analyzing-supply-chain-malware-artifacts

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-supply-chain-malware-artifacts/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers one strong, executable workflow step but stops short of a complete multi-step process and never points to the bundled reference/template/script files that exist alongside it, leaving the overview disconnected from its own bundle.

Suggestions

Complete the workflow with Steps 2-N (build-pipeline artifact inspection, dependency/sideload analysis, IOC extraction/reporting) and weave the Validation Criteria in as explicit checkpoints after each step.

Link to the existing bundle files from the body (e.g. 'See references/workflows.md for the end-to-end flow', 'Use assets/template.md for the report', 'Run scripts/agent.py for binary comparison') instead of inlining code that duplicates scripts/agent.py.

Trim the Overview's well-known historical background and move the time-sensitive 'As of 2025' breach statistic into a clearly labeled dated/deprecated note or drop it.

Dimension	Reasoning	Score
Conciseness	The Overview pads with background Claude already knows (SolarWinds/3CX parentheticals) and includes a time-sensitive 'As of 2025, supply chain attacks account for 30% of all breaches, a 100% increase' stat outside any deprecated section, so it is mostly efficient but could be tightened.	3 / 5
Actionability	A complete, executable Python script with imports, CLI usage, and JSON output is copy-paste ready, but it only covers PE binary comparison (Step 1 of the promised workflow), leaving the other artifact types without executable guidance.	4 / 5
Workflow Clarity	The Workflow is labeled 'Step 1: Binary Comparison Analysis' with no Step 2/N for build-pipeline or dependency analysis, and the Validation Criteria are a detached outcome list rather than embedded checkpoints, matching anchor 3's sequence-with-validation-gaps.	3 / 5
Progressive Disclosure	Section headers are clean, but the body links to none of the five bundled files (references/api-reference.md, references/standards.md, references/workflows.md, assets/template.md, scripts/agent.py) and inlines an ~85-line script that duplicates what should live in scripts/agent.py.	3 / 5
	Total	13 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and third-person with a clear, distinct niche, but it lacks any explicit 'when to use' trigger guidance, which caps completeness at 3 and leaves natural synonyms/product names uncovered.

Suggestions

Add an explicit 'Use when...' clause naming concrete trigger situations, e.g. 'Use when investigating trojanized updates, compromised build pipelines, or dependency-confusion incidents'.

Include natural synonyms and notable product/campaign names users are likely to say (SolarWinds/SUNBURST, 3CX, npm/PyPI package poisoning) to improve trigger-term coverage.

Mention the downstream outputs (IOC extraction, scoping affected systems) to round out the action coverage toward anchor 5.

Dimension	Reasoning	Score
Specificity	Lists several concrete artifact categories ('trojanized software updates, compromised build pipelines, and sideloaded dependencies') and two outcomes ('identify intrusion vectors and scope of compromise'), matching anchor 4 with minor coverage gaps (no IOC extraction/reporting).	4 / 5
Completeness	It clearly states what the skill does but provides no 'Use when...' clause or equivalent trigger guidance, so per the rubric guideline completeness is capped at 3 ('Has a clear what but when is missing').	3 / 5
Trigger Term Quality	Natural analyst-facing terms ('supply chain attack artifacts', 'trojanized software updates', 'compromised build pipelines', 'sideloaded dependencies') give good keyword coverage, but common synonyms and product names (SolarWinds, 3CX, npm, PyPI) are missing.	4 / 5
Distinctiveness Conflict Risk	The 'supply chain attack artifacts' niche is clearly distinct with specific triggers, with only minor overlap risk against broader malware-analysis skills, matching anchor 4.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-supply-chain-malware-artifacts/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.