Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Liberty91LTD/cti-skillsnpx agentmods add skills/liberty91ltd/cti-skills/cti-setupWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liberty91ltd/cti-skills/cti-setup)<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/cti-setup"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/cti-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/cti-setup"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/cti-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.02494 |
| Opus 5 | $0.00042 | $0.01247 |
| Sonnet 5 | $0.00017 | $0.00499 |
| Haiku 4.5 | $0.00008 | $0.00249 |
Grade A, and why
cti-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cti-setup
In-chat configuration of API keys for the threat-intel integrations bundled with this pack. Use this when the user is in Claude Code and doesn't want to drop to a shell to run ./scripts/setup.sh.
When to invoke
- User asks "how do I set up keys", "configure my API keys", "add a VirusTotal key", etc.
- User runs
/cti-setup - A
lookup-*skill failed because a key is missing and you want to offer to add it - After install via
/plugin marketplace addornpx(no shell setup ran)
What you do
- Check current state. Read
.claude/settings.local.json. If it's missing or has noenvblock, the user has zero keys configured. If it has some, list which are present and which are missing. - Tell the user the menu. Present the services in a table with: name, env variable, free-tier limit, signup URL. Make clear all are optional and that the pack degrades gracefully.
- Ask which to configure. Let the user provide one, several, or all. Don't force them through every prompt.
- Receive the keys. When the user shares a key, treat it as sensitive — do not echo it back in plain text in your response (refer to it as
your VirusTotal keyor the masked tail…<last 4 chars>). - Write the merged file. Use the non-destructive merge below — preserve every other field in
settings.local.json. - Offer to verify. Ask if they want you to dry-run each configured key against its CLI to confirm it's wired up.
- Tell them what's next. "Try
/ip-investigation 8.8.8.8" or similar concrete next command.
The services
| Service | Env variable | Free tier | Signup |
|---|---|---|---|
| Liberty91 (first-party) | LIBERTY91_API_KEY (optional LIBERTY91_API_URL) |
per-key rate limit + monthly credits on your plan | Liberty91 platform → user menu → API Access (Owner/Admin only; the secret is shown once) |
| VirusTotal | VIRUSTOTAL_API_KEY |
4/min, 500/day | virustotal.com → profile → API key |
| URLScan.io | URLSCAN_API_KEY |
100 scans/day | urlscan.io → user settings |
| Shodan | SHODAN_API_KEY |
1 req/sec | account.shodan.io |
| AbuseIPDB | ABUSEIPDB_API_KEY |
1000 checks/day | abuseipdb.com → account → API |
| GreyNoise | GREYNOISE_API_KEY |
50 req/day (community) | viz.greynoise.io → account |
| AlienVault OTX | OTX_API_KEY |
10k req/hour | otx.alienvault.com → settings |
| Censys | CENSYS_PAT |
250 queries/month | accounts.censys.io → settings → personal-access-tokens |
| MISP | MISP_URL + MISP_API_KEY |
self-hosted / org-provided | your MISP instance → My Profile → Auth keys |
| OpenCTI | OPENCTI_URL + OPENCTI_TOKEN |
self-hosted / org-provided | your OpenCTI instance → profile → API access (token) |
| Ransomware.live | RANSOMWARE_LIVE |
3000 req/day (PRO) | my.ransomware.live → free PRO key |
| ReversingLabs A1000 | REVERSINGLABS_USER + REVERSINGLABS_PASSWORD (optional REVERSINGLABS_HOST) |
undocumented; 429+Retry-After | licensed product — issued by your RL admin or RL account team |
| CrowdStrike Falcon Intelligence | CROWDSTRIKE_CLIENT_ID + CROWDSTRIKE_CLIENT_SECRET (optional CROWDSTRIKE_BASE_URL) |
per-tenant; 429+Retry-After | licensed product — Falcon console → Support and resources → API clients and keys (assign Intel read scopes) |
| Microsoft Sentinel | SENTINEL_TENANT_ID + SENTINEL_CLIENT_ID + SENTINEL_CLIENT_SECRET + SENTINEL_WORKSPACE_ID |
your Azure tenancy (query API is free; 200 queries/30s) | Azure portal — Entra ID app registration + Log Analytics Reader role; walkthrough in tools/integrations/sentinel.md |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 129 lines · 84 tokens per session scan A a25eec5622a5
cti-setup is a skill published in the GitHub repository Liberty91LTD/cti-skills (18 stars, last pushed 1mo ago), licensed MIT. It adds 84 tokens to every session and 2,494 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ai-ab-testing
An AI-assisted guide for designing A/B tests, which compare two versions to see which performs better. The description gives no further details about its operation.
ai-accessibility
A Chinese-language assistant for diagnosing accessibility and ease-of-use problems in a page or service. Accessibility means making digital products usable by people with different abilities and needs.
ai-account-research-sales-card
A sales-growth assistant for understanding why a customer is not moving a deal forward. It uses the information you provide to organize the situation and recommend actions.
ai-account-research
A customer-research assistant for breaking down a potential customer and deciding how to approach them. It uses the materials you provide to shape a sales plan.
ai-ad-copy-compliance-review
A risk-review assistant for advertising and sales copy. It examines provided material for possible concerns and suggests actions.
ai-ad-creative
An advertising-creative review assistant for assessing whether an ad idea is likely to attract attention. It examines the material you provide and suggests improvements.