本文へ移動
cccskills
無料GitHub で公開

key-assumptions-check

Use when surfacing the assumptions underlying an analytical judgment, the user asks "what are we assuming?" / "are these assumptions still valid?", or before publishing a high-impact assessment. Standard SAT applied during major assessments.

インストール方法を見る

含まれるファイル(1)

  • SKILL.md4.9 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Key Assumptions Check

Every analytical judgment rests on assumptions — often unstated. This technique surfaces them and evaluates whether the analysis holds if assumptions are wrong.

Procedure

Step 1: State the Analytical Line

Write the current assessment or conclusion in one clear sentence.

Step 2: List All Assumptions

Brainstorm every assumption underlying the assessment. Include:

  • Assumptions about threat actor intent or capability
  • Assumptions about data completeness or accuracy
  • Assumptions about the relevance of historical patterns
  • Assumptions about the target environment
  • Assumptions about timing or sequencing

Step 3: Walk the Claim Table (when one exists)

If the assessment was built on graded evidence items from /quality-of-information-check, go through the claim table row by row. Assumptions are usually hiding in judgements that the analysis treats as observations. If there is no claim table, skip this step and leave the Claim column as "n/a".

For each claim, compare its claim_type with how the analytical line uses it:

In the claim tableHow the analysis uses itAssumption to record
assessmentStated as fact, or as a premise for a further judgementThat the source's judgement about intent, capability or future behaviour is correct
attributionActor named without the source's hedgeThat the attribution holds. Quote stated_confidence verbatim
actor_claimScale, victim or data figures repeated as factThat the actor is telling the truth
Any type, flagged caveats_dropped_in_chainOutlet's stronger wording usedThat the claim is as strong as the outlet made it, not as the primary wrote it
Any type, flagged single_source or with corroboration uncheckedRelied on without qualificationThat the one primary is right
Any type, flagged stale or supersededUsed as currentThat nothing has changed since publication

Rules:

  • Every assessment and attribution claim with load_bearing: true gets a row in the matrix, even when the assumption looks safe.
  • Carry the claim_id into the matrix. One claim can produce more than one assumption, and an assumption can rest on several claims.
  • Do not regrade claims here. The grade informs the Confidence column: claim support tentative or worse on a claim used as fact is Low or Medium confidence, never High.
  • Assumptions from Step 2 that trace to no claim are kept, with "none" in the Claim column. These have no evidence behind them at all, which is worth stating.

Step 4: Evaluate Each Assumption

AssumptionClaimImportanceConfidenceStatus
[Assumption 1]C01HighHighValidated
[Assumption 2]C04HighLowFLAG
[Assumption 3]noneMediumMediumMonitor
[Assumption 4]C02, C06LowHighAccepted

Importance: How much does the conclusion depend on this assumption?

  • High: If wrong, the conclusion changes significantly
  • Medium: If wrong, the conclusion weakens but may still hold
  • Low: If wrong, the conclusion is largely unaffected

Confidence: How sure are we this assumption is correct?

  • High: Strong evidence supports it
  • Medium: Some evidence, but not fully validated
  • Low: Little or no evidence; assumed by default

Step 5: Flag Critical Assumptions

Any assumption that is High Importance + Low Confidence is critical. These are the assumptions most likely to invalidate your analysis.

Step 6: Determine Impact

For each flagged assumption:

  • What would the conclusion be if this assumption is wrong?
  • Can this assumption be validated through additional collection?
  • Should the confidence level of the overall assessment be lowered?

Output Template

## Key Assumptions Check: [Assessment Title]

### Analytical Line
[The assessment being checked]

### Assumptions Matrix
| # | Assumption | Claim | Claim type | Access level | Claim support | Importance | Confidence | Status |
|---|-----------|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
| 1 | ... | C04 | attribution | indirect | tentative | H/M/L | H/M/L | ... |

### Flagged Assumptions (High Importance + Low/Medium Confidence)
1. **[Assumption]** (C04): If wrong, [impact on conclusion]. Collection gap: [what would validate this].

### Impact on Assessment
[Does the assumptions check change the confidence level? Should the conclusion be qualified?]

### Recommended Actions
- [Validate assumption X through Y collection]
- [Lower confidence from High to Moderate because of assumption Z]

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

AbuseIPDB API reference. IP reputation and abuse report lookups.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

ach

無料

Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Censys API v2 reference. Host reconnaissance and certificate data.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Liberty91LTD/cti-skills272026年9月30日 更新

Liberty91LTD のスキルをすべて見る

このスキルの問題を報告する