analyzing-indicators-of-compromise

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-indicators-of-compromise/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable threat-intel workflow with solid code examples and a clear tiered disposition framework. Weaknesses are conceptual padding, absent validation checkpoints for destructive/batch blocking, and bundle files that exist but are not referenced from the body.

Suggestions

Replace the 'Key Concepts' and 'Tools & Systems' explanatory prose with terse one-liners or move them to references/api-reference.md, keeping only what Claude does not already know.

Add an explicit validation checkpoint before blocking (e.g., 'Confirm disposition with an analyst and verify defanging before applying to firewall/proxy/DNS controls') to satisfy the batch/destructive validation requirement.

Link the existing bundle files from the body — e.g., 'See references/api-reference.md for full endpoint details' and 'See scripts/agent.py for a runnable enrichment agent' — and remove the duplicated inline API detail.

Dimension	Reasoning	Score
Conciseness	The core workflow and code blocks are lean, but the 'Key Concepts' table (defining IOC, Enrichment, Defanging, Sinkhole, False Positive Rate) and the 'Tools & Systems' prose re-explain cybersecurity concepts Claude already knows, so it could be tightened.	3 / 5
Actionability	Provides concrete, mostly copy-paste-ready code for VirusTotal, AbuseIPDB, MalwareBazaar, and MISP, plus a numeric confidence-scoring framework; minor gaps are Shodan and URLScan.io being described in prose without code examples.	4 / 5
Workflow Clarity	A clear five-step sequence exists (Normalize → Enrich → Attribute → Score → Document), but because the skill performs batch IOC processing and outward-facing block decisions, the missing explicit validate-before-block checkpoint caps the score per the batch/destructive rule.	3 / 5
Progressive Disclosure	The body is organized into clear sections, but the existing bundle files (references/api-reference.md, scripts/agent.py) are never linked or signposted from the body, and API-reference material is duplicated inline rather than delegated to the reference file.	3 / 5
	Total	13 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete capabilities, provides explicit 'Use when' trigger guidance, and lists natural tool-name keywords. It cleanly answers both what the skill does and when to invoke it.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Analyzes indicators of compromise', 'determine maliciousness confidence, campaign attribution, and blocking priority', 'triaging IOCs', 'enriching raw IOCs', 'making block/monitor/whitelist decisions' — with comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly answers both what ('Analyzes IOCs ... to determine maliciousness confidence, campaign attribution, and blocking priority') and when ('Use when triaging IOCs from phishing emails, security alerts, or external threat feeds ... Activates for requests involving ...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural keyword coverage a threat-intel analyst would actually say — 'IOCs', 'phishing emails', 'security alerts', 'threat feeds', plus tool names 'VirusTotal', 'AbuseIPDB', 'MalwareBazaar', 'MISP'.	5 / 5
Distinctiveness Conflict Risk	Clear threat-intelligence niche anchored to specific named tools (VirusTotal, AbuseIPDB, MalwareBazaar, MISP), giving distinct triggers and minimal overlap with adjacent skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-indicators-of-compromise/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.