analyzing-ransomware-leak-site-intelligence

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-ransomware-leak-site-intelligence/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable — complete executable Python across a clear five-step pipeline — but it pads general-knowledge context and, critically, ignores its own bundle files, inlining code that should live in scripts/agent.py. The batch workflow also lacks the validation checkpoints the rubric expects.

Suggestions

Replace the inlined Step 1-5 code with a short usage example and link to the existing scripts/agent.py and references/api-reference.md so the bundle files are not orphaned.

Add validation checkpoints between steps (e.g., halt or branch if fetch_ransomwatch_data() fails or posts is empty before analyze/assess run), turning the pipeline into a validate → fix → retry loop.

Trim the 'Double Extortion Model' and 'DLS Intelligence Value' prose, which restates cybersecurity fundamentals Claude already knows, keeping only domain-specific framing.

Dimension	Reasoning	Score
Conciseness	Mostly efficient, but the Overview and Key Concepts sections restate general knowledge Claude already has (e.g., the 'Double Extortion Model' explanation of how leak-site pressure works), which the rubric penalizes; not verbose enough for 2, but not lean enough for 4.	3 / 5
Actionability	All five workflow steps ship full, import-included, copy-paste-ready Python hitting real endpoints (ransomwatch posts.json/groups.json), matching the 'fully executable, copy-paste ready' 5 anchor.	5 / 5
Workflow Clarity	The five steps are clearly sequenced (ingest → analyze → assess → track → report), but this batch data pipeline has no in-step validation checkpoints (fetch failures are printed but not halted, empty posts flow silently into analysis), so the batch-operation cap holds it at 3.	3 / 5
Progressive Disclosure	Section structure and an external References list are present, but ~250 lines of code that belong in scripts/agent.py are inlined and the provided bundle files (scripts/agent.py, references/api-reference.md) are never linked from the body, leaving them orphaned.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities in third person and includes an explicit 'Use when' trigger with natural threat-intelligence phrasing. The only minor gap is trigger-term breadth, which leans on specialist jargon rather than offering synonyms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'collect and extract structured victim posting data', 'track group activity trends over time', 'produce sector- and geography-specific ransomware risk assessments' — giving comprehensive coverage, matching the 5 anchor.	5 / 5
Completeness	Explicitly answers both what (monitor/extract/track/assess leak-site data) and when via a concrete 'Use when performing threat intelligence gathering… or building proactive defense reporting' clause, matching the 5 anchor.	5 / 5
Trigger Term Quality	Includes natural phrases a threat-intel analyst would say ('threat intelligence gathering on active ransomware groups', 'proactive defense reporting'), but leans on domain jargon ('double-extortion leak-site activity') and lacks synonyms, so it sits below the comprehensive 5 anchor.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (ransomware Tor leak-site intelligence) with distinct triggers and minimal overlap with other skills, matching the 5 anchor.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-ransomware-leak-site-intelligence/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.