# Cyber Detection Validation

Validates defensive controls with paired authorized action and observation evidence...

- Repository: https://github.com/HoangNguyen0403/agent-skills-standard (582 stars)
- Category: Design
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-detection-validation -g -a claude-code -y`
Codex: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-detection-validation -g -a codex -y`
Cursor: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-detection-validation -g -a cursor -y`
Gemini CLI: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-detection-validation -g -a gemini-cli -y`

## Description

Validates defensive controls with paired authorized action and observation evidence, distinguishing blocked, prevented, detected, responded, and telemetry-gap outcomes. Use for purple-team validation design or offline fixture review; not unsanctioned testing or production efficacy claims.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cyber Detection Validation

## **Priority: P0 (CRITICAL)**
No defensive outcome without linked action and observation evidence.

Input: control hypothesis, permitted action, scope/approval, mode (`analysis`, `replay`, `isolated-lab-validation`, `defensive-verification`), entity, window, expected observation, stop condition.
Process: classify active effects (`active: true` for any interaction outside supplied-artifact reasoning; reading supplied events/files is non-active analysis); verify fresh host gate before active actions; capture ActionReceipt and ObservationRecord; enforce transitive binding chain: `ObservationRecord.action_receipt_ref -> ActionReceipt.gate_ref -> GateDecision.request_ref -> ActionRequest`.
Output: purple outcome enum, finding status, evidence references, limitations, stage fidelity, owner.

## Workflow

1. Declare step mode and effects: `analysis`, `replay`, `isolated-lab-validation`, or `defensive-verification`.
2. Preflight host gate for active effects: evaluate ActionRequest and GateDecision immediately before dispatch.
3. Execute bounded action; bind ActionReceipt to correlation key `(run_id, attempt_id, test_id)`.
4. Capture ObservationRecord within defined time window; enforce unique `observation_id` and transitive binding chain.
5. Classify purple defensive outcome: `blocked`, `prevented`, `detected`, `responded`, or `telemetry-gap`.
6. Report stage fidelity: replay reports only exercised stages (e.g., parsing/correlation); lab reports observed sensor/control stages.
7. Run teardown plan; record CleanupResult (`verified-clean`, `residual`, `unverified`, `not-applicable`).

The rest: https://github.com/HoangNguyen0403/agent-skills-standard/blob/HEAD/.agents/skills/cybersecurity/cyber-detection-validation/SKILL.md