AbuseIPDB API reference. IP reputation and abuse report lookups.
中文简介正在准备中。当前显示原文说明。
Use when the user asks "which SAT should I use for X?", wants the index of Structured Analytic Techniques, or is choosing between quality-of-information-check, ACH, key-assumptions-check, devils-advocacy, indicators of change, etc. Quality of Information Check is the default first step of any diagnostic run.
中文简介正在准备中。当前显示原文说明。
查看安装方法安装前可以查看交给 AI 代理的指令内容。
SATs are formal methods that externalise analytical thinking, making it transparent, challengeable, and less susceptible to cognitive biases. Choose the right technique based on the analytical challenge.
The Quality of Information Check is the default first step of any diagnostic run. Before hypotheses are tested or an assessment is written, run /quality-of-information-check on the reports and articles the analysis will rest on. It resolves each one to its originating source, splits it into claims and grades each claim. ach, threat-assessment and writing-assessments prefer graded evidence and run the check themselves when handed raw material.
Skip it when the evidence already arrives as graded evidence items, when there are no documents to grade, or when the user asks to. A skipped check puts those three skills in ungraded mode: the output is labelled as ungraded and confidence is capped at Moderate. Hits in the organisation's own telemetry enter as observations graded "direct, established" (rubric rule R12). Third-party lookup results are rated through source-assessment on the Admiralty scale, which is a separate instrument: the evidence grade applies to claims from documents, and neither is converted into the other.
Families follow the CIA Tradecraft Primer. The full list, one line per technique with the covering skill or "not in the pack", is in references/when-to-use.md.
Purpose: Evaluate existing analysis for quality and bias.
| Technique | When to Use | Skill |
|---|---|---|
| Quality of Information Check | First, before any other diagnostic technique. Resolve provenance, split reports into claims, grade each claim, list gaps | quality-of-information-check |
| Key Assumptions Check | Before or after any major assessment — surface and challenge unstated assumptions | key-assumptions-check |
| Analysis of Competing Hypotheses | Multiple plausible explanations — systematically evaluate each against evidence | ach |
| Indicators or Signposts of Change | When monitoring a developing situation — define observable markers of change | Not in the pack. horizon-scanning defines early warning indicators in part |
Purpose: Challenge prevailing judgments and expose blind spots.
| Technique | When to Use | Skill |
|---|---|---|
| Devil's Advocacy | When consensus is strong — take the team's own lead judgment and argue it is wrong | devils-advocacy |
| What-If Analysis | Assume an event has happened and reason back to how | Not in the pack |
| High-Impact / Low-Probability | Ensure unlikely but catastrophic scenarios are considered | Not in the pack. Nearest: combine threat-assessment + horizon-scanning |
| Team A / Team B | Two competing views each deserve a full case | Not in the pack |
Purpose: Generate new ideas, hypotheses, and indicators.
| Technique | When to Use | Skill |
|---|---|---|
| Brainstorming | Generate hypotheses, IOC types to collect, detection approaches | No dedicated skill — apply freely |
| Scenario Development | Explore multiple futures for strategic planning | horizon-scanning |
| Indicators Generation | Define early warning indicators for a scenario | horizon-scanning |
Are you about to reason from reports or articles? (default first step)
→ Quality of Information Check (quality-of-information-check skill)
Are you evaluating WHO did something?
→ ACH (ach skill)
Are you assessing a THREAT?
→ Threat Assessment (threat-assessment skill)
Are you challenging your OWN analysis?
→ Key Assumptions Check (key-assumptions-check skill)
Are you challenging SOMEONE ELSE's analysis?
→ Devil's Advocacy (devils-advocacy skill)
Are you looking FORWARD (emerging threats)?
→ Horizon Scanning (horizon-scanning skill)
Are you unsure if your evidence is RELIABLE, or where it comes from?
→ Quality of Information Check (quality-of-information-check skill)
Do you need the Admiralty scale DEFINITIONS, or an Admiralty rating for a single lookup result?
→ Source Assessment (source-assessment skill)
Do you have MULTIPLE plausible explanations?
→ ACH (ach skill)
For complex assessments, combine techniques:
ach writes its hypotheses before it reads any evidence. When the sequence is run for ACH, state the question first, let ach list the hypotheses, then run the Quality of Information Check.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
AbuseIPDB API reference. IP reputation and abuse report lookups.
中文简介正在准备中。当前显示原文说明。
Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
中文简介正在准备中。当前显示原文说明。
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
中文简介正在准备中。当前显示原文说明。
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。
Censys API v2 reference. Host reconnaissance and certificate data.
中文简介正在准备中。当前显示原文说明。
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
中文简介正在准备中。当前显示原文说明。