building-adversary-infrastructure-tracking-system

Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/building-adversary-infrastructure-tracking-system/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content provides solid executable code and a clear step sequence, but it over-explains basic concepts, lacks inline validation checkpoints for a batch operation, and fails to surface the existing bundle files, leaving structure mediocre. Tightening the conceptual prose and pointing to the script/reference bundles would lift it.

Suggestions

Replace the Overview and Key Concepts prose (which re-explain passive DNS, pivoting, and adversary patterns Claude already knows) with a brief framing that points to references/api-reference.md for the pivot/source details.

Add inline validation checkpoints in the workflow (e.g., verify API responses, confirm pivot results, retry on failures) so the batch pivoting operation has explicit validate->fix->retry feedback loops rather than only a post-hoc checklist.

Reference scripts/agent.py and references/api-reference.md explicitly from SKILL.md and move the full inline implementation into the script bundle, keeping SKILL.md as a lean overview with key inline snippets.

Dimension	Reasoning	Score
Conciseness	The code is efficient, but the Overview and Key Concepts sections re-explain general-knowledge topics (what passive DNS is, what pivoting is, adversary patterns) that Claude already knows, which the rubric penalizes.	3 / 5
Actionability	Three full, executable Python classes with real API endpoints and complete logic are copy-paste-ready, but minor gaps (placeholder keys, missing 'requests' import in Step 3, listed libraries like shodan/python-whois unused) keep it just below the 5 anchor.	4 / 5
Workflow Clarity	Steps are clearly sequenced (Step 1-3) but validation is only a post-hoc checklist rather than inline validate-fix-retry checkpoints; per the rubric's batch-operation cap, a batch pivoting workflow without embedded validation cannot exceed 3.	3 / 5
Progressive Disclosure	Section structure exists, but ~200 lines of inline code duplicate the purpose of scripts/agent.py and the body never references or links the provided references/api-reference.md or scripts/agent.py bundle files, leaving content that belongs in separate files inlined and navigation poor.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it clearly states concrete capabilities across multiple data sources and provides an explicit 'Use when' trigger clause with specific conditions. Minor gap is synonym coverage in trigger terms, but distinctiveness and completeness are excellent.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across four named data sources (passive DNS, certificate transparency, WHOIS, IP enrichment) plus two outcome actions (map C2 networks, flag new domains), matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers both what (build a tracking system that pivots across named sources) and when ('Use when pivoting from known indicators...') with concrete trigger phrases, matching the anchor-5 example.	5 / 5
Trigger Term Quality	Strong natural keyword coverage ('passive DNS', 'WHOIS', 'C2 infrastructure', 'pivoting', 'threat actor') but a few common synonyms/variants are absent, fitting good-but-not-comprehensive coverage rather than the 5 anchor.	4 / 5
Distinctiveness Conflict Risk	A clear, specialized niche (adversary C2 infrastructure tracking via pivot-based enrichment) with distinct triggers and minimal realistic overlap with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/building-adversary-infrastructure-tracking-system/SKILL.md
Commit: 54a7988

Reviewed: 5 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.