How do I install the Planning Validation Testing skill?

Run npx skillmds@latest add iimp0ster/planning-validation-testing in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Planning Validation Testing safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Planning Validation Testing?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Planning Validation Testing free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Planning Validation Testing?

iimp0ster (@iimp0ster) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Planning Validation Testing by iimp0ster

Name: Planning Validation Testing
Rating: 4.2 (5 reviews)
Author: iimp0ster

Planning Validation Testing

Designs a comprehensive testing approach to validate detection effectiveness. Produces positive and negative test procedures, an evaluation metrics framework, an Atomic Red Team test plan, and an iterative tuning strategy. Use after detection logic is designed to plan how to verify the detection fires correctly and doesn't produce excessive false positives.

iimp0ster Updated Sep 22, 2026

File contents

Planning Validation & Testing

Inputs:

Detection logic from Skill 4
Detection hypothesis from Skill 2
Available testing infrastructure (lab, prod data, simulation tools)

Workflow steps:

Design positive validation tests - Create malicious behavior simulation plan:
- Atomic tests: Simple command-line reproduction steps
- Tool-based tests: Using Atomic Red Team, Invoke-AtomicRedTeam, Caldera, or similar
- Manual procedures: Step-by-step instructions for lab execution
- Expected telemetry: Exact events/fields that should appear
- Detection trigger criteria: What the rule should match
Design negative validation tests - Create benign behavior test cases:
- Common administrative tasks that resemble attack
- Legitimate tools with similar signatures
- Normal user workflows in target environment
- Expected behavior: Detection should NOT trigger
Plan historical data analysis - If production data available:
- Retrospective query approach (search last 30/60/90 days)
- Baseline false positive rate estimation
- Pattern frequency analysis
- Sample size requirements for statistical confidence
Define evaluation metrics - Establish measurement criteria:
- Precision: True Positives / (True Positives + False Positives)
- Recall: Coverage of known attack variants
- Alert volume: Expected alerts per day/week
- Detection latency: Time from event to alert
- Investigation effort: Average time to triage

Create test execution matrix - Document test scenarios:

| Test ID | Type | Procedure | Expected Result | Pass/Fail Criteria |

Plan iterative tuning - Define refinement process:
- Initial deployment mode (monitor-only vs. active alerting)
- Tuning feedback loop (analyst input, FP patterns)
- Threshold adjustment approach
- Documentation of rule changes

Outputs: Validation plan document containing:

Positive test procedures (malicious simulation)
Negative test cases (benign scenarios)
Historical analysis approach
Evaluation metrics and targets
Test execution matrix
Tuning and refinement plan
Tools and commands for testing

References:

Atomic Red Team test library
MITRE ATT&CK Evaluations methodology
Detection validation frameworks (DeTTECT, ATT&CK Navigator)

---name: planning-validation-testingdescription: Designs a comprehensive testing approach to validate detection effectiveness. Produces positive and negative test procedures, an evaluation metrics framework, an Atomic Red Team test plan, and an iterative tuning strategy. Use after detection logic is designed to plan how to verify the detection fires correctly and doesn't produce excessive false positives.---# Planning Validation & Testing**Inputs:**- Detection logic from Skill 4- Detection hypothesis from Skill 2- Available testing infrastructure (lab, prod data, simulation tools)**Workflow steps:**1. **Design positive validation tests** - Create malicious behavior simulation plan: - **Atomic tests:** Simple command-line reproduction steps - **Tool-based tests:** Using Atomic Red Team, Invoke-AtomicRedTeam, Caldera, or similar - **Manual procedures:** Step-by-step instructions for lab execution - **Expected telemetry:** Exact events/fields that should appear - **Detection trigger criteria:** What the rule should match2. **Design negative validation tests** - Create benign behavior test cases: - Common administrative tasks that resemble attack - Legitimate tools with similar signatures - Normal user workflows in target environment - Expected behavior: Detection should NOT trigger3. **Plan historical data analysis** - If production data available: - Retrospective query approach (search last 30/60/90 days) - Baseline false positive rate estimation - Pattern frequency analysis - Sample size requirements for statistical confidence4. **Define evaluation metrics** - Establish measurement criteria: - **Precision:** True Positives / (True Positives + False Positives) - **Recall:** Coverage of known attack variants - **Alert volume:** Expected alerts per day/week - **Detection latency:** Time from event to alert - **Investigation effort:** Average time to triage5. **Create test execution matrix** - Document test scenarios: ``` | Test ID | Type | Procedure | Expected Result | Pass/Fail Criteria | ```6. **Plan iterative tuning** - Define refinement process: - Initial deployment mode (monitor-only vs. active alerting) - Tuning feedback loop (analyst input, FP patterns) - Threshold adjustment approach - Documentation of rule changes**Outputs:**Validation plan document containing:- Positive test procedures (malicious simulation)- Negative test cases (benign scenarios)- Historical analysis approach- Evaluation metrics and targets- Test execution matrix- Tuning and refinement plan- Tools and commands for testing**References:**- Atomic Red Team test library- MITRE ATT&CK Evaluations methodology- Detection validation frameworks (DeTTECT, ATT&CK Navigator)

Frequently asked questions