analyzing-threat-actor-ttps-with-mitre-attack

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers highly actionable, executable Python workflows with a clear sequence and validation checklist, but it is held back by redundant concept explanation and a progressive-disclosure failure where a rich bundle of reference/script/asset files is never surfaced or linked from SKILL.md.

Suggestions

Replace the 'Key Concepts' prose and the redundant Overview with brief pointers to references/standards.md, keeping only what is not already general ATT&CK knowledge Claude has.

Link the inline workflow steps to the richer references/workflows.md and surface scripts/agent.py, scripts/process.py, and assets/template.md where appropriate instead of duplicating their content inline.

Tighten the generic 'When to Use' bullets into specific, non-templated triggers tied to concrete analyst tasks (e.g., 'When producing a threat-actor TTP report from a vendor intelligence bulletin').

Dimension	Reasoning	Score
Conciseness	The Overview restates the description, the 'Key Concepts' section explains ATT&CK matrix/group/Navigator basics Claude already knows, and the 'When to Use' bullets are generic templated phrasing ('When investigating security incidents that require analyzing threat actor ttps with mitre attack'); the code blocks themselves are lean, but the prose around them could be tightened.	2 / 3
Actionability	Each of the five steps is a complete, executable Python script using the attackcti library with real IDs (e.g., G0016) and copy-paste-ready output handling, matching the anchor for fully executable code.	3 / 3
Workflow Clarity	The five steps are clearly sequenced (query -> map -> Navigator layer -> detection gaps -> cross-group) and capped by an explicit 'Validation Criteria' checklist; the operations are read-only queries so the missing inline feedback loops are not penalized.	3 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, references/standards.md, references/workflows.md, scripts/agent.py, scripts/process.py, assets/template.md) but the body references none of them — the STIX/API details and workflow descriptions that live in those files are duplicated inline, and the References section links only to external URLs.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that pairs four concrete capabilities with an explicit 'Use when' trigger clause covering natural CTI terminology. It clearly communicates both what the skill does and when to invoke it, with minimal risk of conflicting with other skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'map threat actor behavior and observed IOCs to the MITRE ATT&CK framework', 'build technique coverage heatmaps with the ATT&CK Navigator', 'identify detection gaps', and 'produce actionable threat intelligence reports' — matching the anchor for multiple specific concrete actions.	3 / 3
Completeness	It clearly answers both what the skill does (map TTPs, build heatmaps, identify gaps, produce reports) and when to use it via an explicit 'Use when analyzing threat actor TTPs, correlating IOCs...' trigger clause.	3 / 3
Trigger Term Quality	The 'Use when' clause surfaces natural CTI vocabulary a user would actually say — 'analyzing threat actor TTPs', 'correlating IOCs to specific ATT&CK techniques', and 'assessing defensive detection coverage' — giving good coverage of natural terms.	3 / 3
Distinctiveness Conflict Risk	The MITRE ATT&CK threat-actor TTP analysis niche is clearly scoped with distinct triggers, making it unlikely to fire for an unrelated skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md
Commit: e612f49

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.