Skill Claude Code
AbuseIPDB API reference. IP reputation and abuse report lookups.
not rated 17 1mo ago A 21 tokens
original MIT
17Stars on the repository
85Mods indexed here, across every type
1mo agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
ach
02Skill Claude Code
Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios.
not rated 17 1mo ago A 29 tokens
original MIT
Skill Claude Code
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the…
not rated 17 1mo ago A 69 tokens
original MIT
Skill Claude Code
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
not rated 17 1mo ago A 67 tokens
original MIT
censys-api
05Skill Claude Code
Censys API v2 reference. Host reconnaissance and certificate data.
not rated 17 1mo ago A 19 tokens
original MIT
Skill Claude Code
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
not rated 17 1mo ago A 71 tokens
original MIT
Skill Claude Code
Use when assigning a confidence level to an analytical judgment, the user asks "how confident are we?" / "what is the confidence on X?", or the orchestrator's tradecraft pipeline calls for a confidence level before publishing. Provides the MISP 0-100 scale and qualitative-band mapping.
not rated 17 1mo ago A 63 tokens
original MIT
Skill Claude Code needs its repo
Use when you need to answer "which attacker techniques do our controls actually stop, and how well?", "what controls should I have for this threat?", or "what telemetry should I collect to detect it?" — joining a customer's or your own security control baseline to ATT&CK techniques using a public, versioned evidence…
not rated 17 1mo ago A 157 tokens
original MIT
Skill Claude Code
CrowdStrike Falcon Intelligence (Intel API) reference. OAuth2 auth, Falcon Query Language, indicator (IOC) lookups, threat-actor entities, intel reports, MITRE ATT&CK mappings, malware families, vulnerabilities, rule sets.
not rated 17 1mo ago A 54 tokens
original MIT
Skill Claude Code
Use when the user asks about the CTI Hyperloop framework, the intelligence lifecycle as a high-tempo loop, or how to map intelligence work across strategic / operational / tactical levels with bidirectional feedback. Liberty91's operational doctrine.
not rated 17 1mo ago A 53 tokens
original MIT
Skill Claude CodeCodex
Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules. Routes to the right investigation or analysis skill, then auto-applies rigor skills (source…
not rated 17 1mo ago A 83 tokens
original MIT
cti-setup
12Skill Claude Code needs its repo
Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and…
not rated 17 1mo ago A 84 tokens
original MIT
Skill Claude Code
Dark web intelligence collection methodology — vendor-first access posture, sourced reference lists for 35+ underground forums and 30+ Telegram channels, OPSEC primer, passive-monitoring strategy, and bundled Python CLIs for onion-indexer search, Telegram channel monitoring, and local keyword matching. Use when the…
not rated 17 1mo ago A 89 tokens
original MIT
Skill Claude CodeCodex
Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot…
not rated 17 1mo ago A 90 tokens
original MIT
Skill Claude Code
Use when the user asks about North Korean state-sponsored cyber operations or specific DPRK actors (Lazarus, APT38, BlueNoroff, Andariel, Kimsuky, etc.), revenue-generation campaigns, IT-worker schemes, or DPRK targeting of cryptocurrency / supply chain. Self-updating knowledge cell.
not rated 17 1mo ago A 75 tokens
original MIT
Skill Claude Code
Feedback loop implementation for continuous CTI improvement. Consumer feedback, analyst retrospectives, source quality tracking.
not rated 17 1mo ago A 24 tokens
original MIT
Skill Claude Code
GreyNoise API reference. Internet scanner/noise classification for IPs.
not rated 17 1mo ago A 19 tokens
original MIT
hacktivism
18Skill Claude Code
Use when the user asks about hacktivist activity (Killnet, NoName057(16), IT Army of Ukraine, Anonymous Sudan, RipperSec, CARR, etc.), DDoS-claiming groups, politically-motivated cyber operations, or wartime cyber-ops chatter. Self-updating knowledge cell.
not rated 17 1mo ago A 72 tokens
original MIT
Skill Claude CodeCodex
Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by…
not rated 17 1mo ago A 87 tokens
original MIT
Skill Claude Code
Use when the user asks "what is coming next?", wants strategic forecasting, or is hunting weak signals of emerging threats before they materialise. Covers signal identification, trend analysis, and scenario development.
not rated 17 1mo ago A 44 tokens
original MIT
Skill Claude Code needs its repo
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete /lookup- commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else…
not rated 17 1mo ago A 103 tokens
original MIT
infostealers
22Skill Claude Code
Use when the user asks about infostealer families (LummaC2, RedLine, Vidar, Stealc, Raccoon, Rhadamanthys, etc.), log marketplaces (Russian Market, Genesis successors, BidenCash, Hudson Rock corpus), or stealer-driven incidents and credential exposure. Self-updating knowledge cell.
not rated 17 1mo ago A 72 tokens
original MIT
Skill Claude Code
Use when the user asks about initial access brokers (IABs), the access-listing market, ransomware-feeding-IAB pipelines, specific broker handles, or how access is priced and packaged. Self-updating knowledge cell.
not rated 17 1mo ago A 51 tokens
original MIT
Skill Claude Code
Use when the user asks about ISAC participation, TAXII feeds, MISP communities, FIRST, STIX-based sharing, or how to publish intelligence externally. Covers sharing models, standards, communities, and TLP-governed dissemination.
not rated 17 1mo ago A 52 tokens
original MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: