts', and produce 'confidence-weighted attribution assessments' — matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly answers what the skill does and includes an explicit 'Use when an incident investigation needs a defensible attribution confidence level' trigger, satisfying the 'clearly answers both what AND when' anchor; not score 2 because the when-clause is explicit rather than implied.	3 / 3
Trigger Term Quality	Contains relevant natural terms ('incident investigation', 'attribution confidence level', 'threat actor') but the phrasing leans technical and omits common variations a user might say ('who is behind this attack', 'APT attribution', 'threat actor identification'), fitting the 'some relevant keywords but missing common variations' anchor.	2 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (campaign attribution / threat intelligence) with distinct triggers ('Diamond Model', 'ACH', 'attribution confidence'), making overlap with other skills unlikely.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-campaign-attribution-evidence/SKILL.md
Commit: e612f49

Reviewed: about 1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.