detection-validate
From the author
Runs attacker techniques and confirms whether detections actually fire, producing an honest ATT&CK coverage map that separates real gaps from accepted ones. Use when running a purple-team exercise, measuring detection coverage, validating that a SOC can see a technique, or turning 'we think we're covered' into evidence per technique.
Install
npx skills add zero-lab-ai/skills --skill detection-validate -a claude-code
Installs to .claude/skills/detection-validate/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 79
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- performing-purple-team-exercise26zl/cybersec-toolkitPerforms purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.Testing★ 82
- breachsimota/agent-skillsDesigning red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed.Security★ 95
- red-teamalirezarezvani/claude-skillsUse when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations. Covers MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting.Security★ 28.7K
- vigilsimota/agent-skillsEngineering detection rules (Sigma/YARA), detection coverage mapping, threat hunting hypotheses, Purple Team Blue side, Detection-as-Code CI/CD. Use when defensive verification is needed.DevOps★ 95
- detection-resilience-test-planzero-lab-ai/skillsPlans and records bounded defensive tests of whether preventive controls, telemetry, and detections remain effective across pre-approved opaque technique variations. Use when a blue or purple team needs authorization-, safety-, evidence-, cleanup-, and remediation-gated resilience measurement without generating bypass procedures, commands, payloads, or stealth rankings.Testing★ 282
- 22-purple-teamMasriyan/Claude-Code-CyberSecurity-SkillCollaborative purple-team operations — threat-informed adversary emulation planning (ATT&CK, CTID, Atomic Red Team, CALDERA), the detect-tune-validate loop, detection coverage measurement (DeTT&CT/Navigator), safe execution and deconfliction, and MTTD/coverage reportingPlanning★ 512
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in