Imported from 7onez/cti-expert (SKILL.md). Install upstream with npx skills add 7onez/cti-expert. Copyright stays with the author.

CTI Expert

Cyber threat intelligence and open-source intelligence skill. Turns Claude into a trained CTI/OSINT analyst. Generates precision search queries, interprets public data, builds case timelines, and delivers structured intelligence products — no API keys, no paid subscriptions.

Runs anywhere. Works in Claude Code (Desktop & CLI) and in OpenAI Codex / ChatGPT and other AGENTS.md-aware agents — see AGENTS.md for the cross-agent runtime contract. Throughout this file, $SKILL_DIR = the directory containing this SKILL.md (Claude Code: ~/.claude/skills/cti-expert; Codex/manual clone: the repo you are working in). Resolve it by locating SKILL.md — never hard-assume ~/.claude. Detect the OS once (Windows/macOS/Linux) and prefer uv for all Python — see §13 Tool Auto-Install Policy.

Collection method: agent-browser when available (JavaScript-heavy sites, infinite-scroll, screenshot evidence), with automatic fallback to web search / web fetch / direct URL fetch. Tool limitations are logged as collection gaps — never as case blockers.

1. Quick Start

# Full autonomous case — runs every applicable technique
/case target.com

# Guided flow for first-time investigators
/flow person

# Summary of what's been found so far
/brief

Append --yolo to any command to skip all interactive prompts and confirmations. The analyst makes every decision autonomously.

2. AEAD Case Lifecycle

Every investigation follows four phases:

Run /progress at any point to see which phase you're in and what's pending.

/case and web-infra pivoting. For a domain or URL target, /case includes web-infrastructure pivoting (/webpivot) in the Acquire phase. It runs keyless by default (crt.sh + passive DNS + anonymous urlscan) and upgrades automatically when premium keys are set via /apikeys (Shodan/Censys/FOFA/Hunter.how/DNSLytics/SecurityTrails/urlscan-PRO/WhoisXML). With keys the pipeline also: reads the urlscan Pro hostname lifecycle (pre-registration NS/A eras on the timeline, verdict rows in Appendix B), runs the MO-neighbour pivot on the estate's non-CDN origin (co-tenants WHOIS-verified; only a registrant join-key ever seeds, same-MO personas render as a rung-10 Related personas table — --mask-personas to aggregate), measures entitlement (meta.capability.plans, per-case capability_plans.json; Censys' search is its own probe), and fires SecurityTrails DNS-history + DSL reverse-WHOIS, DNSLytics reverse-IP (co-tenancy-filtered), a once-per-case Censys cert search, Shodan cert/JARM search and IntelX (loop: --full only). Every metered leg is --free-only/no_spend-gated; IntelX selectors, WhoisXML/SecurityTrails reverse-WHOIS terms, MO-neighbour origins, DNSLytics reverse-IP and the Censys cert search are bought once per CASE (on-disk memo), while per-host legs (urlscan lifecycle, SecurityTrails subdomains/history, Shodan search) stay per host under per-case caps. Because /webpivot can fetch the target directly, for hostile infrastructure it prefers passive capture (urlscan/Wayback) — see techniques/web-pivot.md. It is not run for username/phone/person targets.

⭐ ChongLuaDao is the first-party premium upgrade. With CHONGLUADAO_API_KEY set (/apikeys set chongluadao <KEY>), Acquire/Enrich fold CLD's own datasets into /scam-check, /threat-check, /phone, /breach-deep, /email-deep, /vuln-check and /impersonate, and /cld <target> is the direct entry point. Your client connects only to ChongLuaDao, never to the target (provable from scripts/cld/cld_api.py); for URL/AI/IP checks CLD does any target fetch server-side — the safe first-touch verdict on a live scam funnel before a direct pivot. Full catalog + AEAD placement: connectors/chongluadao-api.md.

Archive IOC harvest runs by default too. For domain/URL targets the Acquire phase also runs wayback_harvest.py <domain> --indicators (add --urlscan when URLSCAN_API_KEY is set), harvesting emails, phones, crypto wallets, tracking/verification IDs, SaaS-operator IDs, and socials from the entire Wayback history — not just the live page — with first-seen/last-seen per selector. It writes case-schema indicators[] to <case>/raw/harvest.indicators.json, which merge into the case and flow into the auto-saved IOC bundle at Deliver. This is the step that recovers selectors a network later scrubbed — across the whole snapshot corpus, not just the live page. Passive by construction — only web.archive.org (+ urlscan.io if keyed), never the target.

The five v2.6 commands are in the pipeline too — no flags. /icp runs for every domain/URL/org target (and an IP's resolved hostname); /cn-corp, /iban and /hash-id fire the moment a company name/USCC, payment detail, or hash appears — and all three feed their yields back into the recursive pivot loop as new seeds, so an ICP licence serial or a reused bank account expands the graph like any other node. /redact is the exception: it is opt-in (--redact), because a redacted report is a weaker artifact and that should always be a deliberate choice. Full trigger table: §Technique Activation Matrix. Narrow with --no-cn.

Two layers, one skill: broad collector → deep pipeline. cti-expert is the broad collector — the wide net of Acquire/Enrich commands (/webpivot, /sweep, /subdomain, /icp, /username, /email-deep, /breach-deep, …) that pull artifacts from anywhere. The intel_engine engine is now vendored in-repo under intel_engine/ (intel_engine/harness/, intel_engine/tools/, intel_engine/WebPivot/, intel_engine/IntelGraph|IntelReport|BinaryPivot|IntelAnalysis/) and supplies the pipeline chains + deeper pivoting logic: a persistent knowledge base (intel_engine/knowledge/), versioned cases (cases/), cross-case correlation, calibrated assessment, and rendering.

The chain (automatic for /case, and it NEVER re-fetches): broad collection (cti-expert) already ran pivot_extract per host during Acquire. When /backend resolves to Tier 1/2 and the run produced ≥1 host seed (domain/URL/IP), /case hands what it already collected to the deterministic pipeline in reuse mode (--no-collect) — one command, a complete case dir, and nothing touches the target again:

1. Write each host's already-collected pivot JSON to $SKILL_DIR/intel_engine/cases/<CASE-ID>/raw/<host>.json and the host list to an absolute <CASE-ID>-seeds.txt, both anchored at the engine root (ROOT=$SKILL_DIR/intel_engine) — never a CWD-relative path.
2. intel.py pipeline open <CASE-ID> <abs-seeds.txt> --no-collect — --no-collect skips the live fetch and runs the rest of the existing pipeline over the raw you just wrote: ingest → prior-overlap (/recall) → risk (/risk) → shared cluster seeds → clusters.json → case_graph.json → ICD-203 assessment.md. Every step is a KB/local read: zero egress, zero metered calls.

The persisted case lands at $SKILL_DIR/intel_engine/cases/<CASE-ID>/ — raw/, shared.txt, clusters.json, case_graph.json, assessment.md — NOT the current working directory, and it is a COMPLETE case that intel.py pipeline status <CASE-ID> accepts (not the partial dir a hand-rolled op sequence would leave). <CASE-ID> is the same id as the report filenames (mint CASE-YYYYMMDD-NN when none is given). Its cluster/risk/assessment fold back into the auto-saved report. Tier 3 (stateless), or a person/username/phone target with no host seeds → the handoff is skipped silently and the tier noted; broad collection + report are unaffected.

Collecting pipeline open (no --no-collect) stays MANUAL — /case never runs it. intel.py pipeline open without the flag re-fetches every seed directly (collect_many on https://<host>; the egress gate at collect_core.py:169 only fires when hostile is set, which the open path never sets), so a blind auto-open would be a second live round against infra /case may have just classified hostile/no-touch — which is why the automatic handoff uses --no-collect. Run collecting mode by hand only for a fresh case with no prior collection, after setting the egress posture (/scope, /cti-proxy, or --passive).

/harness deepening AUTO-ESCALATES on non-convergence (--no-harness opts out). After the --no-collect pipeline, if the case has not converged — intel.py convergence <case> reports status ≠ converged (cold = no free leads left = exhausted), or intel.py frontier <case> still lists open leads and posture is active (not --passive, infra not classified hostile/no-touch) — /case runs the harness Collect→Correlate→Assess loop to close the gap. Egress stays safe by construction: the harness's own audit.py PreToolUse gate turns hostile=True into a hard denial of outbound collection (harness/README.md), so an escalation can never re-touch no-touch infra — on hostile infra it deepens correlation/assessment only. Model — the CLI's own agent: run interactively in Claude Code, the IntelHarness skill front-end drives the same pipeline on your subscription with no separate LLM key; it falls back to HARNESS_BACKEND=local (Ollama/vLLM/LM Studio, keyless) or an API key only for unattended SDK runs. No reasoning backend reachable and non-interactive → the escalation is skipped and noted as a collection gap, never a blocker. A converged case, --passive, or hostile-only infra → no escalation and the deterministic result stands.

Self-contained & self-resolving. /backend resolves to SELF (in-repo) — no external setup. The bundled installer (scripts/install.{sh,ps1}) provisions the deep layer; or by hand: uv venv && uv pip install -r requirements.txt (harness SDK/MCP + IntelGraph renderers; the collector + KB + deterministic pipeline are stdlib and need none). An explicit $INTEL_HOME still overrides for a shared external KB. Full architecture, the op map, and the evidence-envelope schema: connectors/intel-backend.md.

2.5. Pivot Priority & False-Positive Control (CRITICAL)

Two failure modes ruin a cluster: asserting a link that isn't there, and missing one that is. This section governs both. Apply it in Enrich, before anything reaches a report.

Pivot priority ladder

Work down this ladder. Never assert same-operator on a lower rung when a higher rung is available or contradicts it. Tag every asserted link in the report with the rung it rests on.

Reverse-WHOIS is the highest-yield pivot here. Always mode=preview first — the count is free. A term returning hundreds is shared boilerplate; do not purchase it.

Mandatory false-positive control

Before any indicator becomes a cluster edge, run /reference check <value>. If it returns UNKNOWN, decide and record it with /reference add so the next case inherits the judgement.

Six traps, all of which have produced real false clusters:

Never put an unvalidated indicator into a report that recommends abuse reporting. Naming an uninvolved business is the most damaging error this skill can produce. When a cluster rests on a single rung-7-or-below indicator, label it candidate, single-indicator — not a cluster member.

Never submit the case's own sample to a public sandbox (CRITICAL)

/anyrun is lookup-only: it reads detonations that already happened (anyrun_lookup). The engine does carry a detonation path — anyrun_submit (T1) / bp_anyrun.py submit — but it is gated four ways, and every gate is code, not convention:

1. Per-submission analyst confirmation. anyrun_submit without confirm=true returns the risk briefing and sends nothing; bp_anyrun.submit() refuses unless confirm=True is passed (a function parameter — references/anyrun.json can only make the policy stricter). Show the briefing, ask, and only on an explicit yes to this submission call again with confirm=true. Consent to "analyze this sample" is not consent to detonate it.
2. Private by default, public refused. Privacy defaults to owner; public is refused even with confirm unless allow_public is separately authorised — per call, or as the analyst's standing ANYRUN_ALLOW_PUBLIC=1 in the gitignored .env. With that set, a plan that cannot go private (gate 3 denied) is downgraded to a public task explicitly — the result carries public_task, downgraded_from, public_authorized_by — never silently, and never when the plan can go private. Auto-delete defaults to a week.
3. Free plan fails closed. Pre-flight, before any POST, the engine checks the key's own account record: /user → limits.private (observed live; 0 in any window = denied, and the analyst attestation below cannot override that positive evidence; -1/positive = entitled), else a prior non-public task in the account's history. Neither → refused + plan_evidence, unless the analyst explicitly attests to a paid plan (allow_unverified_plan=true / --i-have-a-paid-plan) — never set it on your own.
4. Post-submit read-back. The task record carries no privacy while the sandbox is running (observed live: a status: "in progress" stub for ~2 min), so after the POST the engine polls the report — bounded to sandbox timeout + 60 s, max 240 s — and, once finished, reads the privacy ANY.RUN actually applied. A forbidden mode is withdrawn (task deleted) and the result says exposed: true. If the task outlives the wait, the result says privacy_verified: null with a verify_command; run it — bp_anyrun.py verify-privacy <uuid> / anyrun_submit with verify_task=true, target=<uuid> — to finish the check and the withdrawal. Either way this is detected, not prevented: deletion does not un-publish what the feed already showed, so treat the infrastructure as tipped.

The harness adds a fifth: audit.gate() denies anyrun_submit outright unless the run was launched with HARNESS_ALLOW_SUBMIT=1. tests/test_no_sample_submission.py asserts the gate is both marked and enforced and that no upload machinery exists outside it; intel_engine/tools/eval/test_intelx_anyrun.py §7b–7c exercises every refusal, the plan proof, the attestation path and the read-back.

Do not work around any of it. Uploading the case's own APK / installer / archive to ANY.RUN — or VirusTotal, or any public sandbox — is an outbound, irreversible act:

• A public task is world-readable: the file, its hash, screenshots and full network log.
• Operators watch for their own samples. The standard response is to rotate the backend, revoke the signing key and re-skin the front — destroying the infrastructure the case is built on, often days before a takedown or referral can land.
• It cannot be recalled. Deleting a task does not un-publish what was already seen.
• A URL detonation fetches the live target from published sandbox egress: the operator learns it was sandboxed, and a "clean" verdict may be the decoy served to datacenter IPs.

Try first, and say what you tried: static analyze_artifact, then an existing detonation of the hash (anyrun_lookup, VirusTotal, MalwareBazaar, Triage, Koodous). Prefer the downloaded FILE over the live URL. Never put a case ID or an analyst/client name in tags or the filename. Never on standing permission inferred from an earlier approval, never as a side effect of a pivot. The same reasoning governs --submit (urlscan/Wayback): a public urlscan scan of a live scam funnel is visible to the operator too.

A permuted email is a hypothesis, never a finding (CRITICAL)

When a case yields a real person's name or a username, and you already hold a domain that matters to the case, run /email-permute. An operator's mailbox is almost never published, but it is usually derivable — mail hosts use a small set of local-part conventions, and the operator's own domain is the highest-yield thing to permute against.

That value comes with a matching hazard, so this rule is absolute:

• Permute against the case's own domains. Name × the operator's domain is a narrow, high-prior question. Name × gmail.com is volume with no prior behind it — --free exists, is capped, and should be a deliberate choice, not a reflex.
• Never ingest a candidate into the KB, cite one in a report, or contact one. A fabricated address that reaches kb_ingest becomes a shared indicator, and a shared indicator merges two operator clusters. A permutator wired straight into correlation does not enrich a case — it silently names an innocent party. This is the same failure RULE 5 exists to prevent.
• Candidates are not seeds. They never enter the spider-map frontier. Only an address in the tool's promote list — corroborated by independent evidence (Gravatar registration, breach corpus, a GitHub commit, a page/DOM hit, a dork) — may be treated as a real email seed, and that promotion is an analyst decision.
• Never validate over SMTP. RCPT TO probing connects to the target's mail server, which the egress posture exists to prevent on a hostile case; and a catch-all domain answers 250 for every address ever tried, so it manufactures confidence instead of measuring it. Use --verify, which gates on MX (RFC 7505 null MX included) and checks Gravatar — both keyless, neither touching the target.

State the status in the turn. "12 candidates, 0 corroborated" is an honest result; presenting those 12 as discovered addresses is not.

Dead seed? Do not stop

Zero pivots, a parked page, or NXDOMAIN is not an answer. Run /fallback <domain> — crt.sh, the full Wayback timeline, archive.today, and the local KB. A parked apex frequently has live subdomains: enumerate CT and the Wayback CDX host histogram before writing a seed off. Report an empty result as empty; a collector that returned nothing is a finding, not something to omit.

Egress control — proxy / rotation

On a hostile case your egress IP is a selector too — a direct fetch of scam infrastructure exposes your real address to the operator, and repeated lookups from one IP get you rate-limited or fingerprinted. The /cti-proxy layer routes every HTTP(S) request the collectors make (keyless crt.sh, Wayback/CDX, urlscan, the CLD connector, WHOIS, analytics reverses, /apikeys test) through a configured proxy — or a rotation pool with automatic failover — so collection egresses from an IP you choose, and successive calls can egress from different ones. It also tunnels the collector's raw-socket TLS cert probe (/cert-pivot leaf fingerprint) via CONNECT, failing closed rather than dialling direct.

Raw-socket TLS probes are handled too — nothing dials the target directly behind a proxy. The cert-SHA probes (wp_pssl.py, wp_recon.py) and JARM (jarm.py) all take their socket from cti_proxy.proxied_connection: under an HTTP pool it is CONNECT-tunnelled and fails closed (never a direct dial); under a SOCKS pool the in-process socket hook carries it (installed at import via wp_common, and jarm.py's own bootstrap) when PySocks is present in that interpreter — if it is not (e.g. the intel.py pipeline runs tools under $INTEL_PY), the hook is absent and these probes fail closed instead of leaking, so install pysocks there; with no proxy it dials direct. As a policy choice the /webpivot analyze path additionally skips JARM under an HTTP pool (ten tunnelled handshakes are slow) and runs it under SOCKS / no proxy — that gate honors the env/pool proxy, not just an explicit --proxy.

uv run scripts/proxy/proxy.py add http://user:pass@host:3128 --label res-1
uv run scripts/proxy/proxy.py add 1.2.3.4:8080        # bare host:port -> http://
uv run scripts/proxy/proxy.py rotation round-robin    # | random | sticky | off
uv run scripts/proxy/proxy.py test                    # confirm each proxy's egress IP
uv run scripts/proxy/proxy.py status                  # pool + policy + toggles
uv run scripts/proxy/proxy.py disable                 # back to the real IP

• It is opt-in and additive — with no proxy configured the skill runs exactly as before, from your real IP. A pool, once added, is enabled by default.
• No-leak default: with a pool set, a failed pool is not silently retried direct — turn that on deliberately with allow-direct on.
• Precedence: env CTI_PROXY / CTI_PROXIES (and standard HTTPS_PROXY) override the stored pool for a one-off session; the store lives in scripts/proxy/proxies.json (gitignored, chmod-600 — it may hold credentials).
• Coverage: the broad collectors (scripts/…) get full in-process rotation + failover; the deep pipeline (/backend, /pipeline, /harness) inherits the egress for every tool it spawns (one proxy per run). For an ad-hoc tool call or the MCP server, export first: eval "$(python3 scripts/proxy/proxy.py use)".
• Formats: add accepts a full URL, a bare host:port, a provider host:port:user:pass export, a user:pass@host:port authority, or a pasted http_proxy="…" line. HTTP/HTTPS get the full rotation + failover + no_proxy behavior; socks5:///socks5h:// auto-install PySocks on add but rotate only per run — no in-process failover, and no_proxy is not enforced (the global socket hook routes everything).
• Full reference: /cti-proxy (commands/cti-proxy.md).

3. Command Reference

How to read this table — check the marker before you announce a command.

Marker	Meaning	What you may say
T2: / T1: shown	Backed by a real CLI op and/or MCP tool.	Call it, then report what it returned.
[model]	No code behind it, and none is needed — it names a way for you to work (a summary style, a checklist, a KB read-back).	Do the thing. Never claim a tool ran.
[unimplemented]	The tradecraft is documented but nothing executes it yet.	Say so, then follow the linked technique by hand. Do NOT narrate it as a tool call.

A command with no marker and no T2:/T1: line has not been triaged yet — treat it as [unimplemented]. Announcing a tool call that cannot happen is the failure this table exists to prevent: the output looks identical to real collection and is not.

3.0 Entry point & registered commands

/cti <target> is the single entry to this skill. It routes any target type — domain, IP, email, username, phone, wallet, hash, APK — through recall → collect → cluster → assess. Plain English works identically ("analyze example.com and pivot the infrastructure"); the command form just removes ambiguity.

/case <target> is an alias of /cti <target> — the same full pipeline run; /cti is the canonical entry (and the only form that works from a cold prompt). Prefer /cti.

Nine commands are registered with Claude Code by bash scripts/register.sh and work from a cold prompt in any project:

Every other /command in §3 is a convention read from this file, not a registered command. Once the skill is loaded they are unambiguous instructions; typed at a cold prompt they do nothing. When in doubt use /cti and describe the goal.

Three layers, one operation. The same capability is reachable three ways and the names differ by layer — T0 uses kebab-case after a slash, T2 uses kebab-case ops, T1 uses snake_case tools. The table above is the canonical mapping; when you add a capability, add a row here in the same commit or the layers drift apart again.

Capabilities that are not registered commands still carry their layer mapping inline in the §3 tables. The engine's WebPivot/BinaryPivot collectors add these: /capabilities (T2 capabilities, T1 capability_check), /impersonate (T2 impersonate, T1 impersonation_hunt), /search-pivot (T2 search-pivot, T1 search_pivot), /censys (T2 censys, T1 censys), /intelx (T2 intelx, T1 intelx_search) and /anyrun (T2 anyrun, T1 anyrun_lookup).

Commands grouped by AEAD phase.

Acquire

| /dork-sweep [target] [--telegram\|--docs\|--filetype\|--all] [--after DATE] [--clean] | Zero-auth dork sweep: Telegram ecosystem, 18 doc-hosts, filetype families; 4-tier fallback cascade T2: intel.py dork-sweep <target> | /dork-sweep example.com --filetype | | /docleak [target] [--platform list] [--severity high] | 18-platform document leak hunt with severity classification (CRITICAL/HIGH/MEDIUM/LOW) T2: intel.py docleak "<target>". T1: dork_builder — emits queries, never runs them | /docleak "Acme Corp" |

| /dns-history [domain] | Historical DNS record changes (A, NS, MX) via passive DNS T2: intel.py dns-history <domain>. T1: wayback_ga | /dns-history example.com | | /cert-history [domain] | SSL/TLS certificate timeline from CT logs (crt.sh) T2: intel.py cert-history <domain>. T1: passive_ssl | /cert-history example.com | | /proton-check [email] | Proton Mail account creation date via PGP key [unimplemented] | /proton-check user@proton.me | | /pgp-lookup [email] | PGP key search — creation date, UIDs, signatures [unimplemented] | /pgp-lookup dev@example.com | | /wifi [ssid] | WiFi SSID geolocation via Wigle.net T2: intel.py wifi "<ssid>". T1: wifi_ssid — needs a WiGLE account; discloses the gap | /wifi "HomeNetwork" | | /wifi --bssid [mac] | Exact AP lookup by MAC address | /wifi --bssid AA:BB:CC:DD:EE:FF | | /register [name] | Add a subject to the case workspace | /register JohnDoe | | /snapshots [url] | List/fetch archived Wayback snapshots. WebFetch is blocked from web.archive.org (robots.txt) — this reads the archive instead, so the request never reaches the target. T2: intel.py wayback-fetch <url> [--near latest\|earliest\|YYYY] [--list]. T1: wayback_fetch. See analysis/archive-explorer.md | /snapshots example.com | | /archive-harvest [domain] | Sweep a domain's whole Wayback history for indicators an operator has since scrubbed — the GA ID that clusters the estate is often only in an old capture. T2: intel.py wayback-harvest <domain> --indicators [--from YYYY --to YYYY]. T1: wayback_harvest | /archive-harvest site-a.example | | /fallback [domain] | Dead-seed recovery (§2.5) — crt.sh + full Wayback timeline + archive.today + local KB when a seed returns zero pivots / parked / NXDOMAIN; enumerates CT + Wayback host history before a seed is written off. T2: fallback · T1: fallback_probe | /fallback scam-site.top |

Enrich

Assess

Deliver

UX & Navigation

Configure

Truncated - read the full file at https://github.com/7onez/cti-expert/blob/d0a4f079065e41b745e1d657ab794f73036f8983/SKILL.md.