Tessl • The management layer for AI agent skills

SkillPublic

analyzing-threat-actor-ttps-with-mitre-navigator

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized and concise but stays at a high level: steps are abstract prose with no executable code, validation checkpoints are absent, and the useful bundle files (api-reference.md, agent.py) are never referenced from SKILL.md. Most gains come from surfacing the existing executable material and adding verification steps.

Suggestions

Add a concrete, copy-paste-ready example in the Steps or a Quick Start section, e.g. `python agent.py --group "APT29" --layer-output apt29_layer.json`, and link to scripts/agent.py and references/api-reference.md so the executable detail is reachable.

Insert validation checkpoints into the workflow — e.g., confirm the group resolved before extracting techniques, sanity-check technique_count > 0, and validate the generated layer JSON against the Navigator schema before exporting.

Replace the templated 'When to Use' bullets and the redundant Overview with tighter, skill-specific guidance to remove filler and avoid restating the frontmatter description.

Dimension	Reasoning	Score
Conciseness	Mostly lean body, but the Overview re-states the description and the 'When to Use' bullets are templated filler ('When SOC analysts need structured procedures for this analysis type') that could be trimmed.	4 / 5
Actionability	Steps are abstract prose ('Query ATT&CK STIX data for target threat group using attackcti', 'Extract techniques…via STIX relationships') with no executable code or commands in the body; only an expected-output JSON is concrete, and the executable agent.py / CLI usage in the bundle is never surfaced.	3 / 5
Workflow Clarity	Five steps are clearly sequenced but there are no validation checkpoints or feedback loops (e.g., verify the group resolved, confirm technique count, validate the layer JSON before export).	3 / 5
Progressive Disclosure	Section structure is clean (Overview/When to Use/Prerequisites/Steps/Expected Output), but the body never links to the existing bundle files (references/api-reference.md with API+CLI tables, scripts/agent.py with the executable CLI), so navigation to the real detail is missing.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that concretely states capabilities, library, data sources, and output, with an explicit Use-when trigger clause and a distinct niche. Only minor gap is slightly incomplete keyword synonym coverage.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions ('Map APT TTPs…using the attackcti Python library to query STIX/TAXII…then generate ATT&CK Navigator layer files to visualize and compare defensive coverage') with specific library, data source, and output format — comprehensive coverage.	5 / 5
Completeness	Clearly states what the skill does and provides an explicit 'Use when profiling…building…or assessing…' trigger clause with concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes natural analyst phrases ('profiling an APT group's techniques', 'building Navigator coverage heatmaps', 'assessing technique coverage gaps') but lacks some synonyms and file extensions; not quite comprehensive.	4 / 5
Distinctiveness Conflict Risk	Clear niche (MITRE ATT&CK Navigator + attackcti + STIX/TAXII for APT TTP mapping) with distinct, specialized triggers and minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md
Revision: 54a7988

Reviewed: 1 month ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

analyzing-threat-actor-ttps-with-mitre-navigator

Table of Contents

Is this your skill?