analyzing-ransomware-payment-wallets
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs. Identifies wallet clusters, tracks fund movement through mixers and exchanges, and supports law enforcement attribution. Activates for requests involving ransomware payment tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence gathering.
70
63%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/analyzing-ransomware-payment-wallets/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly articulates specific capabilities (tracing payment flows, identifying wallet clusters, tracking through mixers/exchanges), names concrete tools, and provides explicit trigger conditions. It uses proper third-person voice throughout and occupies a highly distinctive niche that minimizes conflict risk with other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: traces payment flows, identifies wallet clusters, tracks fund movement through mixers and exchanges, supports law enforcement attribution. Also names specific tools (Chainalysis Reactor, WalletExplorer, blockchain.com APIs). | 3 / 3 |
Completeness | Clearly answers both what (traces ransomware cryptocurrency payment flows, identifies wallet clusters, tracks fund movement) and when ('Activates for requests involving ransomware payment tracing, bitcoin wallet analysis, cryptocurrency forensics, or blockchain intelligence gathering'). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural terms users would say: 'ransomware payment tracing', 'bitcoin wallet analysis', 'cryptocurrency forensics', 'blockchain intelligence gathering', plus domain terms like 'mixers', 'exchanges', 'wallet clusters'. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche combining ransomware, cryptocurrency forensics, and law enforcement attribution. Very unlikely to conflict with other skills given the specialized domain and specific tool references. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
27%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill covers a legitimate and useful workflow for ransomware wallet analysis, but it is significantly over-explained for Claude's knowledge level. Core analytical steps (fund tracing, cluster analysis) lack executable code while simpler steps have it, creating an uneven actionability profile. The monolithic structure with glossary tables and tool descriptions inflates token cost without proportional value.
Suggestions
Remove the Key Concepts table and Tools & Systems section entirely—Claude already knows these concepts and can reference them without a glossary taking up tokens.
Add executable Python code for Step 3 (fund flow tracing) that actually follows transaction outputs recursively, rather than just an ASCII diagram describing the concept.
Integrate validation checkpoints directly into the workflow steps (e.g., validate address format before Step 2, check OFAC list before generating the report) rather than listing them in a separate post-hoc section.
Move the detailed report template and address format reference into separate linked files (e.g., REPORT_TEMPLATE.md, ADDRESS_FORMATS.md) to reduce the main skill's token footprint.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is verbose and explains many concepts Claude already knows (Bitcoin address formats, what UTXOs are, what mixers are, what peel chains are). The Key Concepts table and Tools & Systems section are largely unnecessary padding. The prerequisites section explains basic concepts like 'UTXOs, inputs, outputs, change addresses' that Claude understands. The fund flow ASCII diagram, while visually appealing, restates concepts rather than providing actionable guidance. | 1 / 3 |
Actionability | The Python code snippets for querying blockchain.com and WalletExplorer APIs are concrete and mostly executable, but the fund flow analysis (Step 3) is purely descriptive with no executable code for actually tracing outputs. The cluster analysis step is entirely absent as code. The report template in Step 5 is a static example rather than code that generates it. Key analytical steps are described rather than implemented. | 2 / 3 |
Workflow Clarity | The 5-step workflow is clearly sequenced and logically ordered, and there is a Verification section. However, the verification steps are listed as a post-hoc checklist rather than integrated as checkpoints within the workflow. There's no feedback loop for when API queries fail, when addresses are invalid, or when cluster analysis yields ambiguous results. For an investigation workflow involving potentially sanctioned entities, inline validation is important. | 2 / 3 |
Progressive Disclosure | The content is a monolithic wall of text with no references to external files. The Key Concepts table, Tools & Systems list, and detailed report template could all be split into separate reference files. Everything is inline in one long document with no navigation structure or links to supplementary materials. | 1 / 3 |
Total | 6 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.