本文へ移動
cccskills
無料GitHub で公開

structured-analytic-techniques

Use when the user asks "which SAT should I use for X?", wants the index of Structured Analytic Techniques, or is choosing between quality-of-information-check, ACH, key-assumptions-check, devils-advocacy, indicators of change, etc. Quality of Information Check is the default first step of any diagnostic run.

インストール方法を見る

含まれるファイル(2)

  • SKILL.md5.7 KB
  • references/when-to-use.md5.3 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Structured Analytic Techniques (SATs) Index

SATs are formal methods that externalise analytical thinking, making it transparent, challengeable, and less susceptible to cognitive biases. Choose the right technique based on the analytical challenge.

When to Use SATs

  • When the stakes are high (wrong answer = significant consequence)
  • When multiple plausible explanations exist
  • When cognitive biases are likely (confirmation, anchoring, availability)
  • When you need to communicate your reasoning transparently
  • When building on analysis from multiple analysts

Start With the Evidence

The Quality of Information Check is the default first step of any diagnostic run. Before hypotheses are tested or an assessment is written, run /quality-of-information-check on the reports and articles the analysis will rest on. It resolves each one to its originating source, splits it into claims and grades each claim. ach, threat-assessment and writing-assessments prefer graded evidence and run the check themselves when handed raw material.

Skip it when the evidence already arrives as graded evidence items, when there are no documents to grade, or when the user asks to. A skipped check puts those three skills in ungraded mode: the output is labelled as ungraded and confidence is capped at Moderate. Hits in the organisation's own telemetry enter as observations graded "direct, established" (rubric rule R12). Third-party lookup results are rated through source-assessment on the Admiralty scale, which is a separate instrument: the evidence grade applies to claims from documents, and neither is converted into the other.

Technique Categories

Families follow the CIA Tradecraft Primer. The full list, one line per technique with the covering skill or "not in the pack", is in references/when-to-use.md.

Diagnostic Techniques

Purpose: Evaluate existing analysis for quality and bias.

TechniqueWhen to UseSkill
Quality of Information CheckFirst, before any other diagnostic technique. Resolve provenance, split reports into claims, grade each claim, list gapsquality-of-information-check
Key Assumptions CheckBefore or after any major assessment — surface and challenge unstated assumptionskey-assumptions-check
Analysis of Competing HypothesesMultiple plausible explanations — systematically evaluate each against evidenceach
Indicators or Signposts of ChangeWhen monitoring a developing situation — define observable markers of changeNot in the pack. horizon-scanning defines early warning indicators in part

Contrarian Techniques

Purpose: Challenge prevailing judgments and expose blind spots.

TechniqueWhen to UseSkill
Devil's AdvocacyWhen consensus is strong — take the team's own lead judgment and argue it is wrongdevils-advocacy
What-If AnalysisAssume an event has happened and reason back to howNot in the pack
High-Impact / Low-ProbabilityEnsure unlikely but catastrophic scenarios are consideredNot in the pack. Nearest: combine threat-assessment + horizon-scanning
Team A / Team BTwo competing views each deserve a full caseNot in the pack

Imaginative Techniques

Purpose: Generate new ideas, hypotheses, and indicators.

TechniqueWhen to UseSkill
BrainstormingGenerate hypotheses, IOC types to collect, detection approachesNo dedicated skill — apply freely
Scenario DevelopmentExplore multiple futures for strategic planninghorizon-scanning
Indicators GenerationDefine early warning indicators for a scenariohorizon-scanning

Decision Guide: Which Technique?

Are you about to reason from reports or articles? (default first step)
  → Quality of Information Check (quality-of-information-check skill)

Are you evaluating WHO did something?
  → ACH (ach skill)

Are you assessing a THREAT?
  → Threat Assessment (threat-assessment skill)

Are you challenging your OWN analysis?
  → Key Assumptions Check (key-assumptions-check skill)

Are you challenging SOMEONE ELSE's analysis?
  → Devil's Advocacy (devils-advocacy skill)

Are you looking FORWARD (emerging threats)?
  → Horizon Scanning (horizon-scanning skill)

Are you unsure if your evidence is RELIABLE, or where it comes from?
  → Quality of Information Check (quality-of-information-check skill)

Do you need the Admiralty scale DEFINITIONS, or an Admiralty rating for a single lookup result?
  → Source Assessment (source-assessment skill)

Do you have MULTIPLE plausible explanations?
  → ACH (ach skill)

Combining Techniques

For complex assessments, combine techniques:

  1. Quality of Information Check first (grade the evidence before reasoning from it)
  2. Key Assumptions Check (surface your assumptions)
  3. ACH for the core analysis (evaluate hypotheses against the graded claims)
  4. Devil's Advocacy to challenge the result (stress-test conclusions)
  5. Horizon Scanning for forward-looking implications

ach writes its hypotheses before it reads any evidence. When the sequence is run for ACH, state the question first, let ach list the hypotheses, then run the Quality of Information Check.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

AbuseIPDB API reference. IP reputation and abuse report lookups.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

ach

無料

Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Censys API v2 reference. Host reconnaissance and certificate data.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Liberty91LTD のスキルをすべて見る

このスキルの問題を報告する