detection/skillsContribute

An open standard, built on Agent Skills

The expertise around your detections, made portable.

A detection is more than the query that fires it. Detection Skills capture the triage, investigation, and tuning that follow — versioned alongside the detection, runnable by any agent, shareable with everyone.

Browse the library Read the spec

Three phases, one loop

Each phase is a skill with a defined contract for what it returns. The human stays in the loop by design.

Triage
decision: escalate | dismiss
Runs on the trigger before it becomes an alert. Decides whether it deserves an analyst's attention — every dismissal logged and reversible.
Investigation
verdict: malicious | suspicious | inconclusive | benign
Runs on escalated alerts with full context. Reaches a real verdict with evidence and reasoning attached, plus recommended actions.
Tuning
action: exclude | include | modify | fork
Closes the loop. Reads the outcome and proposes one concrete change to the detection — for human review, never auto-applied.

Why an open standard?

Most detections aren't unique to your organization — a CloudTrail finding, a SaaS misconfiguration, a known technique. Triage looks much the same everywhere, and no team should have to reinvent it. Community skills cover the commodity work; your private skills cover the detections specific to your organization.

Read the full overview 
# A skill is just a folderimpossible-travel-triage/├── SKILL.md      # metadata + instructions├── references/   # context, prior cases├── assets/       # queries, lookup tables└── scripts/      # enrichment helpers