CTI Expert skill
A cyber threat intelligence and OSINT skill: structured investigations, domain and breach recon, analyst-grade reports
- 624 ★ on the repository
- Last commit
Broad access
Why this level
- A recon and OSINT tool: use only on your own assets or with explicit authorization, not against others' resources or people
- It runs Python, installs tools and reaches many external services
Install
- Works in
Manual install
/plugin marketplace add 7onez/cti-expert
/plugin install cti-expertInstalls the skill with commands, MCP tools and hooks.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- A recon and OSINT tool: use only on your own assets or with explicit authorization, not against others' resources or people
- It runs Python, installs tools and reaches many external services
This is third-party code. Review the repository files before installing.
What it does
The skill turns the agent into a cyber threat intelligence and OSINT analyst with a clear working cycle. It builds precise search queries, runs a case through collection and enrichment phases and recursively expands discovered identifiers into a link graph. The set covers domain, subdomain, DNS and certificate recon, infrastructure pivoting, enumeration by name, email and phone, breach and log triage, image forensics and geolocation. Results are shaped into structured reports with cited sources and trust scoring. The core works without keys or paid subscriptions, while separate connectors add external services.
Who it is for. For security and investigation specialists who run authorized OSINT and threat analysis.
Good fit when
- You run an authorized investigation of a domain, infrastructure or incident
- You need to review your own organization's digital footprint and exposure
- You need a structured report with sources and trust scoring
Not a fit when
- You have no authorization to investigate the target: use it only on your own assets or with the owner's permission
- The goal is stalking a person or collecting data without a lawful basis
- You need substantive fact-checking rather than recon of footprint and traces
Example request
Review my domain's external exposure and compile a report on subdomains and certificatesLimitations
The skill is execution-heavy: it runs Python via uv, installs OSINT tools, writes reports in several formats and reaches many external sites, so it needs a real local shell with network access, not an ephemeral cloud sandbox. Some connectors and services require their own keys, and the reachability of external sources from your network is worth checking. The tool provides material for analysis; legal and ethical responsibility for its use stays with the operator.
How to disable. Uninstall the plugin via /plugin or remove the cti-expert folder from your agent's skills directory. Disable the added hooks in client settings.
FAQ
Are paid APIs required?
Core commands work without keys or subscriptions. Separate connectors add external services that have their own keys and limits.
Where should it run?
The author recommends a CLI or a local desktop agent with a real shell and open network; an ephemeral cloud sandbox does not fit.
Discussion
No questions or reviews yet.
Related
SkillsA set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
The Hunter (RZK)
RZK-The-Hunter
A skill for open-source investigations that takes a question from hypothesis to verified facts and keeps the evidence trail.
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
The SecKnowledge skill loads a web-vulnerability and AI-app risk knowledge base into an agent for security testing of a target.
README in short
The README describes CTI Expert as a cyber threat intelligence and OSINT skill for Claude Code and Codex that runs a case lifecycle with collection and enrichment phases. It lists dozens of commands and techniques, recursive pivoting on discovered identifiers and reports built to analytic standards with cited sources. The core needs no keys, while separate connectors add external services. It has safeguards: hooks that fail open and confirmation rules for sensitive actions. It installs as a plugin via a marketplace or by cloning into the skills directory.
README badge
Original SKILL.md
--- name: cti-expert description: "Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, domain/subdomain/DNS/certificate recon, web-infrastructure pivoting, username/email/phone enumeration, breach and infostealer-log triage, image forensics, geolocation, and structured reporting." version: "2.12" author: "Hieu Ngo - chongluadao.vn" --- # CTI Expert Cyber threat intelligence and open-source intelligence skill. Turns Claude into a trained CTI/OSINT analyst. Generates precision search queries, interprets public data, builds case timelines, and delivers structured intelligence products, no API keys, no paid subscriptions. > Runs anywhere. Works in Claude Code (Desktop and CLI) and in OpenAI Codex / ChatGPT and other AGENTS.md-aware agents. Throughout this file, $SKILL_DIR is the directory containing this SKILL.md. Resolve it by locating SKILL.md, never hard-assume ~/.claude. ## 1. Quick Start ```bash /case target.com /flow person /brief ``` ## 2. AEAD Case Lifecycle Every investigation follows four phases: Acquire, Enrich, Analyze, Deliver. Acquire and Enrich iterate, not run once.