alert-triage-economics SKILL.md skillA
alert-triage-economics from annatchijova/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add annatchijova/skills/alert-triage-economics@git:20260825.8500180Pins git:20260825.8500180 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- annatchijova/skills
- Path
alert-triage-economics/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260825.8500180, committed Aug 25, 2026
- Size
- 7,951 bytes
- Repository stars
- 9
- License
- a license file GitHub does not identify
Triage a security alert queue by expected loss, not by the severity label the tool stamped — because analyst attention is a scarce, exhaustible resource and a SOC's real failure is not a missed rule but a queue that trains its analysts to dismiss. Use whenever there is a backlog of alerts to prioritize, a "we get 10,000 alerts a day" problem, a decision about which detections to keep, or a claim that a queue is "under control": "which alerts do we work first", "we're drowning in alerts…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Alert Triage Economics A SOC does not fail because a rule was missing. It fails because the alert that mattered arrived into a queue of ten thousand that didn't, worked by analysts the queue had already trained to click *dismiss*. The scarce resource is not detection coverage — it is **analyst attention**, and attention is finite, exhaustible, and spent whether or not the alert was worth it. Triage is the economics of that spend. The severity label the tool stamped is not the priority. "Critical" from a scanner is a statement about the *vulnerability class in the abstract*, made with no knowledge of whether the affected code is reachable, whether the account has any privilege, or whether this is the third identical false positive today. Ranking a queue by that label is ranking by the one number that was computed without looking at your environment. Two failure modes, and the second is the one that actually gets people breached: - **Severity-label theater.** A hundred alerts marked "critical," none rankable against each other, so they get worked top-to-bottom or newest-first — which is to say, not by importance at all. …
Read the whole file at its exact version.
How to install
mdr add annatchijova/skills/alert-triage-economics@sha256:6489c8a78f029048The line at the top of this page pins the label git:20260825.8500180, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_efhs37wly2fg5pzr)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 25, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (7951 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
annatchijova/skills · 9 stars · license a license file GitHub does not identify · pushed 2026-11-02 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_efhs37wly2fg5pzr GET https://markdownregistry.com/api/v1/resolve?ref=annatchijova/skills/alert-triage-economics GET https://markdownregistry.com/api/v1/blob/6489c8a78f029048bc38e7135c19bc2bb2076a43386979ef94f37c64eef4862a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.