Assess and explain threat

Skill gaelic-ghost/socket/skills/assess-and-explain-threat

Assess whether suspicious evidence indicates a real threat and explain it plainly. Use for confidence, protective actions, uncertainty, impact, and advice after artifact, endpoint, identity, or incident evidence.From its SKILL.md

Install

npx -y skills add gaelic-ghost/socket --skill assess-and-explain-threat

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, as published. Nobody here has run it

Assess And Explain Threat

Overview

Turn mixed evidence into a proportionate conclusion and advice the affected person can follow. Do not collapse signatures, reputation, scanner output, or unusual behavior into a binary safe/malicious verdict.

Read references/confidence-and-advice.md for conclusion vocabulary and the explanation shape.

Workflow

Restate the decision.
- Identify what the user must decide now and what can wait for more evidence.
Grade evidence by directness.
- Separate direct observations, reproducible behaviors, vendor or threat-intelligence claims, weak indicators, absence of findings, and speculation.
- Record contradicting evidence and coverage gaps.
Assess behavior and impact.
- State what access, execution, persistence, collection, credential use, network behavior, or data exposure is observed or technically plausible.
- Distinguish capability from intent and artifact presence from successful compromise.
Choose a calibrated classification.
- Use one classification from the reference and state confidence separately.
- Name the strongest supporting evidence and what would change the conclusion.
Give proportionate advice.
- Put urgent harm-reduction actions first.
- Separate containment, evidence preservation, recovery, credential actions, notification, and long-term hardening.
- Avoid destructive cleanup when evidence is weak and reversible isolation is available.
Give a plain-language explanation.
- Answer whether the concern is dangerous, what it appears to do, what is known versus inferred, what to do now, and when to escalate.
- Define specialist terms at first use and avoid fear-amplifying language.

Output

Return the conclusion, confidence, decisive evidence, contradictions/gaps, immediate actions, follow-up analysis, and a short non-specialist explanation.

What ships with it: 2 files

1.5 KB alongside SKILL.md

agents/

openai.yaml255 B

references/

confidence-and-advice.md1.2 KB

Gives 0 of the 12 instructions most explainers skills give

Counted across 274 of the 289 authors here whose files we hold, read 2026-09-06

Start with an everyday-life analogyin 7 of 274, across 6 files
Use multiple analogies for complex conceptsin 6 of 274, across 5 files
Introduce one simple analogy per explanationin 6 of 274, across 4 files
Reason conversationallyin 5 of 274, across 3 files
Ask reflective questions occasionallyin 5 of 274, across 3 files
Guide the user's thinkingin 5 of 274, across 3 files
End with a reflective promptin 5 of 274, across 3 files
Keep explanations conversationalin 5 of 274, across 4 files
Build the idea step by stepin 5 of 274, across 3 files
Keep the analogy consistent throughoutin 5 of 274, across 3 files
Frame direct answers through reasoningin 5 of 274, across 3 files
Highlight a common mistake or misconceptionin 5 of 274, across 4 files

Said here and by no other author read

Restate the decision.
Grade evidence by directness.
Record contradicting evidence and coverage gaps.
State observed or plausible behavior and impact.
Distinguish capability from intent and presence from compromise.
Choose one classification from the reference.

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.