analyzing-indicators-of-compromise
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
90
88%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Risky
Do not use without reviewing
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly defines its scope, lists concrete actions and artifact types, provides explicit trigger scenarios, and names specific tools. It uses proper third-person voice throughout and covers both the 'what' and 'when' comprehensively. The description is well-structured and would allow Claude to confidently select this skill from a large pool without ambiguity.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: analyzing IOCs (IP addresses, domains, file hashes, URLs, email artifacts), determining maliciousness confidence, campaign attribution, blocking priority, and enriching with multi-source intelligence. | 3 / 3 |
Completeness | Clearly answers both 'what' (analyzes IOCs to determine maliciousness, attribution, and blocking priority) and 'when' (triaging IOCs from phishing/alerts/feeds, enriching raw IOCs, making block decisions) with explicit trigger scenarios and tool names. | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms users would say: 'IOCs', 'IP addresses', 'domains', 'file hashes', 'URLs', 'phishing emails', 'security alerts', 'threat feeds', 'VirusTotal', 'AbuseIPDB', 'MalwareBazaar', 'MISP', 'IOC enrichment', 'block/monitor/whitelist'. These are terms security analysts naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focused on IOC analysis and threat intelligence enrichment. The specific mention of tools (VirusTotal, AbuseIPDB, MalwareBazaar, MISP) and use cases (IOC triage, block/monitor decisions) make it very unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a solid, actionable skill with executable code examples and a well-structured multi-step workflow with clear decision thresholds. Its main weaknesses are the inclusion of glossary definitions and tool descriptions that Claude already knows, and the lack of progressive disclosure through external reference files. The workflow itself is strong with appropriate safety caveats for shared infrastructure and single-source reliance.
Suggestions
Remove or drastically reduce the Key Concepts table and Tools & Systems section — Claude already knows what VirusTotal, IOCs, and sinkholes are. Keep only non-obvious operational details (e.g., TTL recommendations).
Move detailed API code examples to a separate ENRICHMENT_EXAMPLES.md file and reference it from the main skill, keeping only one representative example inline.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill includes some unnecessary explanations that Claude would already know (e.g., the Key Concepts table defining IOC, enrichment, defanging, and sinkhole; the Tools & Systems section describing what VirusTotal and AbuseIPDB are). The workflow steps themselves are reasonably efficient, but the glossary and tool descriptions add ~40 lines of content Claude doesn't need. | 2 / 3 |
Actionability | The skill provides fully executable Python code for VirusTotal, AbuseIPDB, MalwareBazaar, and MISP lookups. The confidence scoring thresholds are specific and concrete (≥15 AV detections, AbuseIPDB ≥70), and the defanging conventions are explicit. This is copy-paste ready guidance. | 3 / 3 |
Workflow Clarity | The 5-step workflow is clearly sequenced from normalization through enrichment, contextualization, scoring, and documentation. The tiered decision framework in Step 4 serves as a validation checkpoint, and the 'Do not use in isolation' caveat plus the false positive handling provide appropriate guardrails for a process involving blocking decisions. | 3 / 3 |
Progressive Disclosure | The content is a monolithic single file with no references to external documents for advanced topics. The Key Concepts table and Tools & Systems section could be split into reference files. The inline content is well-structured with headers, but at ~120 lines with glossary and tool descriptions, some content should be externalized. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.