secskills: Skill for Claude Code

Verifying Skill Accuracy

Skills in this repo are drafted with LLM assistance. The methodology in them is usually sound; the specifics are not trustworthy until checked. The measured rate from the first verification pass was 31 factual errors across 11 of 12 skills — about 2.6 per skill, with a single skill clean on both passes. Assume that rate applies to anything unstamped.

This skill is the procedure for driving that rate down, and for knowing when you are allowed to say a skill has been verified.

When to Use

• Auditing an existing SKILL.md against primary sources
• Before adding or renewing a verified: frontmatter stamp
• After drafting new skill content, on the specifics you just wrote
• When a reader reports that a command, ID, or field name does not work
• Reviewing any technical content where the author was a model

When NOT to Use

• Writing a new skill from scratch — use authoring-security-skills, then verify with this skill as the final gate
• Structural or style problems (frontmatter, sections, line count) — that is python3 scripts/validate.py --strict, which checks form only
• Deciding whether a technique is a good idea — that is judgment, not fact

The Core Distinction: Form vs Truth

The repo's CI is a closed loop. validate.py, sync_attack.py, and run_evals.py check frontmatter shape, cross-reference integrity, ATT&CK-index consistency, and routing against self-authored eval cases. Every one of those can pass on a skill whose commands do not exist.

Green CI means the skill is well-formed. It says nothing about whether it is true. Never cite a passing test run as evidence of accuracy.

Sweep by Class Across the Whole Collection

Once you identify an error class, check it everywhere before moving on — not just in the skill that surfaced it. Errors of a class cluster, and a per-skill pass leaves the collection internally inconsistent.

Two cases from this repo make the point. The legacy Sigma date format was fixed in writing-sigma-rules, then turned up again in engineering-detections — in a skill that had already been stamped, because the per-skill inventory did not include a class fixed elsewhere. And attacking-entra-id was still calling retired AzureAD PowerShell cmdlets while investigating-m365-entra already used the modern Graph equivalents: the collection contradicted itself, and only a cross-cutting grep showed it.