跳到正文
cccskills
免费在 GitHub 公开

structured-analytic-techniques

Use when the user asks "which SAT should I use for X?", wants the index of Structured Analytic Techniques, or is choosing between quality-of-information-check, ACH, key-assumptions-check, devils-advocacy, indicators of change, etc. Quality of Information Check is the default first step of any diagnostic run.

中文简介正在准备中。当前显示原文说明。

查看安装方法

包含的文件(2)

  • SKILL.md5.7 KB
  • references/when-to-use.md5.3 KB

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

Structured Analytic Techniques (SATs) Index

SATs are formal methods that externalise analytical thinking, making it transparent, challengeable, and less susceptible to cognitive biases. Choose the right technique based on the analytical challenge.

When to Use SATs

  • When the stakes are high (wrong answer = significant consequence)
  • When multiple plausible explanations exist
  • When cognitive biases are likely (confirmation, anchoring, availability)
  • When you need to communicate your reasoning transparently
  • When building on analysis from multiple analysts

Start With the Evidence

The Quality of Information Check is the default first step of any diagnostic run. Before hypotheses are tested or an assessment is written, run /quality-of-information-check on the reports and articles the analysis will rest on. It resolves each one to its originating source, splits it into claims and grades each claim. ach, threat-assessment and writing-assessments prefer graded evidence and run the check themselves when handed raw material.

Skip it when the evidence already arrives as graded evidence items, when there are no documents to grade, or when the user asks to. A skipped check puts those three skills in ungraded mode: the output is labelled as ungraded and confidence is capped at Moderate. Hits in the organisation's own telemetry enter as observations graded "direct, established" (rubric rule R12). Third-party lookup results are rated through source-assessment on the Admiralty scale, which is a separate instrument: the evidence grade applies to claims from documents, and neither is converted into the other.

Technique Categories

Families follow the CIA Tradecraft Primer. The full list, one line per technique with the covering skill or "not in the pack", is in references/when-to-use.md.

Diagnostic Techniques

Purpose: Evaluate existing analysis for quality and bias.

TechniqueWhen to UseSkill
Quality of Information CheckFirst, before any other diagnostic technique. Resolve provenance, split reports into claims, grade each claim, list gapsquality-of-information-check
Key Assumptions CheckBefore or after any major assessment — surface and challenge unstated assumptionskey-assumptions-check
Analysis of Competing HypothesesMultiple plausible explanations — systematically evaluate each against evidenceach
Indicators or Signposts of ChangeWhen monitoring a developing situation — define observable markers of changeNot in the pack. horizon-scanning defines early warning indicators in part

Contrarian Techniques

Purpose: Challenge prevailing judgments and expose blind spots.

TechniqueWhen to UseSkill
Devil's AdvocacyWhen consensus is strong — take the team's own lead judgment and argue it is wrongdevils-advocacy
What-If AnalysisAssume an event has happened and reason back to howNot in the pack
High-Impact / Low-ProbabilityEnsure unlikely but catastrophic scenarios are consideredNot in the pack. Nearest: combine threat-assessment + horizon-scanning
Team A / Team BTwo competing views each deserve a full caseNot in the pack

Imaginative Techniques

Purpose: Generate new ideas, hypotheses, and indicators.

TechniqueWhen to UseSkill
BrainstormingGenerate hypotheses, IOC types to collect, detection approachesNo dedicated skill — apply freely
Scenario DevelopmentExplore multiple futures for strategic planninghorizon-scanning
Indicators GenerationDefine early warning indicators for a scenariohorizon-scanning

Decision Guide: Which Technique?

Are you about to reason from reports or articles? (default first step)
  → Quality of Information Check (quality-of-information-check skill)

Are you evaluating WHO did something?
  → ACH (ach skill)

Are you assessing a THREAT?
  → Threat Assessment (threat-assessment skill)

Are you challenging your OWN analysis?
  → Key Assumptions Check (key-assumptions-check skill)

Are you challenging SOMEONE ELSE's analysis?
  → Devil's Advocacy (devils-advocacy skill)

Are you looking FORWARD (emerging threats)?
  → Horizon Scanning (horizon-scanning skill)

Are you unsure if your evidence is RELIABLE, or where it comes from?
  → Quality of Information Check (quality-of-information-check skill)

Do you need the Admiralty scale DEFINITIONS, or an Admiralty rating for a single lookup result?
  → Source Assessment (source-assessment skill)

Do you have MULTIPLE plausible explanations?
  → ACH (ach skill)

Combining Techniques

For complex assessments, combine techniques:

  1. Quality of Information Check first (grade the evidence before reasoning from it)
  2. Key Assumptions Check (surface your assumptions)
  3. ACH for the core analysis (evaluate hypotheses against the graded claims)
  4. Devil's Advocacy to challenge the result (stress-test conclusions)
  5. Horizon Scanning for forward-looking implications

ach writes its hypotheses before it reads any evidence. When the sequence is run for ACH, state the question first, let ach list the hypotheses, then run the Quality of Information Check.

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

AbuseIPDB API reference. IP reputation and abuse report lookups.

中文简介正在准备中。当前显示原文说明。

Liberty91LTD/cti-skills272026年9月30日 更新

ach

免费

Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.

中文简介正在准备中。当前显示原文说明。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.

中文简介正在准备中。当前显示原文说明。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.

中文简介正在准备中。当前显示原文说明。

Liberty91LTD/cti-skills272026年9月30日 更新

Censys API v2 reference. Host reconnaissance and certificate data.

中文简介正在准备中。当前显示原文说明。

Liberty91LTD/cti-skills272026年9月30日 更新

Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.

中文简介正在准备中。当前显示原文说明。

Liberty91LTD/cti-skills272026年9月30日 更新

查看 Liberty91LTD 的全部技能

报告此技能的问题