building-malware-incident-communication-template

Build structured communication templates for malware incidents (ransomware, wiper, trojan, worm), covering internal stakeholder notifications, executive briefings, technical advisories for IT teams, customer notifications, and regulatory disclosures, with severity-based escalation procedures. Use when drafting or standardizing incident communications and notification workflows for a malware outbreak.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/building-malware-incident-communication-template/SKILL.md

Quality

Content

53%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body delivers real value — five complete, well-structured communication templates with severity, channel, and escalation tables — but it is weakened by padded boilerplate sections, the absence of an explicit end-to-end workflow with validation checkpoints (e.g., legal review before regulatory submission), and a complete failure to reference the six bundle files, leaving valuable reference material and scripts orphaned.

Suggestions

Add a 'Bundle contents' or per-section references pointing to the actual files: e.g., 'Regulatory deadlines by regulation: see references/api-reference.md', 'Notification cadence workflows: see references/workflows.md', 'Communication tracking: see assets/template.md', and document how scripts/process.py generates templates — this is the single biggest fix (progressive_disclosure).

Replace the implicit process with a numbered workflow with validation checkpoints: classify severity → select template → fill placeholders → validate (legal review for regulatory/customer notifications, fact-check against IOC data) → send via the severity-appropriate channel → log in the tracker (workflow_clarity).

Trim the Overview's 'why communication matters' paragraph, rewrite the generic 'When to Use' bullets into skill-specific triggers, and remove or justify the 'Python 3.8+' prerequisite since the body never invokes Python (conciseness).

Dimension	Reasoning	Score
Conciseness	The five templates and supporting tables are dense and earn their tokens, but the body pads with concepts Claude already knows — the Overview paragraph on why incident communication matters, auto-generated filler like 'When deploying or configuring building malware incident communication template capabilities in your environment', and a 'Python 3.8+' prerequisite the body never uses. This is more than minor over-explanation (ruling out 4) but the bulk of the content is efficient (ruling out 2).	3 / 5
Actionability	The body provides five complete, copy-paste-ready template skeletons (initial notification, executive briefing, technical advisory with concrete IOC blocks, regulatory letter, customer notice) plus severity, channel, and escalation tables — mostly executable guidance. It falls short of 5 because there is no worked example showing a filled template, and the generator scripts and tracking template that would make execution fully concrete are never referenced.	4 / 5
Workflow Clarity	The escalation matrix establishes a sequence (classify severity, then notify defined audiences within stated timelines), but there is no numbered end-to-end workflow connecting the templates (classify → select template → fill → review → send → log) and no validation checkpoints such as legal review before the regulatory notification or logging each communication in a tracker. Checkpoints are missing or implicit rather than merely minor gaps.	3 / 5
Progressive Disclosure	Scored against the actual bundle: six real files exist (references/api-reference.md with regulatory deadlines, references/workflows.md with cadence workflows, references/standards.md, assets/template.md tracker, and two generator scripts), yet none are referenced anywhere in the body — the 'References' section lists only external standards (NIST, GDPR, SANS, CISA). The bundle is effectively orphaned and unnavigable, fitting the 'references buried/absent, content misallocated' anchor rather than the 'references present but not clearly signaled' anchor.	2 / 5
	Total	12 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it is specific, uses third person, comprehensively lists the template types it produces, and closes with an explicit 'Use when...' trigger clause tied to natural user phrasing. The only weakness is a few missing common synonyms (e.g., 'data breach', 'crisis communication') that users might naturally say.

Dimension	Reasoning	Score
Specificity	The description enumerates five concrete deliverables — 'internal stakeholder notifications, executive briefings, technical advisories for IT teams, customer notifications, and regulatory disclosures' — plus 'severity-based escalation procedures', giving comprehensive, concrete coverage rather than a partial list.	5 / 5
Completeness	It explicitly answers both questions: the 'what' (build structured templates covering the listed audience types with severity-based escalation) and the 'when' via a concrete trigger clause — 'Use when drafting or standardizing incident communications and notification workflows for a malware outbreak'.	5 / 5
Trigger Term Quality	Natural terms like 'malware incidents', 'ransomware, wiper, trojan, worm', 'executive briefings', 'regulatory disclosures', and 'malware outbreak' give good keyword coverage, but common user phrasings such as 'data breach', 'breach notification', or 'crisis communication' are missing, so it falls short of the comprehensive-synonyms anchor.	4 / 5
Distinctiveness Conflict Risk	Malware-incident communication is a clear niche with distinct triggers ('ransomware, wiper, trojan, worm', 'malware outbreak'), making it unlikely to fire for general communication, writing, or generic incident-response skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/building-malware-incident-communication-template/SKILL.md
Commit: 54a7988

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.