Cti Expert
Cyber threat intelligence and OSINT analysis toolkit.
Install
npx skills add 7onez/cti-expert --skill cti-expert -g -a claude-code -y- Repository
- 7onez/cti-expert620
- Category
- Security
- Updated
- 13d ago
- License
- See repository
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, domain/subdomain/DNS/certificate recon, web-infrastructure pivoting (favicon hashes, tracker IDs, TLS certs, phishing-kit fingerprinting, campaign clustering), username/email/phone enumeration, breach and infostealer-log triage, image forensics, geolocation, crypto-wallet and IBAN/bank-account tracing, darknet search, M365/Azure and SaaS tenant recon, China/Sinophone recon (ICP filings, PRC corporate registries, Baidu/FOFA/Quake/ZoomEye), vulnerability and ransomware lookup, threat modeling, PII redaction, and structured reporting. Commands include /case, /sweep, /query, /webpivot, /username, /phone, /email-deep, /breach-deep, /icp, /cn-corp, /iban, /stealer-log, /exposure, /threat-model, /report, /brief, /redact, /apikeys.
CTI Expert
Cyber threat intelligence and open-source intelligence skill. Turns Claude into a trained CTI/OSINT analyst. Generates precision search queries, interprets public data, builds case timelines, and delivers structured intelligence products, no API keys, no paid subscriptions.
Runs anywhere. Works in Claude Code (Desktop & CLI) and in OpenAI Codex / ChatGPT and other
AGENTS.md-aware agents, seeAGENTS.mdfor the cross-agent runtime contract. Throughout this file,$SKILL_DIR= the directory containing thisSKILL.md(Claude Code:~/.claude/skills/cti-expert; Codex/manual clone: the repo you are working in). Resolve it by locatingSKILL.md, never hard-assume~/.claude. Detect the OS once (Windows/macOS/Linux) and prefer uv for all Python, see §13 Tool Auto-Install Policy.
Collection method: agent-browser when available (JavaScript-heavy sites, infinite-scroll, screenshot evidence), with automatic fallback to web search / web fetch / direct URL fetch. Tool limitations are logged as collection gaps, never as case blockers.
1. Quick Start
# Full autonomous case, runs every applicable technique
/case target.com
# Guided flow for first-time investigators
/flow person
# Summary of what's been found so far
/brief
Append --yolo to any command to skip all interactive prompts and confirmations. The analyst makes every decision autonomously.
2. AEAD Case Lifecycle
Every investigation follows four phases:
