Cyber Threat Intelligence Skills for each stage of the CTI Lifecycle.
This repository also configures its own agents. See what cti-skills tells them →
Skill Claude Code
Use when the user asks to write a threat / risk / vulnerability assessment, or wants the appropriate template for each type. Distinct structures and section ordering per assessment kind. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Confidence…
Skill Claude Code
Use when the user asks for a YARA rule, "write YARA for this sample/family", or /hash-investigation / /malware-analysis surfaces a sample worth a static-content rule. Pattern-matching rules for identifying malicious files.
Skill Claude Code needs its repo
Use when a report must be split into individual claims before grading, citing or using as evidence: "what does this report actually claim?", "separate facts from judgements", or another skill needs a claim list. Produces five to twelve atomic claims, each typed (observation, attribution, assessment, actor claim…
Skill Claude Code
Use when challenging a prevailing analytical judgment, the user asks "what is the opposing case?" / "argue the other side" / "play devil's advocate", or wants an assessment stress-tested before release. Takes the team's own lead judgment and builds the strongest case that it is wrong. A contrarian technique. It does…
Skill Claude Code
Use when evidence needs grading before anyone reasons from it: "how reliable is this?", "grade this source", "check this report", "is this corroborated?", or a URL, pasted report or Liberty91 event handed over ahead of an ACH or assessment. Resolves each document to its originating source, splits it into claims and…
Skill Claude Code
Use when you need to know where reporting actually came from: an article URL with "where does this come from?", "who is the original source?", "is this a rewrite?", or another skill needs the provenance chain before grading or citing. Follows links and attributions back to the originating vendor, government, victim or…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: