Updated 2w ago
by feedly
skills
CTI resources for Claude, maintained by Feedly
38 GitHub stars (38)
+4 in 30 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | 0 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | +1 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | +1 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | 0 |
| Oct 14 | 0 |
| Oct 15 | 0 |
| Oct 16 | 0 |
| Oct 17 | 0 |
| Oct 18 | 0 |
| Oct 19 | 0 |
| Oct 20 | 0 |
| Oct 21 | 0 |
| Oct 22 | 0 |
| Oct 23 | 0 |
| Oct 24 | +1 |
| Oct 25 | 0 |
| Oct 26 | +1 |
| Oct 27 | 0 |
| Oct 28 | 0 |
| Oct 29 | 0 |
| Oct 30 | 0 |
| Oct 31 | 0 |
| Nov 1 | 0 |
| Nov 2 | 0 |
| Nov 3 | 0 |
| Nov 4 | +1 |
| Nov 5 | 0 |
- 4 skills (4 skills found in its SKILL.md files)
- 4 forks (4 forks)
- 2w ago last update (Last updated 2w ago)
Install
Skills CLI
npx skills add feedly/skills
Asks which skills and agents to install. Just one: npx skills add feedly/skills --skill create-sigma-rule — add -g for every project.
Claude Code
git clone https://github.com/feedly/skillscp -r "skills/skills/create-sigma-rule" ~/.claude/skills/
Copies the create-sigma-rule skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add feedly/skills
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
create-sigma-rule
Turns a threat report, a malware analysis, vendor tool documentation, or a raw log sample into draft Sigma detection rules, validated against sigma-cli where a shell exists and labelled "not machine-validated" where not, each paired with a validation note covering assumptions, false positives, evasion gaps, and a test plan. Reads a saved organizational profile so rules match the team's SIEM backe…
skills/create-sigma-rule/ on GitHub (opens in a new tab)SKILL.md -
cti-risk-reduction-report
Rates a threat against the OWASP Risk Rating Methodology, then rates it again counting only the mitigations that are implemented and verified, and again counting dated commitments, and shows the three states side by side with a financial exposure band sized to the organization. Use this skill whenever the user wants a risk reduction report, wants to score or rate a threat, measure risk before and…
skills/cti-risk-reduction-report/ on GitHub (opens in a new tab)SKILL.md -
intelligence-requirements-builder
Turns a vague, high-level stakeholder ask into a structured set of intelligence requirements for a CTI team, complete with Essential Elements of Information, collection guidance, success criteria, deliverables, and a criticality rating, producing the intelligence requirements set as markdown, as a Word document, and as a CSV intelligence requirements list. Use this skill whenever the user mention…
skills/intelligence-requirements-builder/ on GitHub (opens in a new tab)SKILL.md -
map-attack-techniques
Maps a threat report's narrative behaviour to current MITRE ATT&CK Enterprise and ICS techniques, with verbatim evidence, occurrence status and confidence for every mapping, after offering recommended defaults or a few setup questions; outputs markdown, Word, one Navigator layer per ATT&CK domain, and optional STIX; with the Feedly MCP server connected, optionally compares the mapping with the ac…
skills/map-attack-techniques/ on GitHub (opens in a new tab)SKILL.md
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.