analyzing-ransomware-payment-wallets

Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters and tracking fund movement through mixers and exchanges to support law enforcement attribution. Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-ransomware-payment-wallets/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable skill with executable code and a clear workflow plus verification section. It can improve by trimming redundant concept/tool explanations and explicitly linking the existing api-reference.md and agent.py bundle files.

Suggestions

Remove or compress the 'Key Concepts' table and 'Tools & Systems' section, which restate prerequisites and concepts Claude already knows, to tighten token usage.

Explicitly reference the bundle files in the body, e.g. 'See references/api-reference.md for full endpoint details' and 'Run scripts/agent.py for automated tracing', so progressive disclosure is clearly signaled.

Inline validation checkpoints within the workflow steps (e.g., confirm address format in Step 1 before querying APIs in Step 2) instead of grouping all verification at the end.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with executable code and compact tables, but the 'Key Concepts' table explains UTXO/cluster basics Claude already knows and the 'Tools & Systems' section repeats tools already named in Prerequisites.	3 / 5
Actionability	Provides concrete, executable Python functions (get_wallet_transactions, check_wallet_explorer) with real API URLs and a report template; Step 3's fund-flow mapping is descriptive rather than executable code, a minor gap.	4 / 5
Workflow Clarity	Clear 5-step sequence with a dedicated Verification section containing checkpoints (validate address format, cross-reference timestamps, OFAC check); the operation is explicitly passive/read-only so the destructive cap does not apply, but checkpoints are separated from the step flow rather than inline.	4 / 5
Progressive Disclosure	The skill correctly splits detail into references/api-reference.md and scripts/agent.py, but the body never explicitly signals or links these bundle files, leaving their existence undiscoverable from the overview.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with clear capability statements, natural trigger phrases, and an explicit 'Use when' clause covering multiple scenarios. Minor opportunity to add a few more synonym trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('Traces ransomware cryptocurrency payment flows', 'identifying wallet clusters', 'tracking fund movement through mixers and exchanges', 'support law enforcement attribution') plus named tools, giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what (trace flows, identify clusters, track movement, support attribution) and when ('Use when tracing ransomware bitcoin payments, performing cryptocurrency wallet forensics, or gathering blockchain threat intelligence on extortion payments').	5 / 5
Trigger Term Quality	Strong natural triggers ('tracing ransomware bitcoin payments', 'cryptocurrency wallet forensics', 'blockchain threat intelligence', 'extortion payments') with synonyms, though a few common variations like 'BTC' or specific extensions are absent.	4 / 5
Distinctiveness Conflict Risk	A clearly defined niche (ransomware payment tracing) with distinctive triggers that are unlikely to collide with unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-ransomware-payment-wallets/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.