SKILLS/ask-questions-if-underspecified/SKILL.md
Clarify requirements before implementing. Use when serious doubts arise.
npx skillsauth add pinkpixel-dev/skills-collection-1 ask-questions-if-underspecifiedInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use this skill when a request has multiple plausible interpretations or key details (objective, scope, constraints, environment, or safety) are unclear.
Do not use this skill when the request is already clear, or when a quick, low-risk discovery read can answer the missing details.
Ask the minimum set of clarifying questions needed to avoid wrong work; do not start implementing until the must-have questions are answered (or the user explicitly approves proceeding with stated assumptions).
Treat a request as underspecified if after exploring how to perform the work, some or all of the following are not clear:
If multiple plausible interpretations exist, assume it is underspecified.
Ask 1-5 questions in the first pass. Prefer questions that eliminate whole branches of work.
Make questions easy to answer:
defaults to accept all recommended/default choices)1b 2a 3c); restate the chosen options in plain language to confirmUntil must-have answers arrive:
If the user explicitly asks you to proceed without answers:
Once you have answers, restate the requirements in 1-3 sentences (including key constraints and what success looks like), then start work.
1) Scope?
a) Minimal change (default)
b) Refactor while touching the area
c) Not sure - use default
2) Compatibility target?
a) Current project defaults (default)
b) Also support older versions: <specify>
c) Not sure - use default
Reply with: defaults (or 1a 2a)
development
Build a systematic threat hunt hypothesis framework that transforms threat intelligence, attack patterns, and environmental data into testable hunting hypotheses.
development
Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.
development
Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.
development
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.