cti-skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 75 files.

• abuseipdb-api

  AbuseIPDB API reference. IP reputation and abuse report lookups.

  skills/abuseipdb-api/SKILL.md on GitHub (opens in a new tab)

• ach

  Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios.

  skills/ach/SKILL.md on GitHub (opens in a new tab)

• campaign-tracking

  Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.

  skills/campaign-tracking/SKILL.md on GitHub (opens in a new tab)

• carding-financial-fraud

  Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.

  skills/carding-financial-fraud/SKILL.md on GitHub (opens in a new tab)

• censys-api

  Censys API v2 reference. Host reconnaissance and certificate data.

  skills/censys-api/SKILL.md on GitHub (opens in a new tab)

• china-cyber-espionage

  Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.

  skills/china-cyber-espionage/SKILL.md on GitHub (opens in a new tab)

• confidence-levels

  Use when assigning a confidence level to an analytical judgment, the user asks "how confident are we?" / "what is the confidence on X?", or the orchestrator's tradecraft pipeline calls for a confidence level before publishing. Provides the MISP 0-100 scale and qualitative-band mapping.

  skills/confidence-levels/SKILL.md on GitHub (opens in a new tab)

• control-coverage-mapping

  Use when you need to answer "which attacker techniques do our controls actually stop, and how well?", "what controls should I have for this threat?", or "what telemetry should I collect to detect it?" — joining a customer's or your own security control baseline to ATT&CK techniques using a public, versioned evidence base of 9,545 control-to-technique mappings from six sources. Produces four ranke…

  skills/control-coverage-mapping/SKILL.md on GitHub (opens in a new tab)

• crowdstrike-api

  CrowdStrike Falcon Intelligence (Intel API) reference. OAuth2 auth, Falcon Query Language, indicator (IOC) lookups, threat-actor entities, intel reports, MITRE ATT&CK mappings, malware families, vulnerabilities, rule sets.

  skills/crowdstrike-api/SKILL.md on GitHub (opens in a new tab)

• cti-hyperloop

  Use when the user asks about the CTI Hyperloop framework, the intelligence lifecycle as a high-tempo loop, or how to map intelligence work across strategic / operational / tactical levels with bidirectional feedback. Liberty91's operational doctrine.

  skills/cti-hyperloop/SKILL.md on GitHub (opens in a new tab)

• cti-orchestrator

  Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules. Routes to the right investigation or analysis skill, then auto-applies rigor skills (source rating, TLP, confidence, likelihood) on the output.

  skills/cti-orchestrator/SKILL.md on GitHub (opens in a new tab)

• cti-setup

  Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.

  skills/cti-setup/SKILL.md on GitHub (opens in a new tab)

• darkweb-collection

  Dark web intelligence collection methodology — vendor-first access posture, sourced reference lists for 35+ underground forums and 30+ Telegram channels, OPSEC primer, passive-monitoring strategy, and bundled Python CLIs for onion-indexer search, Telegram channel monitoring, and local keyword matching. Use when the user wants to design or run dark-web collection, build a selector list, pick a ven…

  skills/darkweb-collection/SKILL.md on GitHub (opens in a new tab)

• domain-investigation

  Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.

  skills/domain-investigation/SKILL.md on GitHub (opens in a new tab)

• dprk-cyber-espionage

  Use when the user asks about North Korean state-sponsored cyber operations or specific DPRK actors (Lazarus, APT38, BlueNoroff, Andariel, Kimsuky, etc.), revenue-generation campaigns, IT-worker schemes, or DPRK targeting of cryptocurrency / supply chain. Self-updating knowledge cell.

  skills/dprk-cyber-espionage/SKILL.md on GitHub (opens in a new tab)

• feedback-loops

  Feedback loop implementation for continuous CTI improvement. Consumer feedback, analyst retrospectives, source quality tracking.

  skills/feedback-loops/SKILL.md on GitHub (opens in a new tab)

• greynoise-api

  GreyNoise API reference. Internet scanner/noise classification for IPs.

  skills/greynoise-api/SKILL.md on GitHub (opens in a new tab)

• hacktivism

  Use when the user asks about hacktivist activity (Killnet, NoName057(16), IT Army of Ukraine, Anonymous Sudan, RipperSec, CARR, etc.), DDoS-claiming groups, politically-motivated cyber operations, or wartime cyber-ops chatter. Self-updating knowledge cell.

  skills/hacktivism/SKILL.md on GitHub (opens in a new tab)

• hash-investigation

  Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.

  skills/hash-investigation/SKILL.md on GitHub (opens in a new tab)

• horizon-scanning

  Use when the user asks "what is coming next?", wants strategic forecasting, or is hunting weak signals of emerging threats before they materialise. Covers signal identification, trend analysis, and scenario development.

  skills/horizon-scanning/SKILL.md on GitHub (opens in a new tab)

• indicator-pivoting

  Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a si…

  skills/indicator-pivoting/SKILL.md on GitHub (opens in a new tab)

• infostealers

  Use when the user asks about infostealer families (LummaC2, RedLine, Vidar, Stealc, Raccoon, Rhadamanthys, etc.), log marketplaces (Russian Market, Genesis successors, BidenCash, Hudson Rock corpus), or stealer-driven incidents and credential exposure. Self-updating knowledge cell.

  skills/infostealers/SKILL.md on GitHub (opens in a new tab)

• initial-access-brokers

  Use when the user asks about initial access brokers (IABs), the access-listing market, ransomware-feeding-IAB pipelines, specific broker handles, or how access is priced and packaged. Self-updating knowledge cell.

  skills/initial-access-brokers/SKILL.md on GitHub (opens in a new tab)

• intelligence-sharing

  Use when the user asks about ISAC participation, TAXII feeds, MISP communities, FIRST, STIX-based sharing, or how to publish intelligence externally. Covers sharing models, standards, communities, and TLP-governed dissemination.

  skills/intelligence-sharing/SKILL.md on GitHub (opens in a new tab)

• intelligence-writing

  Use when writing a finished intelligence product, the user asks for a flash-report / threat-assessment / briefing / FINTEL template, or wants the BLUF + active-voice + clear-sourcing conventions. Covers all product types.

  skills/intelligence-writing/SKILL.md on GitHub (opens in a new tab)

• ioc-enrichment-workflow

  Workflow for enriching raw IOCs. Routes each IOC type to the appropriate /lookup-* skills, optionally correlates against MISP, and synthesises a single enrichment record per indicator. Use when the user has a batch of raw IOCs to process before triage or before pushing into a sharing platform.

  skills/ioc-enrichment-workflow/SKILL.md on GitHub (opens in a new tab)

• ioc-export

  IOC export formats and procedures. CSV, STIX 2.1, OpenIOC, MISP. Handles format conversion and packaging.

  skills/ioc-export/SKILL.md on GitHub (opens in a new tab)

• ip-investigation

  Use when a user asks to investigate, check, enrich, or characterize an IP address (IPv4 or IPv6). Chains VirusTotal, Shodan, AbuseIPDB, GreyNoise, OTX, and optionally Censys in parallel, then consolidates findings and prioritizes follow-up IOCs. Invoked by /cti-orchestrator when the target is an IP.

  skills/ip-investigation/SKILL.md on GitHub (opens in a new tab)

• iran-cyber-espionage

  Use when the user asks about Iranian state-sponsored cyber operations or specific IRGC/MOIS-aligned actors (APT35/Charming Kitten, APT34/OilRig, MuddyWater, Imperial Kitten, etc.), wiper campaigns, or front-group hacktivist clusters (Predatory Sparrow, Handala). Self-updating knowledge cell.

  skills/iran-cyber-espionage/SKILL.md on GitHub (opens in a new tab)

• key-assumptions-check

  Use when surfacing the assumptions underlying an analytical judgment, the user asks "what are we assuming?" / "are these assumptions still valid?", or before publishing a high-impact assessment. Standard SAT applied during major assessments.

  skills/key-assumptions-check/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• awesome-design-skillsby bergside List of 67 awesome DESIGN.md and SKILL.md design skill files for agentic tools like Claude Design, Google Stitch, Codex, Cursor, and other… 3.2k stars
• rufloby ruvnet 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems.… 75.1k stars · 30 skills
• eigentby eigent-ai Eigent: The Open Source Cowork Desktop - Local and Free Alternative to Claude Cowork and Codex 15.6k stars · 6 skills
• claude-code-tipsby ykdojo 45+ tips for getting the most out of Claude Code, from basics to advanced - includes a custom status line script and Claude Code running it… 10.2k stars · 9 skills
• html-anythingby nexu-io ✨ The agentic HTML editor — your local AI agent writes the HTML, you ship it. 🚀 75 Skills × 9 Surfaces (magazine · deck · poster · XHS / tw… 9.1k stars
• Awesome-AIToolsby ikaijua Collection of AI-related utilities. Welcome to submit pull requests /收藏AI相关的实用工具，欢迎提交pull requests 6.2k stars