analyzing-threat-intelligence-feeds

Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-threat-intelligence-feeds/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, reasonably actionable skill body hampered by a Key Concepts table that over-explains known concepts, a batch distribution workflow lacking validation checkpoints, and bundle files (api-reference.md, agent.py) that exist but are never referenced from the body. Tightening these would lift the conciseness, workflow, and disclosure scores.

Suggestions

Add an explicit validation checkpoint before Step 5 distribution (e.g., validate the STIX bundle schema and confirm low-confidence indicators are detection-only) so the batch/blocking workflow has a feedback loop.

Link the existing bundle files from the body — e.g., under Step 3 'See [references/api-reference.md](references/api-reference.md) for full STIX pattern syntax' and reference scripts/agent.py for the pipeline — and move the inlined STIX pattern / TAXII endpoint detail into that file.

Trim or remove the 'Key Concepts' table entries for STIX, TAXII, IOC, and TLP, which restate knowledge Claude already has; keep only feed-specific notions like Feed Fidelity if a compact reminder is warranted.

Dimension	Reasoning	Score
Conciseness	Mostly efficient prose with concrete code, but the 'Key Concepts' table defines STIX 2.1, TAXII 2.1, IOC, TLP, and Confidence Score — concepts Claude already knows — and the 'Tools & Systems' section adds product blurbs that go beyond what is needed, so it could be tightened.	3 / 5
Actionability	Provides concrete, mostly executable guidance — STIX patterns like "[ipv4-addr:value = '...']", the `/v2/indicator/search` endpoint with `risk_score_min=65`, enrichment sources, TTL values, and a dedup composite key — with only minor gaps (the inline `taxii2-client` commands carry a `<id>` placeholder and the REST step is described in prose rather than full code).	4 / 5
Workflow Clarity	A clear five-step sequence (Enumerate → Ingest → Normalize → Deduplicate/Enrich → Distribute) is present, but this is a batch operation that pushes indicators to SIEM, firewalls, and EDR with no explicit validation or verification checkpoint before distribution, so the destructive/batch cap of 3 applies.	3 / 5
Progressive Disclosure	The body is sectioned clearly, but bundle files `references/api-reference.md` and `scripts/agent.py` are never linked from the body, and API-reference-style content (STIX pattern syntax, TAXII endpoints) is inlined instead of being offloaded to the existing reference file, so references are present as files but not signaled.	3 / 5
	Total	13 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An excellent description that crisply states what the skill does and when to invoke it, with concrete actions, natural trigger terms, named tool triggers, and a clearly distinct niche. No meaningful gaps to address.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'extract actionable indicators, adversary tactics, and campaign context', 'normalizing data into STIX 2.1 format', 'enriching existing IOCs with campaign attribution', 'evaluating feed quality' — covering the domain comprehensively, matching the anchor for multiple specific concrete actions.	5 / 5
Completeness	Explicitly answers both 'what' (extract indicators/tactics/context, normalize to STIX, enrich IOCs) and 'when' via 'Use when ingesting... evaluating feed quality... normalizing... or enriching...' plus 'Activates for requests involving...', matching the anchor for clear concrete trigger phrases on both sides.	5 / 5
Trigger Term Quality	Includes natural terms and synonyms a CTI analyst would say ('threat intelligence feeds' / 'CTI feeds', 'IOCs', 'STIX 2.1', 'campaign attribution') plus concrete product triggers (ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX), giving comprehensive keyword coverage.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (CTI feed ingestion/normalization/enrichment) anchored by specific named tools and the STIX/TAXII format, giving distinct triggers and minimal overlap risk with adjacent skills.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-threat-intelligence-feeds/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.