🤝 Sponsors & Supporters

[!IMPORTANT] ANY.RUN lookups are read-only; detonation is gated. anyrun_lookup queries TI Lookup for hashes that have already been detonated. anyrun_submit can detonate a file or URL, but only behind a per-submission analyst confirmation (a briefing-then-confirm=true two-step), private-by-default privacy with public refused, a fail-closed plan check (the account's own /user private quota — zero is denied outright — else a prior private task, else an explicit analyst attestation to a paid plan), a post-submit privacy read-back that withdraws and flags a task that still landed public, and a harness deny unless HARNESS_ALLOW_SUBMIT=1. A public sandbox task is world-readable and irreversible; the gate is enforced by a regression test (tests/test_no_sample_submission.py), not just by convention.

_{Listing here reflects support for the project and does not imply affiliation, endorsement, or any verification of this tool by the organisations named. Integrations marked above are optional and key-gated — every core technique still runs with zero API keys. Always respect each provider's terms of service. The full list of open-source projects and free public-interest services this skill depends on is in Acknowledgments & Credits.}

What is CTI Expert?

A Claude Code skill that transforms Claude into a trained cyber threat intelligence and open-source intelligence analyst. It runs structured intelligence collection using 120+ commands across 57 techniques — no API keys required for core functionality. To take full advantage, add your own free or paid API keys to the skill's .env — each is auto-detected and unlocks higher-tier access (e.g., Wigle, VirusTotal, URLScan.io, Shodan, Censys, SecurityTrails, WhoisXML).

[!TIP] Keyless by default, more powerful with your keys. Every core technique runs with zero API keys. Add any free or paid keys to .env (or run /apikeys set <service> <KEY>) and the skill auto-detects them, unlocking higher-tier pivots: reverse favicon→host, passive DNS, certificate search, sibling-domain discovery. A missing or bad key never breaks a run — it just degrades to a note. Setup guide: handbook/api-keys.md.

[!TIP] One skill, two layers. cti-expert is the broad collector — the wide net (/sweep, /webpivot, /subdomain, /username, /email-deep…). Built into the repo is a deep pipeline (intel_engine/) that turns raw collection into a real case: a persistent knowledge base, versioned cases, cross-case correlation, and calibrated assessment. The flow reads like a sentence — collect broadly → "seen this operator before?" → cluster → filter false positives → assess. No external setup: the backend resolves to SELF, and as of v2.9 the bundled installer (scripts/install.{sh,ps1}) provisions the deep layer automatically (or by hand: uv venv && uv pip install -r requirements.txt). Architecture: connectors/intel-backend.md.

Demo

Full Case Investigation

CTI Report Generation

Screenshots

INTSUM Report	Network Topology	Risk Assessment

What's New in v2.12

The release where the premium keys start pulling their weight — and the report writes itself. v2.11 shipped detectors. v2.12 turns an eight-finding audit of the paid vendors into behaviour (every metered leg gated, bought once per case instead of once per host), adds Netlas as an independent index, makes the editorial PDF/DOCX a deterministic composition from the case directory, and closes the last honesty gap in the ANY.RUN docs: detonation exists, and it is gated five ways.

Installation

Recommended: Use Claude Code CLI — it gives you the full terminal workflow, persistent sessions, and direct skill invocation. Download here or run npm install -g @anthropic-ai/claude-code.

Why Claude Code CLI?

The entire CTI Expert workflow is optimized for Claude Code CLI. The CLI gives you:

• Persistent sessions — investigations survive terminal restarts via /workspace save
• Full tool access — file writes, Python scripts, DOCX generation, all run natively
• Skill invocation — type /cti-expert directly in the terminal, no browser required
• Background agents — parallel enrichment via AgentFlow works best with the CLI

🖥️ Where to run it — the CLI is best for this skill

[!IMPORTANT] CTI Expert is execution-heavy: it runs uv/Python, installs OSINT tools, writes .md/.json/.csv/.html/.docx/.pdf reports + IOC bundles, reaches many external sites, and saves case workspaces. What matters is a real local shell + persistent files + open network — a CLI or local desktop agent gives you that; an ephemeral cloud sandbox does not. This applies equally to Claude and Codex.

[!TIP] Run investigations in a CLI (Claude Code or Codex); open the generated .docx/report in a Desktop/IDE window if you prefer reading there. Use web/cloud surfaces only for analyst-reasoning, not execution-heavy recon.

Step 1 — Install Claude Code CLI

npm install -g @anthropic-ai/claude-code

Requires Node.js 18+. Full docs: docs.anthropic.com/en/docs/claude-code/overview

Step 2 — Clone + All-in-One Installer

The installer handles everything: Python dependencies, system tools (whois, dig, asn, jq, exiftool), OSINT tools (maigret, sherlock, holehe, h8mail, and more), and optional headless browser + Go tools. It is powered by uv (Astral's ultra-fast Rust package manager) — the script bootstraps uv, then uses uv venv / uv pip / uv tool for all Python installs, falling back to pip/pipx/venv only if uv can't be installed. Use install.ps1 on Windows (PowerShell) or install.sh on macOS/Linux/Git Bash/WSL.

git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
bash ~/.claude/skills/cti-expert/scripts/install.sh

git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
bash ~/.claude/skills/cti-expert/scripts/install.sh

git clone https://github.com/7onez/cti-expert.git "$env:USERPROFILE\.claude\skills\cti-expert"
powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.claude\skills\cti-expert\scripts\install.ps1"

Windows users: install.ps1 is a full native installer (winget system tools + Python venv + OSINT tools) — no Git Bash or WSL required. It accepts the same -Headless, -Go, and -All flags (e.g. install.ps1 -All). Git Bash / WSL users can run install.sh instead. The DOCX generator self-heals UTF-8 output and auto-locates pandoc, so reports build on Windows with no extra environment setup. The skill itself detects the OS at runtime and installs any missing tool with the right manager (winget / brew / apt) — see scripts/platform-setup.md.

Installer Options

macOS / Linux / Git Bash / WSL:

bash scripts/install.sh               # Core: Python deps + system tools + OSINT tools
bash scripts/install.sh --headless    # + Scrapling headless browser (~200MB Chromium)
bash scripts/install.sh --go          # + Go tools (subfinder, amass, gau, gitleaks, httpx)
bash scripts/install.sh --all         # + Everything above

Windows (PowerShell):

powershell -ExecutionPolicy Bypass -File scripts\install.ps1              # Core
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Headless    # + Scrapling headless browser
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Go          # + Go tools
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -All         # + Everything above

Step 3 — Register the commands with Claude Code

install.sh installs the OSINT tools. This one-time step wires the skill, the 9 /cti* slash commands, and the MCP tools into Claude Code so they work from a cold prompt in any project — it symlinks commands/*.md into ~/.claude/commands/ and writes the per-machine .mcp.json. It's idempotent, so it's safe to re-run after a git pull.

# Register the skill + 9 commands + write the per-machine .mcp.json
bash ~/.claude/skills/cti-expert/scripts/register.sh

# Recommended: install the built-in deep-pipeline (intel_engine) deps once
cd ~/.claude/skills/cti-expert && uv venv && uv pip install -r requirements.txt

Windows (native PowerShell): run register.sh from Git Bash or WSL — it uses symlinks. Then, on every platform, restart Claude Code so the skill and commands load at startup.

# from a local clone
claude
/plugin marketplace add ~/.claude/skills/cti-expert
/plugin install cti-expert

Verify Installation

claude              # open Claude Code CLI, then type:
/cti-status         # health check — backend tier, MCP tools, API-credit balances
/cti example.com    # …or just start investigating

/cti-status confirms the backend, MCP tools, and API-credit balances in one shot. If the /cti* commands aren't recognized, re-run Step 3 (register.sh) and restart Claude Code. You can also type /cti-expert to load the skill directly, then describe your goal in plain English.

Use in ChatGPT / Codex (cross-agent)

CTI Expert is portable: the analyst logic is plain Markdown and the scripts are OS-detecting Python/shell, so it runs in OpenAI Codex (and other AGENTS.md-aware agents), not just Claude Code.

# 1. Clone the skill anywhere
git clone https://github.com/7onez/cti-expert.git

# 2a. In-repo: open Codex inside the clone — it auto-loads AGENTS.md. Then ask it to follow SKILL.md.
# 2b. Slash command: copy the bundled Codex prompt so /cti-expert works in the Codex CLI/IDE
cp cti-expert/codex/cti-expert.md ~/.codex/prompts/cti-expert.md   # Windows: copy to %USERPROFILE%\.codex\prompts\

• AGENTS.md is the cross-agent runtime contract (OS detection, uv, paths). Codex auto-concatenates it from the repo root; you can also reference it from ~/.codex/AGENTS.md.
• codex/cti-expert.md is a ready-to-copy custom prompt → gives Codex a /cti-expert <target> slash command.
• Plain ChatGPT (no code execution): the reasoning, query generation, and report drafting all work (load SKILL.md/AGENTS.md as instructions or Custom-GPT knowledge); only local steps (DOCX build, CLI tool runs) need a code-capable harness like Codex or Claude Code.

Paths are resolved relative to the skill directory (the folder containing SKILL.md), so nothing assumes the Claude-specific ~/.claude/skills/ location.

Alternative — Claude Code Desktop (macOS / Windows)

Download: claude.ai/download — available for macOS and Windows

Step-by-step (no terminal needed):

1. Install Claude Code Desktop — Download from claude.ai/download and install the app

2. Download CTI Expert — Go to the GitHub repository, click the green "Code" button, then select "Download ZIP"

3. Extract to your skills folder — Unzip the downloaded file, then move the extracted folder to your skills directory and rename it to cti-expert:

   Platform	How to navigate
   macOS	Open Finder → Press Shift + Cmd + G → Type ~/.claude/skills/ → Press Go → Move the folder here
   Windows	Open File Explorer → Type %USERPROFILE%\.claude\skills\ in the address bar → Press Enter → Move the folder here

   Note: If the skills folder does not exist, create it inside the .claude folder first.

4. Run the installer + register — Open the Claude Code Desktop terminal and run:

   bash ~/.claude/skills/cti-expert/scripts/install.sh      # OSINT tools
   bash ~/.claude/skills/cti-expert/scripts/register.sh     # skill + 9 commands + MCP
   

   Or on Windows PowerShell (Python deps only; run register.sh from Git Bash/WSL):

   pip3 install -r "$env:USERPROFILE\.claude\skills\cti-expert\scripts\requirements.txt"
   

5. Restart Claude Code Desktop — Close and reopen the app

6. Verify — Type /cti-status in the chat to confirm the skill and commands loaded (or /cti-expert to load the skill directly)

Quick Start

[!TIP] New here, or on a fresh VPS? The steps below take you from an empty box to a finished case in a couple of minutes. No API keys needed for core.

# 1 — install the tools (Linux/macOS): Python + ffmpeg + Node + all OSINT tools
git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
bash ~/.claude/skills/cti-expert/scripts/install.sh
# 2 — register the skill + 9 /cti* commands + MCP with Claude Code, then RESTART Claude Code
bash ~/.claude/skills/cti-expert/scripts/register.sh
#     (Windows: run register.sh from Git Bash / WSL — it uses symlinks. Restart Claude Code after.)
# 3 — investigate anything (keyless, runs to closure):
/cti example.com
# 4 — optional: unlock reverse pivots + image vision
/apikeys set shodan <KEY>     # host / favicon reverse
/apikeys set gemini <KEY>     # image OCR, sign/landmark read, A-V transcription

Windows, --all, and Codex variants: see Installation.

How commands work — read this first

There is one command to remember: /cti <target>. It looks at what you gave it — a domain, IP, email, username, phone, wallet, hash, or APK — and runs the right chain automatically. That's usually all you need.

Under it sit 9 registered commands that Claude Code recognizes from a cold prompt in any project (no need to load the skill first):

Every other command on this page (/case, /webpivot, /report, /sweep…) is a convention command: shorthand that works once the skill is loaded — via /cti, or by typing /cti-expert to open the skill directly. At a cold prompt, reach for a registered command above, or just describe your goal in plain English — it works identically.

First 60 seconds — turn on full power

Before your first real case, run these once in Claude Code so you're not silently running keyless or degraded:

/cti-expert      # load the skill first — the four below are convention commands
/onboard         # interactive first-run guide
/capabilities    # which evidence classes are unavailable now + the free path that substitutes
/backend         # confirm Tier-1 typed MCP (79 tools) is live, not Tier-3 stateless
/apikeys status  # keyless works; add free/paid keys to unlock reverse pivots

1 — Investigate anything

/cti example.com          # domain  → full pipeline
/cti user@domain.com      # email   → breach + infrastructure + cross-platform
/cti @username            # handle  → 3000+ platform enumeration, then pivot
/cti 185.1.1.1            # IP      → ASN, co-tenancy, open ports, passive DNS
/cti ./trader.apk         # file    → static IOCs, clustered with the web infra

/cti picks the right techniques for the target, then expands the pivot graph to closure — no approval prompts. Add --deep for parallel sub-agent fan-out, --quick for a single pass, or --passive for hostile targets (no live contact). Default output: the base bundle (Markdown + JSON + CSV + IOC bundle) plus your chosen presentation report (PDF, DOCX, HTML, or all).

2 — Run a case end-to-end

/cti-recall example.com               # always first — have we seen this seed before?
/cti-case CASE-0001 example.com       # full pipeline on one or more seeds
/cti-cluster CASE-0001                # expand: peers, shared indicators, TLS overlap
/cti-report CASE-0001                 # deliver: relationship graph + house report (PDF/DOCX)

3 — Guided Flows

The commands below are convention commands — type them once the skill is loaded.

/flow person           # Person investigation workflow
/flow domain           # Domain reconnaissance workflow
/flow image            # Image verification workflow

4 — Targeted Reconnaissance

/sweep @username                    # Multi-vector recon on handle
/query example.com                  # 12-15 advanced search queries
/username johndoe                   # Platform enumeration (3000+)
/email-deep user@domain.com         # Deep email investigation
/subdomain example.com              # Certificate transparency + brute-force
/github-osint github.com/org/repo   # GitHub profiles, repos, code, commits, forks
/threat-check 185.1.1.1             # IP/domain/URL threat intelligence
/scam-check suspicious-site.xyz     # Phishing/scam domain check
/breach-deep user@domain.com        # Multi-source breach lookup

5 — Analysis & Assessment

/exposure domain.com                # Composite risk score (0-100)
/threat-model                       # Build threat model from findings
/validate                           # Verify all findings
/coverage                           # Check investigation completeness

6 — Reporting

/report                             # Technical INTSUM report
/report brief                       # Executive summary
/brief                              # Plain-language summary
/workspace save                     # Save case workspace state (resume later)

7 — Full pipeline & full harness (deepest mode)

/cti is the everyday entry. For a persisted, versioned case that runs to convergence and correlates across every prior case, use the deep layer. Run /backend first — it reports the tier (Tier-1 typed MCP intel-harness = 79 tools → Tier-2 CLI → Tier-3 stateless); the bundled installer already provisions it (SELF, in-repo, no external setup).

/case already persists a versioned case — with NO extra egress on the persist step. When /backend is live (Tier 1/2), a /case run reuses the pivots it just collected (it does not re-fetch): it writes them under $SKILL_DIR/intel_engine/cases/<CASE-ID>/raw/ and runs the deterministic pipeline in reuse mode — intel.py pipeline open <CASE-ID> <seeds> --no-collect — which skips the live fetch and runs the whole chain (ingest → recall → risk → clusters → case_graph.json → ICD-203 assessment.md) over that raw. The complete versioned case lands at $SKILL_DIR/intel_engine/cases/<CASE-ID>/ (not your CWD) and is correlated across every prior case. If the case has not converged (intel.py convergence <ID> reports status ≠ converged, or /frontier still lists open leads) and posture is active, /case then auto-escalates to the /harness deepening loop — keyless-first (it uses the CLI's own model), egress hard-gated on hostile infra (the harness audit.py denies outbound collection on hostile=True), --no-harness opts out. Plain /pipeline open (without --no-collect) and /cti-case still collect — they re-fetch every seed directly — so run those by hand only for a fresh case with no prior collection, after setting the egress posture (/scope, /cti-proxy, or --passive for hostile infra). Tier 3 / no host seeds → /case skips the handoff silently.

/cti-expert                           # load the skill first (the commands below are convention commands)
/backend                              # confirm the deep layer is live (Tier-1 = 79 MCP tools)

# A — full DETERMINISTIC pipeline (no LLM key, reproducible, persisted to cases/<ID>/)
printf "example.com\nsibling.com\n" > seeds.txt
/pipeline open CASE-0001 seeds.txt    # collect → ingest → recall → risk → cluster → ICD-203 assessment
                                      #   + MO-neighbour origin pivot · measured entitlement · IntelX auto-fire
                                      #   --free-only: no metered credits · --whois-history purchase: registrant eras
/clusters CASE-0001                   # judge by same-operator cluster, with KB-wide prevalence
/frontier CASE-0001                   # unresolved gaps: free next seeds + deferred metered leads

# B — full HARNESS (agent-driven; also auto-escalates inside /case when a case has not converged)
/harness open CASE-0001 example.com sibling.com
/harness continue CASE-0001 --depth 4 # Collect→Correlate→Assess, cross-case, until the frontier empties
/harness status CASE-0001             # status needs no key
/loop CASE-0001                       # or: collect↔assess repeatedly until it converges

/cti-report CASE-0001                 # deliver: relationship graph + house report (editorial PDF/DOCX from the case dir)

Pipeline vs harness: /pipeline is the deterministic bread-and-butter chain — no LLM key, byte-reproducible. /harness is the agent-driven whole-case orchestration that reasons across cases to convergence (the deepest mode), and auto-escalates inside /case when the deterministic pipeline hasn't converged and posture is active (--no-harness opts out). Keyless-first: run interactively in Claude Code it uses the CLI's own model on your subscription (no separate LLM key); HARNESS_BACKEND=local (Ollama/vLLM/LM Studio, keyless) or an API key are needed only for unattended SDK continue. Both persist under cases/<ID>/; the registered cold-prompt alias /cti-case <ID> <seeds> runs the deterministic pipeline.

Best Practices

Habits that keep investigations fast, cheap, and correct — most are enforced by the skill itself, but knowing them helps.

Running a case

• Start with /cti <target>. It's the single entry point and routes by target type (domain, IP, email, username, phone, wallet, hash, APK). Don't hand-run collectors.
• Recall before you collect. /cti-recall <seed> (or Step 0 of /cti) is the cheapest call in the toolkit — it tells you if a seed is already attributed, saving credits and avoiding contradicting a prior assessment.
• --passive for anything hostile. The egress gate refuses a direct fetch of hostile infrastructure; passive mode works from Wayback/urlscan captures, so your IP never touches it.
• Screen indicators before clustering. /cti-check <indicator> (false-positive control) — a false merge names an innocent party; a false split loses the case.
• --deep earns its cost at 3+ live seeds (parallel sub-agent fan-out); a single seed runs inline.
• /cti-status when something behaves oddly — backend tier, MCP tools, and API balances in one shot.

Cost & keys

• Two separate ledgers: model reasoning (/cost) vs third-party API credits (api_usage) — never the same number.
• Keyless by default; /apikeys upgrades. Keys enrich pivots (Shodan/Censys/FOFA/…) but nothing requires them.

If you're developing the skill

• bash scripts/install-hooks.sh once per clone — wires the leak check as a pre-commit hook.
• bash scripts/audit.sh before pushing — the drift/leak/test gate (also runs in CI on every PR).
• A classification change ships with its test (RULE 5).

Features

AEAD Case Lifecycle

Every investigation follows four automated phases:

                         ╭──────────────────────────────────────╮
                         │         AEAD CASE LIFECYCLE          │
                         ╰──────────────────────────────────────╯

   ┌─── ACQUIRE ────────────────────────────────────────────────────────┐
   │  Collect raw data via /sweep, /query, /username, /phone, etc.     │
   │  Database search, enumeration, collection gap logging             │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ENRICH ─────────────────────────────────────────────────────────┐
   │  Expand leads via /branch, /crossref, /link-subjects, /signatures │
   │  Shared identifier detection, relationship mapping                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ASSESS ─────────────────────────────────────────────────────────┐
   │  Score & verify via /exposure, /threat-model, /validate, /coverage│
   │  Risk scoring, completeness check, evidence chains                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── DELIVER ────────────────────────────────────────────────────────┐
   │  Package output via /report, /brief, /render, /workspace save     │
   │  Auto-saves .md, .html, .json, .csv + IOC set                     │
   └────────────────────────────────────────────────────────────────────┘

Run /progress at any point to see current phase and pending tasks.

Workflow diagrams

End-to-end tool & skill flow — the whole system as one sequence: your target enters at /cti, crosses Layer 1's 57 techniques and the 79-tool MCP surface, through WebPivot / BinaryPivot / the knowledge base / IntelAnalysis, and leaves as a rendered graph and a PDF:

Full /cti · /case pipeline (AEAD) — the recursive spider-map, and where /webpivot, /icp, /iban and correlation fit:

/webpivot + correlation + premium API-key flow:

_{Sources: workflow-skills.puml · workflow-case.puml · workflow-apikeys.puml — rendered with PlantUML to SVG in assets/ (vector, so it stays sharp at any zoom and needs no Git-LFS). Re-render after editing a source:}

plantuml -tsvg -o assets workflow-case.puml workflow-apikeys.puml workflow-skills.puml
# add -tpng if you need raster copies for slides — note assets/*.png is Git-LFS tracked

_{See also the API-keys & webpivot guide.}

Command Reference

The tables below are convention commands — the full technique vocabulary, available once the skill is loaded (via /cti or /cti-expert). The 9 registered entry commands (/cti, /cti-recall, /cti-case…) are in Quick Start above. For the authoritative reference, see SKILL.md.

Skill Tiers

Output density and automation adapt to your proficiency. Switch tiers any time — the output changes immediately: /novice enters Novice, /novice off gives you Specialist, and Practitioner is the default in between.

Technique Catalog

Report Formats

You never have to ask for output. Every /report, /brief, and /case writes the full set automatically — one interactive web page to explore the case, plus machine-readable files for tooling and evidence. Need to share a report outside your team? Add --redact and PII is swapped for stable placeholders (and can be reversed later).

Every report variant is one command — the base data bundle (.md · .json · .csv · IOC bundle: .stix.json/.txt/.csv/.jsonl) saves automatically on every /report, /brief, and /case, then you're asked which presentation report to render: (a) PDF · (b) DOCX · (c) HTML · (d) all; when HTML is among them, one more confirmation shows what the Archify Blueprint would embed (cti_archify.py --plan) and lets you pick Auto / force / off before the file is written (--yolo/guided-auto skip both prompts and default to HTML with Blueprint in Auto). The variants below pick a specific format or audience:

_{Generated by scripts/build_report_data.py (report JSON) · scripts/generate-cti-html.py (HTML) · scripts/generate-cti-iocs.py (IOCs) · scripts/generate-cti-docx-hybrid.py (dashboard DOCX) · intel_engine/tools/house_report.py + intel_engine/IntelReport (house PDF/DOCX)}

Architecture

cti-expert/
├── SKILL.md                    The single skill entrypoint — commands & tradecraft
├── README.md                   This file  ·  README.vi.md · README.zh-CN.md
├── STRUCTURE.md                Authoritative layout + anti-drift rules
├── AGENTS.md                   Cross-agent runtime contract (Claude Code + Codex)
├── CLAUDE.md                   Contributor rules (loads only when building the repo)
│
├── commands/                   9 registered slash commands — work from a cold prompt
│   ├── cti.md                  /cti — the entry point, routes by target type
│   ├── cti-recall.md · cti-case.md · cti-pivot.md · cti-cluster.md
│   └── cti-check.md · cti-report.md · cti-status.md · cti-proxy.md
│
│  ── LAYER 1 · Broad collector — cti-expert's own tools ──────────────
├── scripts/                    Collectors, backend dispatcher, report generators
│   ├── backend/                backend.py (tier resolver) · intel.py (T2 CLI dispatch)
│   ├── webpivot/               pivot_extract · cert_pivot · wayback_* · rank_relations …
│   ├── osint/                  18 keyless-first CLIs behind the SKILL.md commands — hash_id · vuln_check · username_enum · phone_osint · github_osint · reputation_check · cn_recon · kb_crossref · case_drift …
│   ├── build_report_data.py    Case dir → REPORT.json (deterministic report bridge)
│   ├── generate-cti-html.py    Interactive, offline, self-contained HTML report
│   ├── generate-cti-iocs.py    IOC / selector export (STIX 2.1 · flat · CSV · JSONL)
│   ├── generate-cti-docx-hybrid.py   Dashboard DOCX/PDF (charts, diagrams, cover page)
│   ├── iban_analyze.py · redact.py · stealer_log_parse.py · pivot_orchestrator.py
│   ├── install.sh · install.ps1      All-in-one cross-platform installer
│   └── audit.sh · leakcheck.sh · install-hooks.sh   Drift · leak · pre-commit gates
│
├── techniques/                 57 collection techniques (the OSINT tradecraft)
├── handbook/                   Pivot artifacts, API keys, operator queries, analytic standards
├── engine/                     Case data-model design docs (schema, findings, pivot logic)
├── analysis/ · validation/     Pattern & exposure engines · QA + coverage matrices
├── experience/                 UX — skill tiers, guided flows, case templates
├── workflows/ · guides/        Professional use-case guides · worked walkthroughs
├── connectors/                 intel-backend · Maltego · Notion · Obsidian export
├── tests/                      Zero-dep regression tests (RULE 5 classification + collect_core)
│
│  ── LAYER 2 · Deep pipeline — vendored, self-contained ──────────────
└── intel_engine/               Collect → Correlate → Assess pipeline + knowledge base
    ├── harness/                Pipeline brain — orchestrator.py · mcp_server.py · tools.py (79 @tool)
    ├── tools/                  intel.py (deterministic pipeline) · house_report*.py · case_state · kb/ (KB + correlation)
    ├── WebPivot/               Canonical collector — pivot_extract · wp_* vendor clients · enrich_live
    ├── IntelGraph/             Publication-quality case-graph rendering (PNG/SVG)
    ├── IntelReport/            Pandoc render of the composed house report → PDF/DOCX
    ├── IntelAnalysis/          Correlation, attribution, confidence calibration
    ├── IntelShare/             MISP export · stage · publish (two separate decisions)
    ├── Engage/                 Login detection · synthetic persona · gated members-area harvest
    ├── BinaryPivot/            Static IOC extraction from a scam APK / exe · ANY.RUN lookup + gated submit
    └── knowledge/ · cases/     Local runtime data — gitignored, never committed

Professional Workflows

Activate with /flow [type] for interactive guided prompts.

Ethics & Responsible Use

This skill is for lawful research and professional security investigation only.

You are responsible for all use of this skill. Comply with local laws, regulations, and platform terms of service. Always respect privacy and consent boundaries.

Contributing

We welcome research contributions, new techniques, and workflow improvements.

License

MIT License + Ethical Use Addendum

You are free to use, modify, and distribute this skill under the MIT license, provided that you include original attribution, comply with the ethical use guidelines above, and clearly mark any derivatives.

See LICENSE for full text.

🙏 Acknowledgments & Credits

CTI Expert stands on the shoulders of the open-source community and free, public-interest data providers. A huge thank-you to every project, vendor, and free API below — this skill simply would not exist without your work. (Listing here does not imply affiliation or endorsement; always respect each provider's terms of service.)

Built something here we should credit, or want your project's listing changed/removed? Open an issue or PR — we'll fix it fast. 💙