building-attack-pattern-library-from-cti-reports

Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/building-attack-pattern-library-from-cti-reports/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Actionable, executable content undermined by verbosity that explains familiar concepts and by a failure to route readers to the provided bundle files instead of restating their contents inline.

Suggestions

Trim the Overview and Key Concepts sections to assume Claude's domain knowledge and remove the generic 'When to Use' boilerplate.

Replace the inline technique/regex tables with a pointer to references/api-reference.md and reference scripts/agent.py as the runnable CLI for the workflow.

Integrate the Validation Criteria as explicit validate-then-proceed checkpoints inside the workflow steps rather than as a trailing list.

Dimension	Reasoning	Score
Conciseness	The Overview and Key Concepts sections restate domain knowledge Claude already has (what CTI reports and STIX Attack Pattern SDOs are), and the boilerplate 'When to Use' bullets add length without earning their tokens, though the code is mostly efficient.	2 / 3
Actionability	Provides complete, executable Python classes (CTIReportParser, ATTACKMapper, AttackPatternLibrary) with real imports and a worked sample report, copy-paste ready and runnable end-to-end.	3 / 3
Workflow Clarity	Three numbered steps are sequenced, but 'Validation Criteria' is a detached static checklist rather than integrated validate-then-proceed checkpoints, and the batch report-processing flow lacks an explicit feedback loop, which caps the score at 2.	2 / 3
Progressive Disclosure	Bundle files exist (references/api-reference.md, scripts/agent.py) and are one level deep, but the body never links to them and instead duplicates technique/regex tables inline rather than signaling the reference, so content that should be separate stays inline.	2 / 3
	Total	9 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with explicit 'Use when' triggers and clear concrete actions, weakened only by slightly jargon-heavy trigger terms missing common user phrasings like 'threat intel'.

Suggestions

Add common user-facing synonyms such as 'threat intel' and 'IOCs' to broaden natural trigger coverage.

Consider trimming the vendor list (Mandiant, CrowdStrike, Talos, Microsoft) which adds length without improving trigger clarity.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates') and names specific libraries and vendors, matching the comprehensive-actions anchor.	3 / 3
Completeness	Clearly states what the skill does (parse, extract, map, build library, generate templates) and provides an explicit 'Use when...' trigger clause answering when to invoke it.	3 / 3
Trigger Term Quality	Includes relevant natural terms ('CTI reports', 'attack patterns', 'Sigma/YARA templates', 'MITRE ATT&CK technique IDs') but leans jargon-heavy and omits common variations a user might say such as 'threat intel' or 'IOC'.	2 / 3
Distinctiveness Conflict Risk	The niche—building a STIX 2.1 attack-pattern library from CTI reports for detection engineering—is distinctive and the triggers are unlikely to fire for an unrelated skill.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/building-attack-pattern-library-from-cti-reports/SKILL.md
Commit: e612f49

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.