Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Liberty91LTD/cti-skills --skill campaign-trackinggit clone --depth 1 https://github.com/Liberty91LTD/cti-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liberty91ltd/cti-skills/campaign-tracking)<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/campaign-tracking"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/campaign-tracking/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/campaign-tracking"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/campaign-tracking.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.01591 |
| Opus 5 | $0.00034 | $0.00796 |
| Sonnet 5 | $0.00014 | $0.00318 |
| Haiku 4.5 | $0.00007 | $0.00159 |
Grade A, and why
campaign-tracking scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Campaign Tracking
A campaign is a coordinated set of malicious activities carried out by a threat actor against specific targets over a defined period.
Campaign Template
## Campaign: [Campaign ID / Name]
### Overview
| Field | Value |
|-------|-------|
| **Campaign ID** | CAMP-YYYY-MM-XXX |
| **Name** | [Descriptive name if known] |
| **Status** | Active / Dormant / Concluded |
| **First observed** | YYYY-MM-DD |
| **Last observed** | YYYY-MM-DD |
| **Attribution** | [Actor — with confidence level] |
| **Motivation** | [Espionage / Financial / Destruction / Hacktivism] |
### Timeline
| Date | Event | Source |
|------|-------|--------|
| YYYY-MM-DD | Initial delivery emails sent | Internal telemetry |
| YYYY-MM-DD | First successful compromise | Vendor report (B2) |
| YYYY-MM-DD | Lateral movement detected | SOC alert |
| YYYY-MM-DD | Data exfiltration observed | Network forensics |
### Attribution
[Assessment of who is behind this campaign, with confidence level. Reference threat actor profile if available.]
### Victimology
- **Sectors targeted**: [List]
- **Geographies**: [Countries/regions]
- **Number of known victims**: [Count with confidence]
- **Selection criteria**: [How were targets chosen? Opportunistic vs targeted?]
- **Common characteristics**: [What do victims have in common?]
### Attack Chain (Kill Chain / ATT&CK)
| Phase | Technique (ATT&CK) | Details |
|-------|-------------------|---------|
| Reconnaissance | T1598 Phishing for Information | Targeted LinkedIn messages to identify employees |
| Initial Access | T1566.001 Spearphishing Attachment | Malicious Word doc with macro |
| Execution | T1059.001 PowerShell | Macro downloads PowerShell stager |
| Persistence | T1547.001 Registry Run Keys | Run key added for backdoor |
| C2 | T1071.001 Application Layer Protocol | HTTPS to legitimate cloud service |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Data uploaded to attacker-controlled cloud |
### Diamond Model
| Vertex | Details |
|--------|---------|
| **Adversary** | [Threat actor / group — reference profile] |
| **Capability** | [Malware, exploits, tools, techniques used] |
| **Infrastructure** | [C2 servers, staging, delivery infrastructure, domains] |
| **Victim** | [Targeted organisations, sectors, systems] |
**Meta-features:**
- **Direction**: [Adversary-to-Victim / Victim-to-Adversary / Bidirectional]
- **Methodology**: [Attack phases and progression]
- **Resources**: [Level of investment observed]
- **Social-Political**: [Geopolitical context driving the campaign]
- **Technology**: [Technology landscape enabling the campaign]
### IOC Clusters
#### Delivery Infrastructure
| Type | Value | First Seen | Status |
|------|-------|-----------|--------|
| Domain | phishing.example.com | 2026-01-15 | Active |
| IP | 203.0.113.42 | 2026-01-15 | Active |
#### C2 Infrastructure
| Type | Value | First Seen | Status |
|------|-------|-----------|--------|
| Domain | c2.badactor.net | 2026-01-20 | Active |
| IP | 198.51.100.10 | 2026-01-20 | Active |
#### Malware
| Hash (SHA-256) | Name | Type | First Seen |
|----------------|------|------|-----------|
| abc123... | loader.dll | Loader | 2026-01-15 |
### TTP Evolution During Campaign
[How have the attackers adapted? Changed tools? Modified techniques? Responded to detection?]
### Detection Guidance
[Reference to SIGMA/YARA/KQL rules created for this campaign. Link to data/detection-rules/.]
### Intelligence Gaps
[What we still don't know about this campaign]
### Sources
| Date | Source | Reliability | Key Finding |
|------|--------|-------------|-------------|
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 129 lines · 69 tokens per session scan A 8e9408e0d387
campaign-tracking is a skill published in the GitHub repository Liberty91LTD/cti-skills (18 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 1,591 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ai-ab-testing
An AI-assisted guide for designing A/B tests, which compare two versions to see which performs better. The description gives no further details about its operation.
ai-accessibility
A Chinese-language assistant for diagnosing accessibility and ease-of-use problems in a page or service. Accessibility means making digital products usable by people with different abilities and needs.
ai-account-research-sales-card
A sales-growth assistant for understanding why a customer is not moving a deal forward. It uses the information you provide to organize the situation and recommend actions.
ai-account-research
A customer-research assistant for breaking down a potential customer and deciding how to approach them. It uses the materials you provide to shape a sales plan.
ai-ad-copy-compliance-review
A risk-review assistant for advertising and sales copy. It examines provided material for possible concerns and suggests actions.
ai-ad-creative
An advertising-creative review assistant for assessing whether an ad idea is likely to attract attention. It examines the material you provide and suggests improvements.