likelihood-language
Skill35 starsChanged 45 days agoMITView on GitHub
Use when phrasing a forward-looking statement, the user asks "how likely is X?" / "what's the likelihood?", or the tradecraft pipeline applies a probability yardstick to a finished product. Standardised likelihood language across all products.
In this repository79 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- abuseipdb-apiSkill
- achSkill
- campaign-trackingSkill
- carding-financial-fraudSkill
- censys-apiSkill
- china-cyber-espionageSkill
- claim-extractionSkill
- confidence-levelsSkill
- control-coverage-mappingSkill
- crowdstrike-apiSkill
- cti-hyperloopSkill
- cti-orchestratorSkill
- cti-setupSkill
- darkweb-collectionSkill
- devils-advocacySkill
- domain-investigationSkill
- dprk-cyber-espionageSkill
- feedback-loopsSkill
- greynoise-apiSkill
- hacktivismSkill
- hash-investigationSkill
- horizon-scanningSkill
- indicator-pivotingSkill
- infostealersSkill
- initial-access-brokersSkill
- intelligence-sharingSkill
- intelligence-writingSkill
- ioc-enrichment-workflowSkill
- ioc-exportSkill
- ip-investigationSkill
- iran-cyber-espionageSkill
- key-assumptions-checkSkill
- kql-writingSkill
- lookup-abuseipdbSkill
- lookup-censysSkill
- lookup-crowdstrikeSkill
- lookup-greynoiseSkill
- lookup-liberty91Skill
- lookup-mispSkill
- lookup-openctiSkill
- lookup-otxSkill
- lookup-ransomwareliveSkill
- lookup-reversinglabsSkill
- lookup-sentinelSkill
- lookup-shodanSkill
- lookup-urlscanSkill
- lookup-virustotalSkill
- malware-analysisSkill
- maturity-assessmentSkill
- mitre-attackSkill
- osint-methodologySkill
- otx-apiSkill
- phishing-social-engineeringSkill
- pir-managementSkill
- quality-controlSkill
- quality-of-information-checkSkill
- ransomware-ecosystemSkill
- reversinglabs-apiSkill
- The first 60 shown.
The file
We split this skill into the rules it gives an agent
2 rules. About 0 are common, 2 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 11
Every forward-looking assessment (prediction, forecast, risk statement) MUST use standardised likelihood language.
- Distinctive: line 56
If you catch yourself writing informal probabilistic language, map it:
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Likelihood Language — Probability Yardstick
Every forward-looking assessment (prediction, forecast, risk statement) MUST use standardised likelihood language. Never use vague terms like "could", "might", or "may" without mapping them to a probability band.
The Yardstick
| Term | Probability Range | Usage |
| Almost certain | >95% | Use sparingly. Reserved for near-inevitable outcomes with overwhelming evidence. |
| Highly likely | 75-95% | Strong evidence supporting the assessment. Limited plausible alternatives. |
| Likely | 50-75% | The weight of evidence supports this outcome, but meaningful alternatives exist. |
| Realistic possibility | 25-50% | Plausible outcome that cannot be discounted. Evidence is mixed or limited. |
| Unlikely | 15-25% | Possible but not supported by the weight of evidence. |
| Highly unlikely | 5-15% | Very limited evidence suggests this outcome. Most evidence points elsewhere. |
| Remote | <5% | Theoretically possible but requires multiple unlikely conditions to align. |
How to Use
Correct usage
"It is highly likely (75-95%) that the threat actor will shift targeting to the financial sector in Q3, based on observed reconnaissance activity and historical pattern of seasonal targeting shifts."
"There is a realistic possibility (25-50%) that the exploit will be weaponised within 30 days, given the availability of a proof-of-concept but no evidence of active exploitation."
Incorrect usage
"The threat actor might target financial services." ❌ (No probability band) "It could happen in Q3." ❌ (Vague, unquantified) "We think it's likely but also possible that..." ❌ (Contradictory — pick one band)
Combining with Confidence
Likelihood and confidence are independent dimensions:
"We assess with moderate confidence that it is likely (50-75%) that Group X will conduct destructive operations against energy sector targets in the next 6 months."
- Moderate confidence: We have some evidence but key assumptions are not fully validated
- Likely: Based on available evidence, the probability falls in the 50-75% range
A low-confidence assessment CAN have a high likelihood term — it means "if our assessment is correct, the probability is high, but we're not fully sure our assessment is correct."
When NOT to Use Likelihood Language
- Statements of fact: "APT28 used Fancy Bear malware in this campaign" — this is a factual claim, not a prediction. Use confidence levels instead.
- Historical analysis: "The campaign began in January 2025" — past events don't need likelihood language.
- Definitions and descriptions: "SIGMA rules are detection rules written in YAML" — informational, not predictive.
Mapping Informal Language
If you catch yourself writing informal probabilistic language, map it:
| Informal | Map to |
| "could", "may", "might" | Determine which band and use proper term |
| "probably" | Likely (50-75%) or Highly likely (75-95%) |
| "possibly" | Realistic possibility (25-50%) |
| "unlikely" | Already a valid term — check it maps to 15-25% |
| "almost certainly" | Almost certain (>95%) |
| "there's a chance" | Determine probability and use proper term |
| "can't rule out" | Realistic possibility (25-50%) or Unlikely (15-25%) |
Common Mistakes
- Using multiple likelihood terms in one assessment ("likely or highly likely") — commit to one
- Hedging with "possible" instead of making a judgment — if evidence is weak, say "unlikely" with rationale
- Forgetting to include the percentage range in parentheses — always include for clarity
- Confusing likelihood with confidence (see confidence-levels skill)
- Using "almost certain" casually — this is >95% and should be rare
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

