CTI Expert

Cyber Threat Intelligence & OSINT Analysis Toolkit

Transform Claude into a trained intelligence analyst — 74+ commands, 40 techniques, zero API keys required for core functionality.

Built by Hieu Ngo • [email protected] • chongluadao.vn

What is CTI Expert?

A Claude Code skill that transforms Claude into a trained cyber threat intelligence and open-source intelligence analyst. It runs structured intelligence collection using 74+ commands across 40 techniques — no API keys required for core functionality. To take full advantage, add your own free or paid API keys to the skill's .env — each is auto-detected and unlocks higher-tier access (e.g., Wigle, VirusTotal, URLScan.io, Shodan, Censys, SecurityTrails, WhoisXML).

[!TIP] Keyless by default — more powerful with your keys. Everything runs with zero keys. To unlock the skill's full power, drop any free or paid API keys into .env (or run /apikeys set <service> <KEY>); they're auto-detected and immediately upgrade /webpivot and other techniques with reverse favicon→host, passive DNS, cert search, and sibling-domain pivots. Missing or bad keys just degrade to a note. Full list & setup: handbook/api-keys.md.

Core Capability

Multi-vector reconnaissance on any target type — person, domain, organization, username, email, IP, WiFi — with automated finding validation, exposure scoring, and structured intelligence delivery.

AEAD Workflow

Acquire raw data → Enrich with pivot expansion → Assess findings → Deliver structured reports (interactive HTML + Markdown + JSON/CSV + IOC bundle; Word on request).

Demo

Full Case Investigation

CTI Report Generation

Screenshots

INTSUM Report	Network Topology	Risk Assessment

What's New in v2.6

Category	What's New	Details
`/case` runs unattended	Pivot loop defaults to `autonomy=auto`; the new recon commands auto-fire	The spider-map now expands to closure without approval prompts — the confidence gate, not a human prompt, is what keeps expansion tight (exact-match links auto-pursue, weak links held, dedup + depth caps unchanged). Depth summaries still print, so the run stays auditable. And the v2.6 recon commands are in the pipeline with no flags: `/icp` on every domain/URL/org target, `/cn-corp` on any company name or USCC found, `/iban` on any payment detail, `/hash-id` on every hash (before `/hash`) — and all three discovery-driven ones feed their yields back into the loop as new seeds. `/redact` stays opt-in (`--redact`): a redacted report is a weaker artifact, so producing one should be a deliberate call. Narrow with `--checkpoint`, `--no-cn`, `--reach balanced\|focused`, `--depth N`
China / Sinophone recon	`/icp` + `/cn-corp` — the attribution layer Western registries can't reach	ICP filing (工信部备案) maps a domain to its registered PRC entity, and the licence serial reverse-pivots to every sibling site under the same filing — a same-operator link as strong as a shared GA ID. Then the registry chain: GSXT (ground truth) → TianYanCha/QCC/Aiqicha → 信用中国 blacklist → UBO, with USCC validation and revoked-status flags. Adds Quake (360) and ZoomEye as independent cyberspace indexes, a Baidu tier for `/dork-sweep` (tiers 1–4 index almost no CN content), and CJK variant generation — pinyin, Simplified↔Traditional and company-name stems — as a new `/pivot-suggest` axis. See `techniques/china-recon.md`
Fiat payment rails	`/iban` — bank accounts become selectors, like wallets already were	Most victims never touch crypto — they make a bank transfer. `iban_analyze.py` runs ISO 7064 mod-97 validation (proving a "bank account" on a payment page is fabricated without contacting anyone), decomposes the BBAN into bank/branch/account, and flags jurisdiction mismatch — the classic beneficiary-abroad mule pattern. Validated accounts export as `financial/iban` IOCs; invalid ones are recorded as behavioural findings. Covers VN/SEA non-IBAN rails too: VietQR/NAPAS BIN, card BIN, e-wallets, BIC. See `techniques/fiat-payment-osint.md`
Shareable reports	`/redact` — reversible PII redaction	`redact.py` replaces PII with stable numbered placeholders (`[EMAIL_1]` means one address across the whole case) and writes a reversible JSON map, so a report can leave the organisation and still be reconstituted for evidence. Handles `.md`/`.json`/`.csv`; round-trip is byte-exact. Infrastructure is not redacted by default — in a CTI report the actor's domains are the analysis, not incidental PII
Analytic rigor	Probability-anchored likelihood + 5W1H + ACH	Judgments now carry likelihood terms with probability bands (almost no chance → almost certain) reported alongside evidence confidence, because "MODERATE" alone means a 30-point-different thing to writer and reader. `/coverage` gains a 5W1H pass — a technique matrix measures effort, so a case could score 96% while answering no Why or How. `/threat-model` now requires an ACH matrix for attribution: rival hypotheses scored by inconsistency, runner-up named, and the evidence that would change the ranking stated. See `handbook/analytic-standards.md`
Hash typing	`/hash-id` — before any hash lookup	32 hex is MD5 or NTLM — one is a file hash, the other is credential material, and querying the wrong service returns a confident "unknown sample" that reads as exculpatory. Routes file hashes to MalwareBazaar/VT and credential hashes to `/breach-deep`, never a public cracking service

What's New in v2.5

Category	What's New	Details
Recursive pivoting	`/case` is a spider-map — expands the whole network	`/case` now runs a recursive BFS pivot engine (`pivot_orchestrator.py` + `engine/pivot-orchestration.md`): every discovered identifier (email/domain/IP/username/wallet/…) becomes a new seed and the relationship graph expands hop-by-hop until the frontier is exhausted. Confidence-gated (exact-match links auto-pursue, weak/PII links held), cycle-safe (dedup + depth caps), with per-depth checkpoints. Defaults: active · exhaustive · checkpoint-per-depth
Archive IOC harvest	`/webpivot --harvest` — every selector the site ever exposed	`wayback_harvest.py` runs the full extractor over a domain's entire Wayback history, merging emails, phones, crypto wallets, tracking/verification IDs, SaaS-operator IDs and socials with first-seen/last-seen — recovering selectors a network later scrubbed. Emits case-schema `indicators[]` straight into the IOC bundle; auto-runs in `/case` for domain/URL targets. `/webpivot` now also extracts phone numbers (`tel:` + formatted) as ranked pivot leads
Archive access	Fetch archived pages Claude Code's WebFetch can't reach	WebFetch is blocked from `web.archive.org` (robots.txt at the fetch layer). `wayback_fetch.py` routes around it — CDX lookup → nearest-snapshot resolve → raw `id_` fetch, with retry/backoff (`--near`, `--list`, `--url-only`, `--json`)
Web pivoting	`/webpivot` — map the infra behind a page	Favicon mmh3, GA/GTM/AdSense IDs, wallets & SaaS-operator tokens from a page's DOM → ranked pivots; same-operator correlation via `/rank-relations` (weighted scoring + noise denylist), `/cert-pivot`, `/pivot-suggest`, `/crypto-balance`, `/email-hygiene`, `/sensitive-paths`. Auto-runs in `/case` for domain/URL targets
Keyless by default	100% free — no key, no signup	crt.sh (certificate transparency) + passive DNS + anonymous urlscan always run; full pivoting at zero cost, nothing to configure
Premium auto-detect	Drop in a key → it upgrades itself	`/webpivot` auto-detects any premium key you've set (Shodan, Censys, FOFA, DNSLytics, SecurityTrails, urlscan-PRO, WhoisXML) and unlocks its higher tier — no flag, no re-run; a missing/bad key degrades to a note, never breaks the run. Manage keys with `/apikeys`
Attack surface	`/appliance-scan` — edge/VPN appliance → KEV mapping	Passive-first fingerprint of internet-facing Citrix/F5/Cisco/Ivanti/Forti/Palo Alto/Exchange appliances (Shodan InternetDB/Censys) → matched CISA KEV/CVE list; feeds `/vuln-check` + `/threat-model`
Identity fabric	`/saas-map` — SaaS tenancy + IdP surface	DNS-TXT tenancy tokens (Google/Atlassian/Zscaler/Salesforce/Workday…), non-Microsoft IdP fingerprint (Okta/Auth0/OneLogin/Ping/Keycloak/ADFS), unauthenticated API/GraphQL/OpenAPI-spec discovery
Credentials	Read-only liveness validation	A discovered key is confirmed live via identity-only endpoints (AWS STS, GitHub scopes, Slack `auth.test`, `…/v1/models`) — never a mutating call — upgrading it to CRITICAL with account/scope evidence
Integrity	Evidence-gated analysis	every asserted claim cites a resolvable finding; untrusted collected data is tagged, never executed
Recon	Native `asn` command	Keyless IP/ASN/domain lookups (ipwho.is + RDAP) on Windows; full nitefood/asn auto-installed on Linux/macOS/WSL
System tools	`whois` + `dig` + `asn` auto-install on Windows	winget `Microsoft.Sysinternals.Whois` + `ISC.Bind`; previously manual steps
Reliability	Windows PowerShell 5.1 hardening	Fixes native-stderr script aborts, the `OSArchitecture` probe crash, and maigret via `uv tool --force`; installs clean on WinPS 5.1
Packaging	Auto-PATH for CLI tools	`~/.local/bin` (uv tools + `asn`) added to PATH automatically — current session and persistent

What's New in v2.4

Category	What's New	Details
Platform	Cross-platform OS detection (Windows/macOS/Linux)	OS-aware auto-install; self-healing DOCX (UTF-8 + auto-located pandoc)
Packaging	uv-first toolchain	`uv venv` / `uv pip` / `uv tool`; PEP 723 `uv run` zero-setup scripts; pip/pipx/venv fallback
Portability	Cross-agent support	Runs in Claude Code and OpenAI Codex via `AGENTS.md` + a ready-to-copy `/cti-expert` Codex prompt
CTI	Infostealer-log analyzer (`/stealer-log`)	Family ID, victim-vs-operator profiling, cross-log actor correlation, IOC + raw-artifact extraction
Recon	Admin / sensitive-endpoint detection	Subdomain-prefix + path + CJK classifier (`admin`, `adm`, `kef`, `ador`, `panel`…)
Collection	agent-browser integration	Primary interactive browser (vercel-labs): CDP, accessibility-tree snapshots, screenshots; complementary to Scrapling, no API key for core
Reliability	Fresh-VPS install hardening + CI	root/sudo + prereq bootstrap; smoke test + GitHub Actions on a minimal root Ubuntu container

What's New in v2.3

Category	What's New	Details
WHOIS	Universal WHOIS for all TLDs	whoisdomain + CLI + Whoxy API; .vn, .th, .sg, .kr, 27+ ccTLD servers
WHOIS	Reverse & historical WHOIS (free)	Whoxy reverse API, historical lookup, ViewDNS
Web Collection	Scrapling adaptive scraping	3-tier: static → anti-bot → JS rendering; headless auto-open
Web Collection	Headless browser auto-open default	JS-heavy sites auto-detected and rendered via DynamicFetcher
Orchestration	AgentFlow parallel enrichment	DAG-based parallel pivot expansion for 3+ subjects
Performance	HTML parsing ~2ms	Scrapling parser replaces slow HTTP scraping
Platform	Python 3.10+ minimum	Required by Scrapling and AgentFlow

What's New in v2.2

Category	What's New	Details
Image Forensics	Face search, reverse image, manipulation detection, AI geolocation	FaceCheck.id, TinEye, FotoForensics, Forensically, picarta.ai, GeoSpy, Pic2Map
Blockchain	Crypto wallet tracing, transaction graphs, scam detection	Blockchair, Etherscan, WalletExplorer, OXT.me, Chainabuse, Breadcrumbs
Transport	Aircraft tracking (unfiltered), vessel AIS, vehicle VIN lookup	ADS-B Exchange, Flightradar24, Marine Traffic, VesselFinder, NICB VINCheck
Darknet	Tor search, ransomware monitoring, onion service discovery	Ahmia.fi, onionsearch, DarknetLive, ransomwatch
Social Media	Reddit, Instagram, TikTok, Telegram investigation	Osintgram, instaloader, toutatis, RedditMetis, TGStat, TelegramDB, Bellingcat TikTok Timestamp
People Search	US people search engines, free reverse lookups	TruePeopleSearch, FastPeopleSearch, IDCrawl, That's Them
Mega-Dorks	11 cross-platform Google dork templates covering 73 unique domains	Social, Telegram ecosystem, dev platforms, forums, paste sites, darknet, breach DBs, business, image, messaging, jobs
IoT	Webcam directories, IoT device search	Insecam, Thingful

Category	New Commands	What It Does
Intelligence	`/cti-expert /render threat-path`, `/cti-expert /render attack-surface`	Attack path flow + infrastructure exposure visualization
Intelligence	`/cti-expert /snapshots`, `/cti-expert /diff`	Wayback Machine snapshots and version diffing
Intelligence	`/cti-expert /drift`, `/cti-expert /report ioc`	Temporal risk tracking + IOC export (STIX 2.1)
UX	`/cti-expert /onboard`, `/cti-expert /clarify`, `/cti-expert /quality`	First-time tutorial, finding explanation, quality scoring
UX	`/cti-expert /blind-spots`, `/cti-expert /source-check`	Gap analysis + batch URL verification
UX	`/cti-expert /workspace diff`	Compare two saved investigation sessions
Data Model	Source Reliability A-F	Complements trust scores with source-level grading
Data Model	4 new entity types	Device, Image, Crypto Address, Custom
Data Model	HIGH conflict severity	4-level severity: CRITICAL/HIGH/NOTABLE/MINOR

Installation

Recommended: Use Claude Code CLI — it gives you the full terminal workflow, persistent sessions, and direct skill invocation. Download here or run npm install -g @anthropic-ai/claude-code.

Why Claude Code CLI?

The entire CTI Expert workflow is optimized for Claude Code CLI. The CLI gives you:

Persistent sessions — investigations survive terminal restarts via /cti-expert /workspace save
Full tool access — file writes, Python scripts, DOCX generation, all run natively
Skill invocation — type /cti-expert directly in the terminal, no browser required
Background agents — parallel enrichment via AgentFlow works best with the CLI

🖥️ Where to run it — the CLI is best for this skill

[!IMPORTANT] CTI Expert is execution-heavy: it runs uv/Python, installs OSINT tools, writes .md/.html/.json/.csv reports + IOC bundles, reaches many external sites, and saves case workspaces. What matters is a real local shell + persistent files + open network — a CLI or local desktop agent gives you that; an ephemeral cloud sandbox does not. This applies equally to Claude and Codex.

Environment	Running cases	Why
Claude Code CLI · Codex CLI	✅ Best	Real shell, persistence, background tasks, open network — what the skill is built for
Claude Code Desktop · Codex IDE extension	✅ Great	Same local execution; nicest for reading rendered reports, charts & diagrams
claude.ai/code (web) · Codex cloud / ChatGPT web	⚠️ Limited	Reasoning & query generation work, but files don't persist to your disk and outbound network is often restricted

[!TIP] Run investigations in a CLI (Claude Code or Codex); open the generated .docx/report in a Desktop/IDE window if you prefer reading there. Use web/cloud surfaces only for analyst-reasoning, not execution-heavy recon.

Step 1 — Install Claude Code CLI

npm install -g @anthropic-ai/claude-code

Requires Node.js 18+. Full docs: docs.anthropic.com/en/docs/claude-code/overview

Step 2 — Clone + All-in-One Installer

The installer handles everything: Python dependencies, system tools (whois, dig, asn, jq, exiftool), OSINT tools (maigret, sherlock, holehe, h8mail, and more), and optional headless browser + Go tools. It is powered by uv (Astral's ultra-fast Rust package manager) — the script bootstraps uv, then uses uv venv / uv pip / uv tool for all Python installs, falling back to pip/pipx/venv only if uv can't be installed. Use install.ps1 on Windows (PowerShell) or install.sh on macOS/Linux/Git Bash/WSL.

git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
bash ~/.claude/skills/cti-expert/scripts/install.sh

git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
bash ~/.claude/skills/cti-expert/scripts/install.sh

git clone https://github.com/7onez/cti-expert.git "$env:USERPROFILE\.claude\skills\cti-expert"
powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.claude\skills\cti-expert\scripts\install.ps1"

Windows users: install.ps1 is a full native installer (winget system tools + Python venv + OSINT tools) — no Git Bash or WSL required. It accepts the same -Headless, -Go, and -All flags (e.g. install.ps1 -All). Git Bash / WSL users can run install.sh instead. The DOCX generator self-heals UTF-8 output and auto-locates pandoc, so reports build on Windows with no extra environment setup. The skill itself detects the OS at runtime and installs any missing tool with the right manager (winget / brew / apt) — see scripts/platform-setup.md.

Installer Options

macOS / Linux / Git Bash / WSL:

bash scripts/install.sh               # Core: Python deps + system tools + OSINT tools
bash scripts/install.sh --headless    # + Scrapling headless browser (~200MB Chromium)
bash scripts/install.sh --go          # + Go tools (subfinder, amass, gau, gitleaks, httpx)
bash scripts/install.sh --all         # + Everything above

Windows (PowerShell):

powershell -ExecutionPolicy Bypass -File scripts\install.ps1              # Core
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Headless    # + Scrapling headless browser
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Go          # + Go tools
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -All         # + Everything above

Flag	What it installs	Size
(none)	Python packages, whois, dig, asn, jq, exiftool, maigret, sherlock, holehe, h8mail, theHarvester, waymore, xeuledoc, agentflow	~50 MB
`--headless`	Scrapling StealthyFetcher + DynamicFetcher + Chromium	+200 MB
`--go`	subfinder, amass, gau, gitleaks, httpx, trufflehog, phoneinfoga	+150 MB
`--all`	Everything	~400 MB

Verify Installation

claude   # opens Claude Code CLI
# then type:
/cti-expert

If the skill loads, you'll see the CTI Expert command menu. Type /cti-expert /help for the full command list.

Use in ChatGPT / Codex (cross-agent)

CTI Expert is portable: the analyst logic is plain Markdown and the scripts are OS-detecting Python/shell, so it runs in OpenAI Codex (and other AGENTS.md-aware agents), not just Claude Code.

# 1. Clone the skill anywhere
git clone https://github.com/7onez/cti-expert.git

# 2a. In-repo: open Codex inside the clone — it auto-loads AGENTS.md. Then ask it to follow SKILL.md.
# 2b. Slash command: copy the bundled Codex prompt so /cti-expert works in the Codex CLI/IDE
cp cti-expert/codex/cti-expert.md ~/.codex/prompts/cti-expert.md   # Windows: copy to %USERPROFILE%\.codex\prompts\

AGENTS.md is the cross-agent runtime contract (OS detection, uv, paths). Codex auto-concatenates it from the repo root; you can also reference it from ~/.codex/AGENTS.md.
codex/cti-expert.md is a ready-to-copy custom prompt → gives Codex a /cti-expert <target> slash command.
Plain ChatGPT (no code execution): the reasoning, query generation, and report drafting all work (load SKILL.md/AGENTS.md as instructions or Custom-GPT knowledge); only local steps (DOCX build, CLI tool runs) need a code-capable harness like Codex or Claude Code.

Paths are resolved relative to the skill directory (the folder containing SKILL.md), so nothing assumes the Claude-specific ~/.claude/skills/ location.

Alternative — Claude Code Desktop (macOS / Windows)

Download: claude.ai/download — available for macOS and Windows

Step-by-step (no terminal needed):

Install Claude Code Desktop — Download from claude.ai/download and install the app
Download CTI Expert — Go to the GitHub repository, click the green "Code" button, then select "Download ZIP"

Extract to your skills folder — Unzip the downloaded file, then move the extracted folder to your skills directory and rename it to cti-expert:

Platform	How to navigate
macOS	Open Finder → Press Shift + Cmd + G → Type `~/.claude/skills/` → Press Go → Move the folder here
Windows	Open File Explorer → Type `%USERPROFILE%\.claude\skills\` in the address bar → Press Enter → Move the folder here

Note: If the skills folder does not exist, create it inside the .claude folder first.

Run the installer — Open Claude Code Desktop terminal and run:

bash ~/.claude/skills/cti-expert/scripts/install.sh

Or on Windows PowerShell (Python only):

pip3 install -r "$env:USERPROFILE\.claude\skills\cti-expert\scripts\requirements.txt"

Restart Claude Code Desktop — Close and reopen the app
Verify — Type /cti-expert in the chat to confirm the skill is loaded

Requirement	Version	Purpose
Claude Code CLI	Latest	Recommended terminal runtime
Claude Code Desktop	Latest	GUI runtime (macOS/Windows)
Node.js	18+	Required by Claude Code CLI
uv	Latest	Recommended — bootstrapped by the installer; manages Python, venv, packages & CLI tools
Python	3.10+	DOCX report generation, Scrapling, AgentFlow (uv can install this for you)
pip packages	See `requirements.txt`	Charts, diagrams, styling
git	Any	Clone the repository

Quick Start

How to run commands: All commands below use the /cti-expert prefix. Type /cti-expert followed by the command in Claude Code.

Example: /cti-expert /case example.com — not just /case example.com

1 — Full Autonomous Case

/cti-expert /case example.com

Runs every applicable technique for the target type, then expands the pivot graph to closure with no approval prompts. Auto-generates the default export set: .md + interactive .html + .json + .csv + IOC bundle. Add --redact for a shareable PII-placeholdered copy.

2 — Guided Flows

/cti-expert /flow person           # Person investigation workflow
/cti-expert /flow domain           # Domain reconnaissance workflow
/cti-expert /flow image            # Image verification workflow

3 — Targeted Reconnaissance

/cti-expert /sweep @username                    # Multi-vector recon on handle
/cti-expert /query example.com                  # 12-15 advanced search queries
/cti-expert /username johndoe                   # Platform enumeration (3000+)
/cti-expert /email-deep [email protected]         # Deep email investigation
/cti-expert /subdomain example.com              # Certificate transparency + brute-force
/cti-expert /github-osint github.com/org/repo   # GitHub profiles, repos, code, commits, forks
/cti-expert /threat-check 185.1.1.1             # IP/domain/URL threat intelligence
/cti-expert /scam-check suspicious-site.xyz     # Phishing/scam domain check
/cti-expert /breach-deep [email protected]        # Multi-source breach lookup

4 — Analysis & Assessment

/cti-expert /exposure domain.com                # Composite risk score (0-100)
/cti-expert /threat-model                       # Build threat model from findings
/cti-expert /validate                           # Verify all findings
/cti-expert /coverage                           # Check investigation completeness

5 — Reporting

/cti-expert /report                             # Technical INTSUM report
/cti-expert /report brief                       # Executive summary
/cti-expert /brief                              # Plain-language summary
/cti-expert /workspace save                     # Save case workspace state (resume later)

Features

Identity & People

Person lookup — 50+ data points
Phone — carrier, reputation, associations
Email — accounts, breaches, infrastructure
Username — 3000+ platform enumeration
GitHub developer footprint — profiles, orgs, repos, commits, forks

Domain & Infrastructure

Subdomain enumeration via CT logs
CMS, CDN, analytics fingerprinting
DNS forensics & WHOIS deep/reverse
Traffic analysis & audience demographics
ICP filing → PRC entity + sibling-domain pivot
IBAN/bank-account validation & attribution

Analysis & Verification

Face search (FaceCheck.id) & reverse image (TinEye)
Image forensics (FotoForensics, Forensically)
AI photo geolocation (picarta.ai, GeoSpy)
Document/email metadata forensics
Google Docs identity extraction
100+ paste sites & breach DBs
Likelihood-banded judgments, 5W1H coverage, ACH

WiFi, Geo & Transport

SSID/BSSID lookup via Wigle.net
W3W, Plus Codes, MGRS, Street View
Aircraft tracking (ADS-B Exchange, Flightradar24)
Vessel tracking (Marine Traffic, VesselFinder)
Vehicle VIN lookup & plate recognition

Security Auditing

Cloud audit (AWS/GCP/Azure)
OWASP Top 10 source code review
CVE & supply chain vulnerability checks
LLM/agent/MCP prompt injection audit

Reporting & Export

INTSUM, executive brief, plain-language
DOCX with charts, diagrams, timelines
Save/load case workspaces
Legal, journalist, HR, threat analyst formats
Reversible PII redaction for external sharing

AEAD Case Lifecycle

Every investigation follows four automated phases:

                         ╭──────────────────────────────────────╮
                         │         AEAD CASE LIFECYCLE          │
                         ╰──────────────────────────────────────╯

   ┌─── ACQUIRE ────────────────────────────────────────────────────────┐
   │  Collect raw data via /sweep, /query, /username, /phone, etc.     │
   │  Database search, enumeration, collection gap logging             │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ENRICH ─────────────────────────────────────────────────────────┐
   │  Expand leads via /branch, /crossref, /link-subjects, /signatures │
   │  Shared identifier detection, relationship mapping                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ASSESS ─────────────────────────────────────────────────────────┐
   │  Score & verify via /exposure, /threat-model, /validate, /coverage│
   │  Risk scoring, completeness check, evidence chains                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── DELIVER ────────────────────────────────────────────────────────┐
   │  Package output via /report, /brief, /render, /workspace save     │
   │  Auto-saves .md, .html, .json, .csv + IOC set                     │
   └────────────────────────────────────────────────────────────────────┘

Run /progress at any point to see current phase and pending tasks.

Workflow diagrams

Full /case pipeline (AEAD) — where /webpivot, correlation, and premium keys fit:

/webpivot + correlation + premium API-key flow:

Sources: workflow-case.puml · workflow-apikeys.puml — see the API-keys & webpivot guide.

Command Reference

Full command list: See SKILL.md for comprehensive reference.

Command	Purpose
`/cti-expert /case [target]`	Full pipeline — every applicable technique
`/cti-expert /sweep [target]`	Multi-vector recon (person/domain/org/username/email/IP)
`/cti-expert /query [subject]`	12-15 advanced search operator queries
`/cti-expert /username [handle]`	3000+ platform enumeration
`/cti-expert /phone [number]`	Carrier lookup, reputation, associations
`/cti-expert /email-deep [email]`	Accounts, breaches, infrastructure
`/cti-expert /subdomain [domain]`	CT logs + passive enumeration
`/cti-expert /github-osint [target]`	GitHub user/org/repo profiles, code, commits, forks
`/cti-expert /threat-check [target]`	IP/domain/URL/hash threat intelligence
`/cti-expert /breach-deep [email]`	Multi-source breach lookup

Command	Purpose
`/cti-expert /branch [data]`	Lateral expansion (email→username, username→email, etc.)
`/cti-expert /crossref`	Shared identifier detection across subjects
`/cti-expert /link-subjects [A] [B]`	Define connection between subjects
`/cti-expert /show-connections`	Display logged connections
`/cti-expert /graph`	Full ASCII subject relationship map

Command	Purpose
`/cti-expert /exposure [target]`	Composite risk score (0-100)
`/cti-expert /threat-model`	Build threat model from findings
`/cti-expert /validate`	Verify finding evidence chains
`/cti-expert /coverage`	Check investigation completeness

Command	Purpose
`/cti-expert /report`	Technical INTSUM report
`/cti-expert /report brief`	Executive summary
`/cti-expert /brief`	Plain-language summary
`/cti-expert /workspace save`	Persist case workspace state (resume later)

Command	Purpose
`/cti-expert /webpivot [url]`	Extract favicon/tracker/wallet/SaaS-operator artifacts → ranked pivot queries (Shodan/FOFA/urlscan). Flags: `--rank`, `--cert`, `--graph`, `--history`, `--whois`
`/cti-expert /rank-relations`	Score + rank same-operator relations across pages (weighted signals, noise-filtered, clustered)
`/cti-expert /cert-pivot [domain]`	Find other hosts serving the same TLS cert + SAN siblings (keyless; Shodan/Censys with keys)
`/cti-expert /pivot-suggest`	Rank "what to pivot next" from findings (leet/variant/temporal/domain clusters, CJK pinyin + Traditional + company-stem)
`/cti-expert /crypto-balance [addr]`	On-chain balance + lifetime flow for a wallet, valued at spot
`/cti-expert /iban [value]`	Validate + decompose a bank account (mod-97, BBAN split, bank code, mule signals)
`/cti-expert /email-hygiene [email]`	Grade an email domain 0-100 + A-F (disposable/MX/free/role)
`/cti-expert /sensitive-paths [list]`	Classify a Wayback/URL list for exposed paths (.git/.env/backups/configs)

Command	Purpose
`/cti-expert /icp [domain\|serial]`	ICP filing → registered PRC entity + licence no.; reverse the licence serial to sibling domains under one filing
`/cti-expert /cn-corp [name\|USCC]`	GSXT → TianYanCha/QCC/Aiqicha → 信用中国 chain: officers, shareholders, subsidiaries, UBO, revoked-status flags
`/cti-expert /dork-sweep [t] --baidu`	Baidu tier — tiers 1–4 (Google/Bing/DDG) index almost no CN-hosted content
`/cti-expert /pivot-suggest --cjk`	Pinyin, Simplified↔Traditional and company-name-stem variants

Registries needing mainland egress (TianYanCha/QCC/Aiqicha) are logged as collection gaps, never blockers.

Command	Purpose
`/cti-expert /redact [file]`	Shareable report variant — stable `[EMAIL_1]` placeholders + reversible JSON map (`.md`/`.json`/`.csv`). Opt-in; the default export set stays unredacted
`/cti-expert /hash-id [hash]`	Identify a hash's algorithm before lookup —

CTI Expert: Cyber Threat Intelligence for Claude

README