automating-ioc-enrichment

Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/automating-ioc-enrichment/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable and mostly concise, with executable code and concrete SOAR steps. Its two weaknesses are the missing validation feedback loops (capping workflow clarity at 3 for a batch skill) and unreferenced bundle files that duplicate inlined content, which weakens progressive disclosure.

Suggestions

Add explicit validation/verification checkpoints to the workflow — e.g., verify enrichment completeness and confirm partial results before routing alerts, with a fix-and-retry loop for failed lookups, since this is a batch IOC skill.

Reference the existing bundle files from the body (e.g., 'See references/api-reference.md for full API details' and 'See scripts/agent.py for a runnable pipeline') and move the inlined API call patterns out of the body to avoid duplication.

Add a brief domain/URL enrichment code example or explicitly point to it in the reference, so all four IOC types named in the architecture diagram have executable guidance.

Dimension	Reasoning	Score
Conciseness	The body is efficient and largely assumes Claude's competence, avoiding padding like 'what is a SOAR platform'; code and tables earn their place. Not a 5 because the Key Concepts table and a few prose passages could still be tightened, but well above the mostly-efficient-with-unnecessary-explanation bar of 3.	4 / 5
Actionability	Provides executable Python (enrich_ip, enrich_hash, rate_limited, retry_on_429) and specific SOAR playbook commands ('!vt-file-scan', '!misp-search', '!abuseipdb-check-ip') with concrete thresholds and metrics. Not a 5 because there is no complete copy-paste entry point and a couple of paths (e.g., domain/URL enrichment) are sketched only in the architecture diagram, but it is clearly above the 'some concrete guidance but incomplete' bar of 3.	4 / 5
Workflow Clarity	A clear 5-step sequence is present, but this is a batch IOC-processing skill with no validation/verification checkpoints (no verify-enrichment-completeness step, no confirm-before-routing, no validate-IOC-before-processing). Per the rubric, batch skills without validation are capped at 3 regardless of sequencing clarity. Not a 4 because the cap explicitly applies and validation feedback loops are absent.	3 / 5
Progressive Disclosure	Bundle files exist (references/api-reference.md, scripts/agent.py) but the body never references or links to them, and API patterns are inlined in the body while a separate reference file duplicates them. Structure exists but references are not signaled and content that belongs in separate files is partly inline. Not a 4 because navigation to the bundle is not clearly signaled; not a 2 because sections are organized rather than a monolithic wall.	3 / 5
	Total	14 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it explicitly states what the skill does and when to use it, with concrete product-named triggers and low conflict risk. The main gap is specificity, where it describes mechanisms and outcomes rather than enumerating the full set of concrete enrichment actions.

Dimension	Reasoning	Score
Specificity	Names concrete mechanisms ('SOAR platforms, Python pipelines, or TIP playbooks') and outcomes ('reduce analyst triage time and standardize enrichment outputs'), but stops short of listing multiple distinct enrichment actions comprehensively. Not a 5 because it does not enumerate the concrete actions (e.g., IP/domain/hash enrichment) as fully as the top anchor.	4 / 5
Completeness	Explicitly answers both 'what' ('Automates the enrichment of raw indicators of compromise... to reduce analyst triage time and standardize enrichment outputs') and 'when' with concrete trigger phrases ('Use when building automated enrichment workflows...', 'Activates for requests involving...'). Matches the top anchor for clearly answering what and when with concrete triggers.	5 / 5
Trigger Term Quality	Strong natural keyword coverage including product names ('Cortex XSOAR', 'Splunk SOAR', 'TheHive') plus synonyms ('SOAR enrichment', 'Python enrichment pipelines', 'automated IOC processing'), but a few natural terms are absent. Not a 5 because not fully comprehensive on synonyms/extensions, and not a 3 because coverage is well above 'some relevant keywords'.	4 / 5
Distinctiveness Conflict Risk	A clear niche (automated IOC enrichment via SOAR/TIP) with distinct, product-named triggers ('Cortex XSOAR', 'Splunk SOAR', 'TheHive') and minimal overlap risk with unrelated skills. Matches the top anchor for a clear niche with distinct triggers.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/automating-ioc-enrichment/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.