7onez/cti-expert

---

🤝 Sponsors & Supporters

[!IMPORTANT] ANY.RUN is used read-only. anyrun_lookup queries TI Lookup for hashes that have already been detonated. This skill never submits a sample — a public sandbox task is world-readable and irreversible. That boundary is enforced by a regression test (tests/test_no_sample_submission.py), not just by convention.

Listing here reflects support for the project and does not imply affiliation, endorsement, or any verification of this tool by the organisations named. Integrations marked above are optional and key-gated — every core technique still runs with zero API keys. Always respect each provider’s terms of service. The full list of open-source projects and free public-interest services this skill depends on is in Acknowledgments & Credits.

---

What is CTI Expert?

A Claude Code skill that transforms Claude into a trained cyber threat intelligence and open-source intelligence analyst. It runs structured intelligence collection using 74+ commands across 49 techniques — no API keys required for core functionality. To take full advantage, add your own free or paid API keys to the skill’s .env — each is auto-detected and unlocks higher-tier access (e.g., Wigle, VirusTotal, URLScan.io, Shodan, Censys, SecurityTrails, WhoisXML).

[!TIP] Keyless by default, more powerful with your keys. Every core technique runs with zero API keys. Add any free or paid keys to .env (or run /apikeys set ) and the skill auto-detects them, unlocking higher-tier pivots: reverse favicon→host, passive DNS, certificate search, sibling-domain discovery. A missing or bad key never breaks a run — it just degrades to a note. Setup guide: handbook/api-keys.md.

[!TIP] One skill, two layers. cti-expert is the broad collector — the wide net (/sweep, /webpivot, /subdomain, /username, /email-deep…). Built into the repo is a deep pipeline (intel_engine/) that turns raw collection into a real case: a persistent knowledge base, versioned cases, cross-case correlation, and calibrated assessment. The flow reads like a sentence — collect broadly → “seen this operator before?” → cluster → filter false positives → assess. No external setup: the backend resolves to SELF; install the deep-layer deps once with uv venv && uv pip install -r requirements.txt. Architecture: connectors/intel-backend.md.

---

Demo

Full Case Investigation

CTI Report Generation

Screenshots

---

What’s New in v2.7

The release where the deep pipeline landed. v2.6 sharpened the collector. v2.7 makes cti-expert a two-layer system — a broad collector plus a built-in, self-contained intelligence pipeline with a persistent knowledge base — reachable from a cold prompt by one command, and guarded by a gate that checks the repo against its own rules on every push.

---

Installation

Recommended: Use Claude Code CLI — it gives you the full terminal workflow, persistent sessions, and direct skill invocation. Download here or run npm install -g @anthropic-ai/claude-code.

Why Claude Code CLI?

The entire CTI Expert workflow is optimized for Claude Code CLI. The CLI gives you:

• Persistent sessions — investigations survive terminal restarts via /workspace save
• Full tool access — file writes, Python scripts, DOCX generation, all run natively
• Skill invocation — type /cti-expert directly in the terminal, no browser required
• Background agents — parallel enrichment via AgentFlow works best with the CLI

🖥️ Where to run it — the CLI is best for this skill

[!IMPORTANT] CTI Expert is execution-heavy: it runs uv/Python, installs OSINT tools, writes .md/.html/.json/.csv reports + IOC bundles, reaches many external sites, and saves case workspaces. What matters is a real local shell + persistent files + open network — a CLI or local desktop agent gives you that; an ephemeral cloud sandbox does not. This applies equally to Claude and Codex.

[!TIP] Run investigations in a CLI (Claude Code or Codex); open the generated .docx/report in a Desktop/IDE window if you prefer reading there. Use web/cloud surfaces only for analyst-reasoning, not execution-heavy recon.

---

Step 1 — Install Claude Code CLI

npm install -g @anthropic-ai/claude-code

Requires Node.js 18+. Full docs: docs.anthropic.com/en/docs/claude-code/overview

---

Step 2 — Clone + All-in-One Installer

The installer handles everything: Python dependencies, system tools (whois, dig, asn, jq, exiftool), OSINT tools (maigret, sherlock, holehe, h8mail, and more), and optional headless browser + Go tools. It is powered by uv (Astral’s ultra-fast Rust package manager) — the script bootstraps uv, then uses uv venv / uv pip / uv tool for all Python installs, falling back to pip/pipx/venv only if uv can’t be installed. Use install.ps1 on Windows (PowerShell) or install.sh on macOS/Linux/Git Bash/WSL.

Windows users: install.ps1 is a full native installer (winget system tools + Python venv + OSINT tools) — no Git Bash or WSL required. It accepts the same -Headless, -Go, and -All flags (e.g. install.ps1 -All). Git Bash / WSL users can run install.sh instead. The DOCX generator self-heals UTF-8 output and auto-locates pandoc, so reports build on Windows with no extra environment setup. The skill itself detects the OS at runtime and installs any missing tool with the right manager (winget / brew / apt) — see scripts/platform-setup.md.

---

Installer Options

macOS / Linux / Git Bash / WSL:

bash scripts/install.sh               # Core: Python deps + system tools + OSINT tools
bash scripts/install.sh --headless    # + Scrapling headless browser (~200MB Chromium)
bash scripts/install.sh --go          # + Go tools (subfinder, amass, gau, gitleaks, httpx)
bash scripts/install.sh --all         # + Everything above

Windows (PowerShell):

powershell -ExecutionPolicy Bypass -File scripts\install.ps1              # Core
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Headless    # + Scrapling headless browser
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Go          # + Go tools
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -All         # + Everything above

---

Step 3 — Register the commands with Claude Code

install.sh installs the OSINT tools. This one-time step wires the skill, the 8 /cti* slash commands, and the MCP tools into Claude Code so they work from a cold prompt in any project — it symlinks commands/*.md into ~/.claude/commands/ and writes the per-machine .mcp.json. It’s idempotent, so it’s safe to re-run after a git pull.

# Register the skill + 8 commands + write the per-machine .mcp.json
bash ~/.claude/skills/cti-expert/scripts/register.sh

# Recommended: install the built-in deep-pipeline (intel_engine) deps once
cd ~/.claude/skills/cti-expert && uv venv && uv pip install -r requirements.txt

Windows (native PowerShell): run register.sh from Git Bash or WSL — it uses symlinks. Then, on every platform, restart Claude Code so the skill and commands load at startup.

---

Verify Installation

claude              # open Claude Code CLI, then type:
/cti-status         # health check — backend tier, MCP tools, API-credit balances
/cti example.com    # …or just start investigating

/cti-status confirms the backend, MCP tools, and API-credit balances in one shot. If the /cti* commands aren’t recognized, re-run Step 3 (register.sh) and restart Claude Code. You can also type /cti-expert to load the skill directly, then describe your goal in plain English.

---

Use in ChatGPT / Codex (cross-agent)

CTI Expert is portable: the analyst logic is plain Markdown and the scripts are OS-detecting Python/shell, so it runs in OpenAI Codex (and other AGENTS.md-aware agents), not just Claude Code.

# 1. Clone the skill anywhere
git clone https://github.com/7onez/cti-expert.git

# 2a. In-repo: open Codex inside the clone — it auto-loads AGENTS.md. Then ask it to follow SKILL.md.
# 2b. Slash command: copy the bundled Codex prompt so /cti-expert works in the Codex CLI/IDE
cp cti-expert/codex/cti-expert.md ~/.codex/prompts/cti-expert.md   # Windows: copy to %USERPROFILE%\.codex\prompts\

• AGENTS.md is the cross-agent runtime contract (OS detection, uv, paths). Codex auto-concatenates it from the repo root; you can also reference it from ~/.codex/AGENTS.md.
• codex/cti-expert.md is a ready-to-copy custom prompt → gives Codex a /cti-expert slash command.
• Plain ChatGPT (no code execution): the reasoning, query generation, and report drafting all work (load SKILL.md/AGENTS.md as instructions or Custom-GPT knowledge); only local steps (DOCX build, CLI tool runs) need a code-capable harness like Codex or Claude Code.

Paths are resolved relative to the skill directory (the folder containing SKILL.md), so nothing assumes the Claude-specific ~/.claude/skills/ location.

---

Alternative — Claude Code Desktop (macOS / Windows)

Download: claude.ai/download — available for macOS and Windows

Step-by-step (no terminal needed):

1. Install Claude Code Desktop — Download from claude.ai/download and install the app

2. Download CTI Expert — Go to the GitHub repository, click the green “Code” button, then select “Download ZIP”

3. Extract to your skills folder — Unzip the downloaded file, then move the extracted folder to your skills directory and rename it to cti-expert:

   Platform	How to navigate
   macOS	Open Finder → Press Shift + Cmd + G → Type ~/.claude/skills/ → Press Go → Move the folder here
   Windows	Open File Explorer → Type %USERPROFILE%\.claude\skills\ in the address bar → Press Enter → Move the folder here

   Note: If the skills folder does not exist, create it inside the .claude folder first.

4. Run the installer + register — Open the Claude Code Desktop terminal and run:

   bash ~/.claude/skills/cti-expert/scripts/install.sh      # OSINT tools
   bash ~/.claude/skills/cti-expert/scripts/register.sh     # skill + 8 commands + MCP
   

   Or on Windows PowerShell (Python deps only; run register.sh from Git Bash/WSL):

   pip3 install -r "$env:USERPROFILE\.claude\skills\cti-expert\scripts\requirements.txt"
   

5. Restart Claude Code Desktop — Close and reopen the app

6. Verify — Type /cti-status in the chat to confirm the skill and commands loaded (or /cti-expert to load the skill directly)

---

Quick Start

How commands work — read this first

There is one command to remember: /cti . It looks at what you gave it — a domain, IP, email, username, phone, wallet, hash, or APK — and runs the right chain automatically. That’s usually all you need.

Under it sit 8 registered commands that Claude Code recognizes from a cold prompt in any project (no need to load the skill first):

Every other command on this page (/case, /webpivot, /report, /sweep…) is a convention command: shorthand that works once the skill is loaded — via /cti, or by typing /cti-expert to open the skill directly. At a cold prompt, reach for a registered command above, or just describe your goal in plain English — it works identically.

1 — Investigate anything

/cti example.com          # domain  → full pipeline
/cti [email protected]      # email   → breach + infrastructure + cross-platform
/cti @username            # handle  → 3000+ platform enumeration, then pivot
/cti 185.1.1.1            # IP      → ASN, co-tenancy, open ports, passive DNS
/cti ./trader.apk         # file    → static IOCs, clustered with the web infra

/cti picks the right techniques for the target, then expands the pivot graph to closure — no approval prompts. Add --deep for parallel sub-agent fan-out, --quick for a single pass, or --passive for hostile targets (no live contact). Default output: Markdown + interactive HTML + JSON + CSV + IOC bundle.

2 — Run a case end-to-end

/cti-recall example.com               # always first — have we seen this seed before?
/cti-case CASE-0001 example.com       # full pipeline on one or more seeds
/cti-cluster CASE-0001                # expand: peers, shared indicators, TLS overlap
/cti-report CASE-0001 --pdf           # deliver: relationship graph + PDF/DOCX

3 — Guided Flows

The commands below are convention commands — type them once the skill is loaded.

/flow person           # Person investigation workflow
/flow domain           # Domain reconnaissance workflow
/flow image            # Image verification workflow

4 — Targeted Reconnaissance

/sweep @username                    # Multi-vector recon on handle
/query example.com                  # 12-15 advanced search queries
/username johndoe                   # Platform enumeration (3000+)
/email-deep [email protected]         # Deep email investigation
/subdomain example.com              # Certificate transparency + brute-force
/github-osint github.com/org/repo   # GitHub profiles, repos, code, commits, forks
/threat-check 185.1.1.1             # IP/domain/URL threat intelligence
/scam-check suspicious-site.xyz     # Phishing/scam domain check
/breach-deep [email protected]        # Multi-source breach lookup

5 — Analysis & Assessment

/exposure domain.com                # Composite risk score (0-100)
/threat-model                       # Build threat model from findings
/validate                           # Verify all findings
/coverage                           # Check investigation completeness

6 — Reporting

/report                             # Technical INTSUM report
/report brief                       # Executive summary
/brief                              # Plain-language summary
/workspace save                     # Save case workspace state (resume later)

---

Best Practices

Habits that keep investigations fast, cheap, and correct — most are enforced by the skill itself, but knowing them helps.

Running a case

• Start with /cti . It’s the single entry point and routes by target type (domain, IP, email, username, phone, wallet, hash, APK). Don’t hand-run collectors.
• Recall before you collect. /cti-recall (or Step 0 of /cti) is the cheapest call in the toolkit — it tells you if a seed is already attributed, saving credits and avoiding contradicting a prior assessment.
• --passive for anything hostile. The egress gate refuses a direct fetch of hostile infrastructure; passive mode works from Wayback/urlscan captures, so your IP never touches it.
• Screen indicators before clustering. /cti-check (false-positive control) — a false merge names an innocent party; a false split loses the case.
• --deep earns its cost at 3+ live seeds (parallel sub-agent fan-out); a single seed runs inline.
• /cti-status when something behaves oddly — backend tier, MCP tools, and API balances in one shot.

Cost & keys

• Two separate ledgers: model reasoning (/cost) vs third-party API credits (api_usage) — never the same number.
• Keyless by default; /apikeys upgrades. Keys enrich pivots (Shodan/Censys/FOFA/…) but nothing requires them.

If you’re developing the skill

• bash scripts/install-hooks.sh once per clone — wires the leak check as a pre-commit hook.
• bash scripts/audit.sh before pushing — the drift/leak/test gate (also runs in CI on every PR).
• A classification change ships with its test (RULE 5).

---

Features

---

AEAD Case Lifecycle

Every investigation follows four automated phases:

                         ╭──────────────────────────────────────╮
                         │         AEAD CASE LIFECYCLE          │
                         ╰──────────────────────────────────────╯

   ┌─── ACQUIRE ────────────────────────────────────────────────────────┐
   │  Collect raw data via /sweep, /query, /username, /phone, etc.     │
   │  Database search, enumeration, collection gap logging             │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ENRICH ─────────────────────────────────────────────────────────┐
   │  Expand leads via /branch, /crossref, /link-subjects, /signatures │
   │  Shared identifier detection, relationship mapping                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ASSESS ─────────────────────────────────────────────────────────┐
   │  Score & verify via /exposure, /threat-model, /validate, /coverage│
   │  Risk scoring, completeness check, evidence chains                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── DELIVER ────────────────────────────────────────────────────────┐
   │  Package output via /report, /brief, /render, /workspace save     │
   │  Auto-saves .md, .html, .json, .csv + IOC set                     │
   └────────────────────────────────────────────────────────────────────┘

Run /progress at any point to see current phase and pending tasks.

Workflow diagrams

End-to-end tool & skill flow — the whole system as one sequence: your target enters at /cti, crosses Layer 1’s 49 techniques and the 24-tool MCP surface, through WebPivot / BinaryPivot / the knowledge base / IntelAnalysis, and leaves as a rendered graph and a PDF:

Full /cti · /case pipeline (AEAD) — the recursive spider-map, and where /webpivot, /icp, /iban and correlation fit:

/webpivot + correlation + premium API-key flow:

Sources: workflow-skills.puml · workflow-case.puml · workflow-apikeys.puml — rendered with PlantUML to SVG in assets/ (vector, so it stays sharp at any zoom and needs no Git-LFS). Re-render after editing a source:

plantuml -tsvg -o assets workflow-case.puml workflow-apikeys.puml workflow-skills.puml
# add -tpng if you need raster copies for slides — note assets/*.png is Git-LFS tracked

See also the API-keys & webpivot guide.

---

Command Reference

The tables below are convention commands — the full technique vocabulary, available once the skill is loaded (via /cti or /cti-expert). The 8 registered entry commands (/cti, /cti-recall, /cti-case…) are in Quick Start above. For the authoritative reference, see SKILL.md.

---

Skill Tiers

Output density and automation adapt to your proficiency. Switch tiers any time — the output changes immediately: /novice enters Novice, /novice off gives you Specialist, and Practitioner is the default in between.

---

Technique Catalog

---

Report Formats

You never have to ask for output. Every /report, /brief, and /case writes the full set automatically — one interactive web page to explore the case, plus machine-readable files for tooling and evidence. Need to share a report outside your team? Add --redact and PII is swapped for stable placeholders (and can be reversed later).

Every report variant is one command — the five-format default set (.md · .html · .json · .csv · IOC bundle) saves automatically on every /report, /brief, and /case; the variants below pick a specific format or audience:

Generated by scripts/generate-cti-html.py (HTML) · scripts/generate-cti-iocs.py (IOCs) · scripts/generate-cti-docx-hybrid.py (DOCX) · intel_engine/IntelReport (pandoc PDF/DOCX)

---

Architecture

---

Professional Workflows

Activate with /flow [type] for interactive guided prompts.

---

Ethics & Responsible Use

This skill is for lawful research and professional security investigation only.

You are responsible for all use of this skill. Comply with local laws, regulations, and platform terms of service. Always respect privacy and consent boundaries.

---

Contributing

We welcome research contributions, new techniques, and workflow improvements.

---

License

MIT License + Ethical Use Addendum

You are free to use, modify, and distribute this skill under the MIT license, provided that you include original attribution, comply with the ethical use guidelines above, and clearly mark any derivatives.

See LICENSE for full text.

---

🙏 Acknowledgments & Credits

CTI Expert stands on the shoulders of the open-source community and free, public-interest data providers. A huge thank-you to every project, vendor, and free API below — this skill simply would not exist without your work. (Listing here does not imply affiliation or endorsement; always respect each provider’s terms of service.)

Built something here we should credit, or want your project’s listing changed/removed? Open an issue or PR — we’ll fix it fast. 💙

---