analyzing-threat-actor-ttps-with-mitre-attack

Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md

Quality

Content

53%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers a clear five-step workflow with executable attackcti code and a working Navigator layer, but re-explains ATT&CK fundamentals Claude already knows and ignores its own bundle — inlining code that belongs in scripts/ and never linking to the provided reference files. Adding inline validation checkpoints and wiring up the local references would lift the weaker dimensions.

Suggestions

Replace the Key Concepts section with a one-line pointer; Claude already knows ATT&CK matrix structure and the Navigator, so the explanation is padding.

Move the per-step Python into scripts/ and reference it, and link to references/api-reference.md and references/workflows.md instead of inlining everything — this wires up the currently orphaned bundle files.

Add inline validation checkpoints — e.g., confirm the ATT&CK client connected before querying, validate the Navigator layer JSON renders before saving, and guard the Step 4 division against an empty technique set.

Dimension	Reasoning	Score
Conciseness	The Key Concepts section re-explains ATT&CK matrix structure, threat-group profiles, and the Navigator — concepts Claude already knows — and each step re-imports attack_client, adding padding that could be trimmed.	3 / 5
Actionability	Five workflow steps ship executable attackcti Python with real group IDs (G0016, G0007) and a working Navigator layer builder, though Step 4's detected_techniques set is a hardcoded placeholder.	4 / 5
Workflow Clarity	Steps 1–5 are clearly sequenced, but there are no inline validation checkpoints (e.g., verify the layer JSON before saving) and the batch cross-group/coverage comparisons lack a validate-fix-retry loop, capping the score per the rubric.	3 / 5
Progressive Disclosure	The bundle ships references/ (api-reference.md, standards.md, workflows.md), scripts/, and assets/ files, but the body inlines ~120 lines of Python and links to none of them, leaving the local references orphaned.	2 / 5
	Total	12 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that states four concrete capabilities and an explicit 'Use when' trigger clause in third-person voice. The only gap is minor: a few natural synonyms (threat hunting, APT) would round out trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists four concrete actions — 'map threat actor behavior and observed IOCs to the MITRE ATT&CK framework', 'build technique coverage heatmaps with the ATT&CK Navigator', 'identify detection gaps', and 'produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices' — for comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what it does (the four capabilities) and when to use it via the 'Use when analyzing threat actor TTPs, correlating IOCs... or assessing defensive detection coverage' clause with concrete triggers.	5 / 5
Trigger Term Quality	Includes natural analyst phrases like 'analyzing threat actor TTPs', 'correlating IOCs to specific ATT&CK techniques', and 'assessing defensive detection coverage', but omits common synonyms such as 'threat hunting' or 'APT'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche — MITRE ATT&CK TTP mapping with Navigator heatmaps and detection-gap analysis — with triggers unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-threat-actor-ttps-with-mitre-attack/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.