analyzing-ransomware-leak-site-intelligence

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with five complete executable code blocks and a clear step sequence, but it loses points for re-explaining known concepts, lacking in-workflow validation feedback loops for batch operations, and failing to surface the existing bundle files.

Suggestions

Trim the 'Key Concepts' section (Double Extortion Model, DLS Intelligence Value) to only what is non-obvious; Claude already knows double-extortion basics.

Add validation checkpoints inside the workflow (e.g., after Step 1 verify the post count is non-empty and surface API errors with a retry), rather than only a post-hoc Validation Criteria checklist.

Link the existing bundle files from the body — e.g., point to references/api-reference.md for the API schemas and scripts/agent.py for the ready-to-run agent — instead of inlining all code in SKILL.md.

Dimension	Reasoning	Score
Conciseness	The five code blocks are dense and earn their tokens, but the 'Key Concepts' section re-explains the double-extortion model and DLS intelligence value that Claude already knows, so it could be tightened. It is not a 1 because the bulk is executable guidance rather than generic padding, and not a 3 because of the conceptual explanation.	2 / 3
Actionability	Each of the five workflow steps ships complete, executable Python against real APIs (ransomwatch raw JSON endpoints) with working data structures and logic, copy-paste ready. It is not below 3 because no step is left as pseudocode or vague direction.	3 / 3
Workflow Clarity	Steps 1–5 are clearly sequenced and a Validation Criteria checklist exists, but batch ingestion and report generation lack interleaved validate→fix→retry feedback loops; validation is a separate end-checklist rather than checkpoints. Capped at 2 per the batch-operations guideline, not 3 because no in-workflow error-recovery loop is present.	2 / 3
Progressive Disclosure	The body is organized into clear sections (not a wall of text), but the bundle files references/api-reference.md and scripts/agent.py are never linked or signaled from the body, and all code is inlined rather than split out. It is a 2 rather than 1 because sections exist, and not 3 because the provided reference and script are undiscoverable from SKILL.md.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, uses third person, includes natural trigger terms, and clearly answers both what the skill does and when to use it. It carves out a distinct, low-conflict niche.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments' — rather than vague language.	3 / 3
Completeness	Explicitly states what it does (monitor/collect/track/assess) and when to use it via the 'Use when performing threat intelligence gathering...' clause, answering both what and when.	3 / 3
Trigger Term Quality	Uses natural terms an analyst would say — 'ransomware', 'threat intelligence gathering', 'data leak sites (DLS)', 'double-extortion', 'proactive defense reporting' — with good coverage of likely phrasings.	3 / 3
Distinctiveness Conflict Risk	The narrow niche of ransomware Tor-hosted data leak site monitoring with distinct triggers makes it unlikely to be selected for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-ransomware-leak-site-intelligence/SKILL.md
Commit: e612f49

Reviewed: about 10 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.