Cyber Threat Intelligence Skills for each stage of the CTI Lifecycle.
This repository also configures its own agents. See what cti-skills tells them →
Skill Claude Code
Use when prioritising CVEs, the user asks "should we patch X first?" / "is CVE-YYYY-NNNNN being exploited?", or wants weaponisation, EPSS, and KEV context combined into a patch-now-vs-later recommendation.
Skill Claude Code
Use when the user asks to write a threat / risk / vulnerability assessment, or wants the appropriate template for each type. Distinct structures and section ordering per assessment kind.
Skill Claude Code
Use when the user asks for a YARA rule, "write YARA for this sample/family", or /hash-investigation / /malware-analysis surfaces a sample worth a static-content rule. Pattern-matching rules for identifying malicious files.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: