dfirtnt

41 mods across 1 repository, 11 stars between them.

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Diagnose a Huntable CTI Studio eval run through the huntable-cti-studio MCP server. Use when asked to diagnose an eval, explain an extractor miss or over-extraction, analyze an eval bundle, or investigate a subagent failure. Diagnosis is agent-side and uses no server-side LLM provider.

11 3d ago A 72 tokens original MIT

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Retrieve and compare Huntable CTI Studio evaluation runs, article eval bundles, and workflow traces through MCP. Use this whenever the user mentions eval bundles, eval runs, config selectors such as v5139a/v5139b, article evaluation traces, CmdlineExtract evaluation, or comparing replicate runs. Start with the…

11 3d ago A 89 tokens original MIT

contract-guardian

03

dfirtnt/Huntable-CTI-Studio

Agent Claude Code

Reviews schema, config, migration, prompt, and preset changes for drift against this repo's contract sources of truth (src/database/models.py, src/config/workflowconfigschema.py, docs/contracts/.md). Use PROACTIVELY before committing any change that touches models.py, workflowconfigschema.py, scripts/migrate…

11 3d ago A 95 tokens original MIT

security-reviewer

04

dfirtnt/Huntable-CTI-Studio

Agent Claude Code

Adversarial security review of changes touching authentication, authorization, audit logging, session/CSRF handling, scraper ingestion (SSRF surface), deserialization (pickle/joblib/yaml), or SQL construction. Use PROACTIVELY before committing changes in src/web/ auth/session code, auditservice, scraper/OCR ingestion…

11 3d ago A 93 tokens original MIT

PreToolUse

05

dfirtnt/Huntable-CTI-Studio

Hook Claude Code

Runs before the agent uses a tool for Edit and Write tool calls, running an inline shell check. From dfirtnt/Huntable-CTI-Studio.

11 3d ago A tokens not measured original MIT

PostToolUse

06

dfirtnt/Huntable-CTI-Studio

Hook Claude Code

Runs after a tool call finishes for Edit and Write tool calls, running an inline shell check. From dfirtnt/Huntable-CTI-Studio.

11 3d ago A tokens not measured original MIT

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Add a new extraction sub-agent to Huntable CTI Studio as a first-class peer of CmdlineExtract, ProcTreeExtract, HuntQueriesExtract, RegistryExtract, ServicesExtract, and ScheduledTasksExtract. Use this skill whenever the user asks to "add a new agent", "create a sub-agent", "wire up a new extractor", "add a new…

11 3d ago A 129 tokens original MIT

add-cloud-model

09

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Register a new OpenAI or Anthropic model in CTI Studio so it appears in the Workflow Agent configuration dropdown. Use this skill whenever the user says "add a model", "make gpt-X available", "why isn't model X in the dropdown", "register claude X", "add support for o4", "I want to use gpt-5-pro", or anything about…

11 3d ago A 114 tokens original MIT

add-source

10

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Add a new CTI intelligence source to Huntable CTI Studio for article ingestion. Use this skill when the user says "add a source", "add a feed", "new source", "add this blog", "ingest from ", or wants to configure a new RSS/scraping source for the ingestion pipeline.

11 3d ago A 69 tokens original MIT

create-migration

11

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Scaffold, apply, and verify a database schema migration for Huntable CTI Studio following the house pattern (standalone idempotent scripts/migrate.py, NOT Alembic). Use whenever the user asks to "create a migration", "add a column", "add a table", "migrate the schema", "write a migration script", or any schema change…

11 3d ago A 109 tokens original MIT

cut-release

12

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Interactive walkthrough for cutting a new release of Huntable CTI Studio. Use this skill whenever the user says "cut a release", "ship a release", "tag a version", "bump the version", "new release", "do the release", "release vX.Y.Z", "ship v5.4.0", "time to release", or otherwise signals they want to move code from…

11 3d ago A 136 tokens original MIT

eval-fixture-audit

13

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Audit and correct the eval fixtures (Eval1 expected counts + Eval2 ground-truth item lists) for one extractor subagent in Huntable CTI Studio: CmdlineExtract, ProcTreeExtract, RegistryExtract, ServicesExtract, ScheduledTasksExtract, or HuntQueriesExtract. Use this skill whenever the user asks to "audit the evals"…

11 3d ago A 209 tokens original MIT

huntable-doc-trueup

14

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Full weekly documentation audit and fix cycle for Huntable CTI Studio. Scans all .md and /docs files, validates each against the live codebase, applies factual corrections, and produces a triage summary. Use this skill whenever the user says "huntable-doc-trueup", "weekly doc audit", "true-up the docs", "full doc…

11 3d ago C 156 tokens original MIT

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Verify and refresh the model context-window data in CTI Studio against the latest public developer docs from Anthropic and OpenAI. Use this skill whenever the user says "refresh context windows", "are the context windows accurate", "check model context windows", "update MODELCONTEXTTOKENS", "verify the model catalog"…

11 3d ago A 159 tokens original MIT

source-healing

16

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Diagnose and repair troubled CTI intelligence sources in Huntable CTI Studio — sources that ingest 0 articles or rack up recurring fetch failures. Use this skill whenever the user says "heal a source", "fix a broken/failing source", "this source has 0 articles", "why isn't collecting", "diagnose troubled sources"…

11 3d ago A 155 tokens original MIT

sync-prompt-presets

17

dfirtnt/Huntable-CTI-Studio

Skill Claude CodeCodex

Propagate any change under src/prompts/ (agent prompt files, .txt or extensionless) into all 9 quickstart preset JSONs in config/presets/AgentConfigs/quickstart/. Use this EVERY time a prompt file is edited, created, or renamed — editing src/prompts/ alone silently ships stale prompts to anyone who applies a…

11 3d ago A 107 tokens original MIT

context-manager

18

dfirtnt/Huntable-CTI-Studio

Agent Cursor

Design and product context authority for Huntable CTI Studio. Responds to getdesigncontext and similar requests from ui-designer and other agents. Use proactively when any agent requests design context, brand guidelines, or design system details.

11 3d ago A 49 tokens original MIT

dockernoharm

20

dfirtnt/Huntable-CTI-Studio

Cursor rule Cursor

Never docker-compose down -v (preserve volumes); never git commit/push without user confirmation.

11 3d ago A 117 tokens original MIT

lg-workflow

23

dfirtnt/Huntable-CTI-Studio

Cursor rule Cursor

When the user says lg or LG, you must run the full workflow yourself from hygiene through push to the current branch. Do not stop at commit or ask the user to push manually.

11 3d ago A 371 tokens original MIT