analyzing-supply-chain-malware-artifacts

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-supply-chain-malware-artifacts/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers strong executable code and clear prerequisites, but the workflow is incomplete (a single labeled step with no validation feedback loops) and the bundle files are never referenced from the body. Tightening the Overview and wiring up the bundle would raise the score.

Suggestions

Add the missing workflow steps (e.g. Step 2 dependency/package analysis, Step 3 IOC extraction) with explicit validate-then-proceed checkpoints and a fix-retry loop.

Reference the bundle files inline — point to scripts/agent.py, references/api-reference.md, and assets/template.md with "See ..." links so the SKILL.md acts as an overview hub.

Trim the Overview's SolarWinds/3CX backstory and the time-sensitive "30% of breaches" stat, or move dated statistics to a clearly marked section, to respect token budget.

Dimension	Reasoning	Score
Conciseness	The Overview rehashes widely known context (SolarWinds/3CX backstory, "30% of all breaches") that competes with context budget; the core code is efficient but the prose could be tightened.	2 / 3
Actionability	Provides a fully executable, copy-paste-ready Python script with concrete functions (compare_pe_files, hash_file) and a runnable __main__ block, matching the executable-code anchor.	3 / 3
Workflow Clarity	Only "Step 1: Binary Comparison Analysis" is sequenced with no Steps 2+, no validation checkpoints, and no fix-and-retry feedback loops for what is described as a multi-step analysis process.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, references/standards.md, references/workflows.md, scripts/agent.py, assets/template.md) but the body never signals or links to them, so navigation to supporting material is missing.	2 / 3
	Total	9 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive with natural domain trigger terms, but it omits an explicit "Use when..." trigger clause, leaving the "when to use it" half only implied. Adding a usage-trigger sentence would lift completeness to full marks.

Suggestions

Append a "Use when..." trigger clause naming concrete scenarios, e.g. "Use when investigating trojanized updates, compromised build pipelines, or sideloaded dependency compromise."

Add common variation terms users might say (e.g. "software integrity", "dependency confusion", "SolarWinds-style attack") to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies" and "identify intrusion vectors and scope of compromise" — matching the multiple-specific-actions anchor.	3 / 3
Completeness	Clearly answers what the skill does, but there is no "Use when..." clause or equivalent explicit trigger guidance, which per the guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	Uses natural domain terms a practitioner would say — "supply chain attack artifacts", "trojanized software updates", "compromised build pipelines", "sideloaded dependencies" — giving good coverage of natural trigger language.	3 / 3
Distinctiveness Conflict Risk	Targets a clearly distinct niche — supply chain malware artifact analysis — with specific triggers unlikely to overlap with other skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-supply-chain-malware-artifacts/SKILL.md
Commit: e612f49

Reviewed: about 10 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.