building-incident-timeline-with-timesketch

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data (including Plaso output) for attack chain reconstruction and investigation documentation. Use when reconstructing the sequence of events during an incident investigation or when multiple analysts need to jointly tag, annotate, and search a shared DFIR timeline.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/building-incident-timeline-with-timesketch/SKILL.md

Quality

Content

53%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is rich with executable, actionable guidance for building Timesketch timelines, but it inlines reference-style material that should live in the provided bundle files and never navigates to them, and its batch workflow lacks explicit validation steps.

Suggestions

Link the existing bundle files from the body (e.g., 'See references/workflows.md for end-to-end evidence processing pipelines' and 'See references/api-reference.md for the full REST API') so the SKILL.md acts as an overview rather than inlining that material.

Add explicit validation/verification checkpoints to the ingestion and analysis workflow (e.g., verify event counts after upload, confirm indexing completed before searching) to satisfy the destructive/batch feedback-loop requirement.

Trim the Overview explanation of what Timesketch and Plaso are, and replace the generic 'When to Use'/'Prerequisites' boilerplate with skill-specific triggers and prerequisites.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with concrete commands and code, but the Overview explains what Timesketch/Plaso are (concepts Claude largely knows) and the boilerplate 'When to Use'/'Prerequisites' sections add padding that could be tightened.	3 / 5
Actionability	Provides executable bash and python snippets, query-language examples, and lookup tables covering the common ingestion and analysis cases, with only minor gaps (e.g., the EVTX-to-CSV conversion is a placeholder).	4 / 5
Workflow Clarity	The ingest -> analyze -> search -> story sequence is listed, but batch/evidence-processing operations lack explicit validation checkpoints in the body (verification appears only in an unreferenced bundle file), so the destructive/batch cap of 3 applies.	3 / 5
Progressive Disclosure	Bundle files (references/api-reference.md, workflows.md, standards.md; scripts/process.py; assets/template.md) exist but are never linked or signaled from the body, and content that belongs in separate files (full API reference, MITRE mapping, data-source tables) is inlined.	2 / 5
	Total	12 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both what the skill does and when to use it, with natural trigger phrasing and low conflict risk. It falls just short of top specificity only because the action list could be more exhaustively enumerated.

Dimension	Reasoning	Score
Specificity	Names concrete actions like 'ingest, normalize, and analyze multi-source event data', 'attack chain reconstruction', and 'tag, annotate, and search', but the action set is not as fully enumerated as a 5-level example.	4 / 5
Completeness	Explicitly answers what ('ingest, normalize, and analyze multi-source event data ... for attack chain reconstruction and investigation documentation') and when via a concrete 'Use when reconstructing the sequence of events during an incident investigation or when multiple analysts need to jointly tag, annotate, and search a shared DFIR timeline.' clause.	5 / 5
Trigger Term Quality	Natural phrases like 'incident investigation', 'attack chain reconstruction', and 'tag, annotate, and search a shared DFIR timeline' map to what analysts say, though some synonyms and file extensions are missing.	4 / 5
Distinctiveness Conflict Risk	Targets a clear Timesketch/DFIR niche with distinct triggers (shared DFIR timeline, Plaso, multi-analyst collaboration) and minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/building-incident-timeline-with-timesketch/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.