Cyber Threat Intelligence Skills for each stage of the CTI Lifecycle.
This repository also configures its own agents. See what cti-skills tells them →
Skill Claude Code
Use when writing a finished intelligence product, the user asks for a flash-report / threat-assessment / briefing / FINTEL template, or wants the BLUF + active-voice + clear-sourcing conventions. Covers all product types.
Skill Claude Code
Workflow for enriching raw IOCs. Routes each IOC type to the appropriate /lookup- skills, optionally correlates against MISP, and synthesises a single enrichment record per indicator. Use when the user has a batch of raw IOCs to process before triage or before pushing into a sharing platform.
Skill Claude Code
IOC export formats and procedures. CSV, STIX 2.1, OpenIOC, MISP. Handles format conversion and packaging, and carries per-claim evidence grades (access level and claim support) from /quality-of-information-check into each format (STIX confidence, MISP attribute tags).
Skill Claude CodeCodex
Use when a user asks to investigate, check, enrich, or characterize an IP address (IPv4 or IPv6). Chains VirusTotal, Shodan, AbuseIPDB, GreyNoise, OTX, and optionally Censys in parallel, then consolidates findings and prioritizes follow-up IOCs. Invoked by /cti-orchestrator when the target is an IP.
Skill Claude Code
Use when the user asks about Iranian state-sponsored cyber operations or specific IRGC/MOIS-aligned actors (APT35/Charming Kitten, APT34/OilRig, MuddyWater, Imperial Kitten, etc.), wiper campaigns, front-group hacktivist personas (Handala, Cyber Av3ngers), or anti-Iran operations such as Predatory Sparrow.…
Skill Claude Code
Use when surfacing the assumptions underlying an analytical judgment, the user asks "what are we assuming?" / "are these assumptions still valid?", or before publishing a high-impact assessment. Standard SAT applied during major assessments.
Skill Claude Code
Use when the user asks for a KQL query, a Microsoft Sentinel / Defender / Azure Log Analytics detection or hunt, or wants to translate a finding from /hash-investigation / /malware-analysis into KQL. Format spec + writing guide.
Skill Claude Code
Use when phrasing a forward-looking statement, the user asks "how likely is X?" / "what's the likelihood?", or the tradecraft pipeline applies a probability yardstick to a finished product. Standardised likelihood language across all products.
Skill Claude CodeCodex needs its repo
Use when you need abuse-report history for an IPv4/IPv6 address — confidence score, total reports, distinct reporters, usage type. IP-only. Commonly invoked by /ip-investigation. Retrieval only.
Skill Claude CodeCodex needs its repo
Use when you need deep host + certificate reconnaissance for an IP or need to run a Censys search query. Returns services, TLS certificates, ASN, and location. Free tier is severely limited (250 queries/month) — use sparingly. Retrieval only.
Skill Claude CodeCodex needs its repo
Use for CrowdStrike Falcon Intelligence on an indicator (IP, domain, hash or URL: malicious confidence, linked actors, malware families, reports) or an adversary (profile, origin/target search, ATT&CK TTPs, finished intel reports): "look up 1.1.1.1", "what TTPs does Charming Kitten use?", "latest report on Mustang…
Skill Claude CodeCodex needs its repo
Use when you need to classify an IP as internet scanner noise vs. targeted activity. Returns noise/riot flags, classification (benign/malicious/unknown), actor name if known. IP-only. Commonly invoked by /ip-investigation to filter out mass-scanning noise. Retrieval only.
Skill Claude CodeCodex needs its repo
Use for Liberty91 platform intelligence: deduplicated Threat Events with sources and verification stage, whether an IOC is known to your account, the threat library (actors, malware, vulnerabilities, ATT&CK TTPs), alert matches, and which customer organizations an occurrence affects; also to push intelligence back…
Skill Claude CodeCodex needs its repo
Use when you need to query a MISP instance for existing events/attributes/objects, or push new intel into MISP — adding attributes to an event, creating an event, or uploading a STIX 2 bundle as one or more events. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is…
Skill Claude CodeCodex needs its repo
Use to query an OpenCTI instance (is this IOC known, which entities, reports or campaigns exist for an actor) or push intel into it (indicators, observables, labels, TLP markings, relationships, STIX 2.1 import). Two-way. Invoked by /ip-investigation and friends to check the knowledge base, and by analytical skills…
Skill Claude CodeCodex needs its repo
Use when you need to check an IP, domain, file hash, or URL against AlienVault OTX community pulses. Returns pulse count, key pulses, tags, related indicators, and passive DNS. Commonly invoked by investigation skills to pull community context. Retrieval only — does not interpret.
Skill Claude CodeCodex needs its repo
Use when you need to check whether an organisation/domain has been claimed by a ransomware group, profile a specific ransomware group (TTPs, leak-site infra, IOCs, YARA), or aggregate ransomware victim claims by country/sector/timeframe. Backed by ransomware.live's leak-site scrapes — 27k+ victims across 330+ groups.…
Skill Claude CodeCodex needs its repo
Use for ReversingLabs Spectra Analyze (A1000) classification, threat name, ATT&CK mapping, sandbox and dynamic-analysis results on a file hash, or network threat intelligence for a URL, domain or IP. Returns verdict, risk score, AV detection ratio, behavioural tags and pivot candidates (parent containers, extracted…
Skill Claude CodeCodex needs its repo
Use to hunt in the organisation's own Microsoft Sentinel workspace: sweep logs for IOC hits (IP, domain, hash, URL, account), hunt ATT&CK techniques, run KQL on live data, or check which tables are ingested. Discovers tables first and only writes KQL for ones that exist. Chained by the /-investigation skills to answer…
Skill Claude CodeCodex needs its repo
Use when you need host reconnaissance for an IP or domain — open ports, services, banners, OS detection, vulnerabilities. For domains, resolves DNS first then queries the IP. Commonly invoked by /ip-investigation and /domain-investigation. Retrieval only.
Skill Claude CodeCodex needs its repo
Use when you need to submit a URL for live scanning via URLScan.io and retrieve results, or search existing scans for a domain. Returns verdict, final URL after redirects, resolved IP, contacted domains/IPs, and screenshot URL. Commonly invoked by /url-investigation and /domain-investigation.
Skill Claude CodeCodex needs its repo
Use when you need to check an IP, domain, file hash, or URL against VirusTotal's reputation database. Returns detection ratio, verdict, community score, and key findings. Commonly invoked by investigation skills (/ip-investigation, /domain-investigation, /hash-investigation, /url-investigation) and by analysts…
Skill Claude Code
Use when characterising a malware sample, the user asks "what does this binary do?" / "analyse this hash deeply", or /hash-investigation flags a novel sample warranting deeper review. Static + dynamic methodology, behavioural indicators, sandbox interpretation.
Skill Claude Code
Use when assessing the maturity of a CTI programme, the user asks "how mature is our CTI?" / "what should we improve next?", or wants a benchmark against the five-level model across six dimensions.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: