analyzing-threat-landscape-with-misp

Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape reports with temporal trends. Use when asked to analyze threat intelligence data, summarize top threat actors or malware families, or produce a CTI landscape report from MISP events.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-threat-landscape-with-misp/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean and gives a runnable command, but it lacks validation steps for the batch report operation and never links the existing references/api-reference.md bundle file, capping both workflow_clarity and progressive_disclosure at 3.

Suggestions

Add an explicit validation/verification step after running the agent (e.g., check that landscape_report.json is non-empty and parseable, and surface errors if the MISP connection or query fails) to lift workflow_clarity above 3.

Link the existing references/api-reference.md from the body (e.g., 'See references/api-reference.md for PyMISP connection details, attribute types, and galaxy tag prefixes') so the bundle file is actually discoverable.

Trim templated generic Prerequisites/When-to-Use lines ('Access to a test or lab environment', 'When validating security monitoring coverage for related attack techniques') to tighten conciseness toward 4-5.

Dimension	Reasoning	Score
Conciseness	The body is short and mostly efficient, but templated generic lines in Prerequisites ('Access to a test or lab environment for safe execution', 'Appropriate authorization for any testing activities') and generic 'When to Use' bullets are padding that could be tightened; not enough waste to score 2, but more than the minor trimmings of a 4.	3 / 5
Actionability	Provides a concrete, copy-paste-ready command ('python scripts/agent.py --misp-url ... --api-key ... --days 90 --output landscape_report.json') plus 'pip install pymisp'; the gap is that 'Configure MISP URL and API key' is vague and the analysis sub-steps describe what the script does rather than how to execute it manually.	4 / 5
Workflow Clarity	A numbered sequence is present (install, configure, run), but report generation is a batch operation with no validation or verification steps and no error-handling checkpoint, which per the rubric caps workflow_clarity at 3.	3 / 5
Progressive Disclosure	Sections are present and the API detail lives in a separate bundle file (references/api-reference.md), but that file is never referenced or linked from the body, so navigation to it is not signaled — structure exists but references are buried/missing rather than clearly pointed to.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete, comprehensive capabilities paired with explicit, natural trigger guidance and a distinct niche. Minor keyword/synonym gaps keep trigger_term_quality just below a perfect score.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape reports with temporal trends' — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly answers both what (query MISP via PyMISP, compute statistics/breakdowns/clusters/trends, generate reports) and when ('Use when asked to analyze threat intelligence data...'), with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger phrases are present ('Use when asked to analyze threat intelligence data, summarize top threat actors or malware families, or produce a CTI landscape report'), but a few common synonyms or phrasings a user might say are missing, so it sits just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	Clear niche (MISP threat-intelligence analysis) with distinct triggers tied to MISP and CTI reporting, giving minimal conflict risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-threat-landscape-with-misp/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.