detection-validate
From the author
Runs attacker techniques and confirms whether detections actually fire, producing an honest ATT&CK coverage map that separates real gaps from accepted ones. Use when running a purple-team exercise, measuring detection coverage, validating that a SOC can see a technique, or turning 'we think we're covered' into evidence per technique.
Install
npx skills add zero-lab-ai/skills --skill detection-validate -a claude-code
Installs to .claude/skills/detection-validate/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 79
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- detection-resilience-test-planzero-lab-ai/skillsPlans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective across pre-approved opaque technique variations. Use when a blue or purple team needs authorization-, safety-, evidence-, cleanup-, and remediation-gated resilience measurement without generating bypass procedures, commands, payloads, or stealth rankings.Testing★ 281
- 22-purple-teamMasriyan/Claude-Code-CyberSecurity-SkillCollaborative purple-team operations — threat-informed adversary emulation planning (ATT&CK, CTID, Atomic Red Team, CALDERA), the detect-tune-validate loop, detection coverage measurement (DeTT&CT/Navigator), safe execution and deconfliction, and MTTD/coverage reportingPlanning★ 504
- defense-in-depth-validationsecondsky/claude-skillsValidate at every layer data passes through to make bugs impossible. Use when invalid data causes failures deep in execution, requiring validation at multiple system layers.Other★ 236
- incident-validation-correlationzero-lab-ai/skillsCorrelates supplied sanitized incident observations with separately approved isolated defensive-validation receipts across prevent, observe, detect, contain, and recover. Use for defensive learning comparison without live response, hunting, technique design or execution, detection authoring, case management, findings, or reporting.Design★ 281
- ghost-validateghostsecurity/skillsThis skill should be used when the user asks to "validate a finding", "check if a vulnerability is real", "triage a security finding", "confirm a vulnerability", "determine if a finding is a true positive or false positive", or provides a security finding for review. It validates security vulnerability findings by tracing data flows, verifying exploit conditions, analyzing security controls, and optionally testing attack vectors against a live application.Security★ 418
- dart-test-coveragekevmoo/dash_skillsUnderstand and improve test coverage in a Dart package. Helps agents run coverage, interpret results, and identify missed lines.Testing★ 148
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in