Quality of Information Check.

Structured analytic techniques (SAT) are the methods intelligence analysts use to keep their reasoning objective: write down every possible explanation, test each one against the evidence, check what you are assuming, and check the quality of your information before you rely on it. The skills put those techniques into the AI's workflow so it has to follow them. One of the big problems with relying on AI to do this though, is that it can 'choose' to trust a source, which makes the analysis look rigorous. But in fact it's not. Grading the evidence first, by fixed rules, with every step checkable, is what makes the analysis more reliable.

When you ask how reliable a piece of security news is, the skill works through seven steps in a fixed order. It does not grade before the source is found, and it does not count confirmations after grading.

Every claim is measured against two axes, written as two words. The first word is the access level. It answers: how does the source know this? The second word is the claim support. It answers: what backs this statement?

In the hospital example, what the investigators saw in the systems is "direct, firm". The attribution to a threat actor is "direct, tentative". Both claims come from the same source. The difference is between what a source saw, and what a source concluded. Nobody saw the threat actor actually do it, but the investigators compared the tools and methods with what they know about that group and reached a conclusion. Another investigator with the same evidence could reach a different one, so one source's conclusion is "tentative" at best. To reach "established", any claim needs a second organisation that confirms it from its own evidence. And what the attackers say about how much they stole is "adversary, unverified" until someone else confirms it.

Analysts familiar with the Admiralty scale might wonder why we're not using that here. That's because it works really well for Human Intelligence (HUMINT), but not so well for Threat Intelligence Reporting. The grading we're proposing is a better fit.

In the Admiralty Scale, the letter is the source's track record: how often that source has been right before. Rating a track record takes a history of past claims and outcomes. Nobody keeps that history for hundreds of vendors and news outlets, and without that track record, "usually reliable" means it becomes an impression of a company's reputation, which is a typical analytical bias we're trying to prevent here.

Instead the grading system records what can be read from the report: how the source knows. A report either says "we observed this in our telemetry" or it does not. Two people reading the same report will reach the same answer.

Following the links to the original report, recording who published what, and checking every grade against the limits are done by scripts. The provenance tracing is a plain script, standard library only, and gives the same answer every time.

Deciding what kind of claim a statement is, judging whether an article changed the original wording, and writing the reason for each grade are judgements the AI-model makes. This is tracked and reported in the output, so you can review and check. Every grade is based on evidence, and a script checks that the sentence is really in the report. The grading rules and reasoning are published in the repository.

By default, the skills that test hypotheses and write assessments, /ach, /threat-assessment and /writing-assessments, grade their evidence. You can invoke them with a link, and the check will run before the analysis. You can skip it. The result is then labelled "ungraded" and cannot claim more than moderate confidence. If an indicator later shows up in your own logs, through /lookup-sentinel for example, or your own endpoint tooling, that observation is logged in the claim table as "direct, established": you saw it yourself, so nobody else needs to confirm it. The skill runs from Claude Code, Cursor, Codex or Windsurf, on any article URL, with no API key.