본문으로 건너뛰기
cccskills
무료GitHub에 공개

structured-analytic-techniques

Use when the user asks "which SAT should I use for X?", wants the index of Structured Analytic Techniques, or is choosing between quality-of-information-check, ACH, key-assumptions-check, devils-advocacy, indicators of change, etc. Quality of Information Check is the default first step of any diagnostic run.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

설치 방법 보기

포함된 파일(2)

  • SKILL.md5.7 KB
  • references/when-to-use.md5.3 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Structured Analytic Techniques (SATs) Index

SATs are formal methods that externalise analytical thinking, making it transparent, challengeable, and less susceptible to cognitive biases. Choose the right technique based on the analytical challenge.

When to Use SATs

  • When the stakes are high (wrong answer = significant consequence)
  • When multiple plausible explanations exist
  • When cognitive biases are likely (confirmation, anchoring, availability)
  • When you need to communicate your reasoning transparently
  • When building on analysis from multiple analysts

Start With the Evidence

The Quality of Information Check is the default first step of any diagnostic run. Before hypotheses are tested or an assessment is written, run /quality-of-information-check on the reports and articles the analysis will rest on. It resolves each one to its originating source, splits it into claims and grades each claim. ach, threat-assessment and writing-assessments prefer graded evidence and run the check themselves when handed raw material.

Skip it when the evidence already arrives as graded evidence items, when there are no documents to grade, or when the user asks to. A skipped check puts those three skills in ungraded mode: the output is labelled as ungraded and confidence is capped at Moderate. Hits in the organisation's own telemetry enter as observations graded "direct, established" (rubric rule R12). Third-party lookup results are rated through source-assessment on the Admiralty scale, which is a separate instrument: the evidence grade applies to claims from documents, and neither is converted into the other.

Technique Categories

Families follow the CIA Tradecraft Primer. The full list, one line per technique with the covering skill or "not in the pack", is in references/when-to-use.md.

Diagnostic Techniques

Purpose: Evaluate existing analysis for quality and bias.

TechniqueWhen to UseSkill
Quality of Information CheckFirst, before any other diagnostic technique. Resolve provenance, split reports into claims, grade each claim, list gapsquality-of-information-check
Key Assumptions CheckBefore or after any major assessment — surface and challenge unstated assumptionskey-assumptions-check
Analysis of Competing HypothesesMultiple plausible explanations — systematically evaluate each against evidenceach
Indicators or Signposts of ChangeWhen monitoring a developing situation — define observable markers of changeNot in the pack. horizon-scanning defines early warning indicators in part

Contrarian Techniques

Purpose: Challenge prevailing judgments and expose blind spots.

TechniqueWhen to UseSkill
Devil's AdvocacyWhen consensus is strong — take the team's own lead judgment and argue it is wrongdevils-advocacy
What-If AnalysisAssume an event has happened and reason back to howNot in the pack
High-Impact / Low-ProbabilityEnsure unlikely but catastrophic scenarios are consideredNot in the pack. Nearest: combine threat-assessment + horizon-scanning
Team A / Team BTwo competing views each deserve a full caseNot in the pack

Imaginative Techniques

Purpose: Generate new ideas, hypotheses, and indicators.

TechniqueWhen to UseSkill
BrainstormingGenerate hypotheses, IOC types to collect, detection approachesNo dedicated skill — apply freely
Scenario DevelopmentExplore multiple futures for strategic planninghorizon-scanning
Indicators GenerationDefine early warning indicators for a scenariohorizon-scanning

Decision Guide: Which Technique?

Are you about to reason from reports or articles? (default first step)
  → Quality of Information Check (quality-of-information-check skill)

Are you evaluating WHO did something?
  → ACH (ach skill)

Are you assessing a THREAT?
  → Threat Assessment (threat-assessment skill)

Are you challenging your OWN analysis?
  → Key Assumptions Check (key-assumptions-check skill)

Are you challenging SOMEONE ELSE's analysis?
  → Devil's Advocacy (devils-advocacy skill)

Are you looking FORWARD (emerging threats)?
  → Horizon Scanning (horizon-scanning skill)

Are you unsure if your evidence is RELIABLE, or where it comes from?
  → Quality of Information Check (quality-of-information-check skill)

Do you need the Admiralty scale DEFINITIONS, or an Admiralty rating for a single lookup result?
  → Source Assessment (source-assessment skill)

Do you have MULTIPLE plausible explanations?
  → ACH (ach skill)

Combining Techniques

For complex assessments, combine techniques:

  1. Quality of Information Check first (grade the evidence before reasoning from it)
  2. Key Assumptions Check (surface your assumptions)
  3. ACH for the core analysis (evaluate hypotheses against the graded claims)
  4. Devil's Advocacy to challenge the result (stress-test conclusions)
  5. Horizon Scanning for forward-looking implications

ach writes its hypotheses before it reads any evidence. When the sequence is run for ACH, state the question first, let ach list the hypotheses, then run the Quality of Information Check.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

AbuseIPDB API reference. IP reputation and abuse report lookups.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Liberty91LTD/cti-skills272026년 9월 30일 업데이트

ach

무료

Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Liberty91LTD/cti-skills272026년 9월 30일 업데이트

Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Liberty91LTD/cti-skills272026년 9월 30일 업데이트

Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Liberty91LTD/cti-skills272026년 9월 30일 업데이트

Censys API v2 reference. Host reconnaissance and certificate data.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Liberty91LTD/cti-skills272026년 9월 30일 업데이트

Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Liberty91LTD/cti-skills272026년 9월 30일 업데이트

Liberty91LTD의 스킬 모두 보기

이 스킬의 문제 신고