Cyber Threat Intelligence Skills for each stage of the CTI Lifecycle.
This repository also configures its own agents. See what cti-skills tells them →
Agent Claude Code
Core intelligence analyst. Applies structured analytic techniques, performs threat actor profiling, campaign tracking, and produces analytical judgments. The analytical brain of the platform.
Agent Claude Code
Writes detection rules in SIGMA, YARA, and KQL based on intelligence findings. Translates threat intelligence into actionable detections.
Agent Claude Code
Processes, enriches, deduplicates, and exports IOCs. Creates STIX 2.1 bundles. Manages IOC lifecycle from raw indicators to exportable packages.
Agent Claude Code
Conducts open-source intelligence research using web search and web fetch. The ONLY agent with WebSearch and WebFetch access.
Agent Claude Code
Peer reviews intelligence products for accuracy, analytical rigor, proper sourcing, TLP compliance, and tradecraft quality. The quality gate before dissemination.
Agent Claude Code
Writes finished intelligence products including threat assessments, flash reports, intelligence summaries, and briefings. Applies proper TLP, confidence, and likelihood language.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: