Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Liberty91LTD/cti-skills --skill tlp-guidegit clone --depth 1 https://github.com/Liberty91LTD/cti-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liberty91ltd/cti-skills/tlp-guide)<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/tlp-guide"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/tlp-guide/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/tlp-guide"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/tlp-guide.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00985 |
| Opus 5.5 | $0.00024 | $0.00394 |
| Sonnet 5.5 | $0.00012 | $0.00197 |
| Haiku 4.5 | $0.00006 | $0.00098 |
Grade A, and why
tlp-guide scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Traffic Light Protocol (TLP) v2.0
Every intelligence output from this platform MUST have a TLP designation. This is enforced by platform rules and validated by hooks.
TLP Definitions
TLP:RED — Named Recipients Only
When to use: Information that would cause significant harm if shared beyond the named recipients. Sources may face risk.
- Share with: Only the named recipients, in person or via secure channels
- Do NOT share with: Anyone not explicitly named, even within the same organisation
- Examples: Active zero-day exploitation details shared to a specific CISO; source-identifying intelligence; ongoing law enforcement operation details
TLP:AMBER+STRICT — Organisation Only
When to use: Information that requires support to be effectively acted upon, limited to the recipient's organisation only.
- Share with: Members of the recipient's own organisation on a need-to-know basis
- Do NOT share with: External parties, clients, partners, or affiliated organisations
- Examples: Targeted threat intelligence specific to one organisation's infrastructure; internal investigation findings
TLP:AMBER — Organisation + Need-to-Know
When to use: Information that requires support to be effectively acted upon, and may be shared with clients/partners on a need-to-know basis.
- Share with: Members of the recipient's organisation AND their clients/partners who need the information to protect themselves
- Do NOT share with: The general public, social media, or parties without a clear need-to-know
- Examples: Sector-specific threat briefings shared with ISAC members; IOCs for active campaigns affecting a supply chain
TLP:GREEN — Community
When to use: Information useful for awareness within a broader community but not for public disclosure.
- Share with: The wider community (sector peers, security community) but not via publicly accessible channels
- Do NOT share with: The general public, social media, public blogs, or news outlets
- Examples: General threat landscape updates shared at closed conferences; new TTP descriptions shared within an ISAC
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 102 lines · 61 tokens per session scan A 2439420e960f
tlp-guide is a skill published in the GitHub repository Liberty91LTD/cti-skills (36 stars, last pushed 4d ago), licensed MIT. It adds 61 tokens to every session and 985 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use…
implementing-data-loss-prevention-with-microsoft-purview
Implements data loss prevention policies using Microsoft Purview to protect sensitive information across Exchange Online, SharePoint, OneDrive, Teams, endpoint devices, and Power BI. The analyst configures sensitivity labels with encryption and content marking, creates DLP policies using built-in and custom sensitive…
implementing-gdpr-data-protection-controls
The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill cover.
implementing-pci-dss-compliance-controls
PCI DSS 4.0.1 establishes 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data. With PCI DSS 3.2.1 retiring April 2024 and 51 new requirements.
analyzing-threat-actor-ttps-with-mitre-attack
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. This skill covers systematically mapping threat actor beh.
collecting-volatile-evidence-from-compromised-host
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.