analyzing-threat-actor-ttps-with-mitre-navigator

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md

Quality

Content

50%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured with clear sections and a sensible step sequence, but it stays at a descriptive level: it lacks executable code, validation checkpoints, and any links to the provided api-reference and agent bundle files that contain the actionable detail.

Suggestions

Add a short, executable attackcti snippet in the Steps (e.g., initializing attack_client() and calling get_techniques_used_by_group) so guidance is copy-paste ready instead of descriptive.

Reference the existing bundle files inline — point to references/api-reference.md for method signatures and scripts/agent.py for a working layer-generation example — so progressive disclosure actually routes readers to the deeper material.

Insert a validation checkpoint between querying and layer generation (e.g., confirm techniques were returned and the layer JSON is well-formed before exporting) and trim the redundant first "When to Use" bullet plus the Navigator/attackcti concept explanations.

Dimension	Reasoning	Score
Conciseness	The Overview explains what MITRE ATT&CK Navigator and attackcti are — concepts Claude largely already knows — and the first "When to Use" bullet restates the skill title verbatim ("analyzing threat actor ttps with mitre navigator"), so it is mostly efficient but could be tightened rather than fully lean.	2 / 3
Actionability	The numbered Steps name the library and operations but provide no executable code or commands in the body, functioning like a high-level recipe with missing key details rather than the copy-paste-ready guidance of a 3.	2 / 3
Workflow Clarity	A clear 5-step sequence is present, but there are no validation checkpoints or feedback loops (e.g., verifying the STIX query returned techniques before building the layer), matching the "steps listed but checkpoints missing" anchor.	2 / 3
Progressive Disclosure	The body is cleanly sectioned, but bundle files holding the real actionable detail (references/api-reference.md with attackcti methods and scripts/agent.py with working code) are never referenced or signaled, so navigation to deeper content is missing despite the files existing.	2 / 3
	Total	8 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted, third-person description that states concrete capabilities, includes an explicit trigger clause with natural analyst terms, and carves out a distinctive niche. No first/second-person voice or vague fluff is present.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "Map...TTPs to the MITRE ATT&CK framework", "query STIX/TAXII data for group-technique associations", "generate ATT&CK Navigator layer files", "visualize and compare defensive coverage" — matching the multiple-specific-actions anchor rather than the single-domain anchor at 2.	3 / 3
Completeness	Clearly answers both what (the mapping/querying/generation actions) and when via an explicit "Use when profiling..." clause, satisfying the explicit-trigger requirement that would otherwise cap this at 2.	3 / 3
Trigger Term Quality	The "Use when" clause covers natural analyst vocabulary — "profiling an APT group's techniques", "Navigator coverage heatmaps", "technique coverage gaps", "specific threat actor" — giving good coverage of terms a user would actually say, not just jargon.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (APT TTP mapping to MITRE ATT&CK Navigator layers) with distinct triggers, making conflict with other skills unlikely; not generic like the score-1 anchor.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-threat-actor-ttps-with-mitre-navigator/SKILL.md
Commit: e612f49

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.