71 tagged cti, measured the same way as everything else here.
Browse within: cybersecurity 55cyber-threat-intelligence 51cyber-security 50cyber-threat-tool 50cyber-threats 50ai-security 11bug-bounty 11bugcrowd 10claude-ai 10attribution 7campaign-analysis 7ioc 7mitre-attack 7stix 7
Skill Claude CodeCodex
Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack)…
Skill Claude CodeCodex
Password spray methodology for bug bounty — when to do it vs web-vuln hunting, the wordlist-gen + breach-check + osint-employees + spray pipeline, mode selection (http-form / oauth / o365 / okta), rate-limit + lockout tactics, BBP legal guardrails, success detection, and the spray → authenticated /hunt chain pattern.…
Skill Claude CodeCodex
GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a…
Skill Claude CodeCodex
Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, domain/subdomain/DNS/certificate recon, web-infrastructure pivoting (favicon…
Skill Claude CodeCodex
ZettelForge v2.0.0 — Production CTI agentic memory system. Hybrid TypeDB (STIX 2.1 ontology) + LanceDB (vector search). Zero external AI dependencies: fastembed for embeddings, llama-cpp-python for LLM. 75% accuracy on CTI queries, 18% on LOCOMO. Use when agents need persistent memory, threat intel retrieval, entity…
Skill Claude CodeCodex
Use when you need to answer "which attacker techniques do our controls actually stop, and how well?", "what controls should I have for this threat?", or "what telemetry should I collect to detect it?" — joining a customer's or your own security control baseline to ATT&CK techniques using a public, versioned evidence…
Skill Claude CodeCodex
Dark web intelligence collection methodology — vendor-first access posture, sourced reference lists for 35+ underground forums and 30+ Telegram channels, OPSEC primer, passive-monitoring strategy, and bundled Python CLIs for onion-indexer search, Telegram channel monitoring, and local keyword matching. Use when the…
Skill Claude CodeCodex
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete /lookup- commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else…
kevinmhorvath/threat-intel-toolkit
Skill Claude CodeCodex
Check whether a working exploit or public PoC exists for a vulnerability. Given a CVE ID (e.g. CVE-2024-3400) or a named vulnerability (e.g. Log4Shell, EternalBlue, BlueKeep, Citrix Bleed), it queries CISA KEV, EPSS, Metasploit, Nuclei, Exploit-DB, and the nomi-sec/trickest GitHub PoC aggregators, then reports an…
kevinmhorvath/threat-intel-toolkit
Skill Claude CodeCodex
Aggregate free / open-source threat-intel feeds into a local cache and check indicators (IPs, domains, URLs, CVEs) against them. Trigger whenever the user drops an IP, domain, URL, or CVE and asks "is this malicious", "is this a known bad IP", "check this indicator / IOC", "is this domain on any blocklist", "who's…