analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-malicious-url-with-urlscan/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is reasonably concise and actionable with concrete API examples and a real automation script, but the workflow lacks explicit validation checkpoints and fails to link the bundled reference and asset files, weakening navigation. Tightening workflow feedback loops and wiring up the references would raise the score.

Suggestions

Add an explicit validation/checkpoint within the workflow (e.g., poll /result/{uuid}/ until 200 before analyzing, and verify IOCs were extracted before cross-referencing).

Link the existing bundle files from the body — reference references/api-reference.md, references/workflows.md, references/standards.md, and assets/template.md in the relevant sections so detailed material is clearly signaled one level deep.

De-duplicate the Overview against the frontmatter description or trim it to avoid restating capabilities Claude already has.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean with concise capability and red-flag lists that add domain-specific value; only minor redundancy (the Overview restates the description) keeps it just below anchor 5.	4 / 5
Actionability	Step 1 gives a concrete API endpoint, header, and JSON body, and Step 4 points to the real executable scripts/process.py; the middle steps are higher-level review bullets, leaving minor gaps versus fully copy-paste-ready inline code.	4 / 5
Workflow Clarity	Four steps are clearly sequenced, but there are no explicit validation checkpoints within the workflow (e.g., confirm scan completion before analyzing) and batch operations are referenced without in-flow validation, matching the anchor 3 'sequence present but checkpoints implicit' case.	3 / 5
Progressive Disclosure	The body is well-sectioned and references scripts/process.py, but it never links to the existing references/ (api-reference.md, standards.md, workflows.md) or assets/template.md files, so detailed materials that should be surfaced are not clearly signaled — anchor 3 rather than 4.	3 / 5
	Total	14 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description concretely names URLScan.io and several specific capabilities, but is truncated mid-word and lacks any 'Use when...' trigger guidance, capping completeness and trigger quality. It is distinct enough due to the named service but would benefit from explicit use-when phrasing.

Suggestions

Complete the truncated sentence ('isolated environment') and verify the description is not cut off in the frontmatter.

Add an explicit 'Use when...' clause naming natural trigger phrases (e.g., phishing URLs, suspicious links, credential-harvesting pages) to lift completeness and trigger-term quality.

Include common synonyms and file/term variations users say ('malicious URL', 'phishing link', 'URL analysis') to improve trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists several concrete capabilities ('captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections') rather than vague language, but the description is truncated mid-word ('in an isolat'), leaving coverage incomplete — anchor 4 fits better than 5.	4 / 5
Completeness	It clearly states what the skill does (scanning/analyzing URLs and what URLScan captures) but has no 'Use when...' clause or equivalent trigger guidance, which per the judging guidelines caps completeness at 3.	3 / 5
Trigger Term Quality	Includes the natural phrase 'scanning and analyzing suspicious URLs' but misses common variations users would say ('phishing URLs', 'malicious links', 'URL analysis'), matching the anchor 3 example of relevant-but-incomplete keywords.	3 / 5
Distinctiveness Conflict Risk	Naming the specific service URLScan.io and its capture capabilities gives it a clear niche with only minor overlap risk against general URL-analysis skills; not a 5 because no explicit distinct trigger phrases are provided.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-malicious-url-with-urlscan/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.