# Assess And Explain Threat

> Assess whether suspicious evidence indicates a real threat and explain it plainly. Use for confidence, protective actions, uncertainty, impact, and advice after artifact, endpoint, identity, or incident evidence.

- Skill: `gaelic-ghost/assess-and-explain-threat` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/assess-and-explain-threat`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/assess-and-explain-threat/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/assess-and-explain-threat

---


# Assess And Explain Threat

## Overview

Turn mixed evidence into a proportionate conclusion and advice the affected person can follow. Do not collapse signatures, reputation, scanner output, or unusual behavior into a binary safe/malicious verdict.

Read [references/confidence-and-advice.md](references/confidence-and-advice.md) for conclusion vocabulary and the explanation shape.

## Workflow

1. Restate the decision.
   - Identify what the user must decide now and what can wait for more evidence.

2. Grade evidence by directness.
   - Separate direct observations, reproducible behaviors, vendor or threat-intelligence claims, weak indicators, absence of findings, and speculation.
   - Record contradicting evidence and coverage gaps.

3. Assess behavior and impact.
   - State what access, execution, persistence, collection, credential use, network behavior, or data exposure is observed or technically plausible.
   - Distinguish capability from intent and artifact presence from successful compromise.

4. Choose a calibrated classification.
   - Use one classification from the reference and state confidence separately.
   - Name the strongest supporting evidence and what would change the conclusion.

5. Give proportionate advice.
   - Put urgent harm-reduction actions first.
   - Separate containment, evidence preservation, recovery, credential actions, notification, and long-term hardening.
   - Avoid destructive cleanup when evidence is weak and reversible isolation is available.

6. Give a plain-language explanation.
   - Answer whether the concern is dangerous, what it appears to do, what is known versus inferred, what to do now, and when to escalate.
   - Define specialist terms at first use and avoid fear-amplifying language.

## Output

Return the conclusion, confidence, decisive evidence, contradictions/gaps, immediate actions, follow-up analysis, and a short non-specialist explanation.