cti-skills

Cyber Threat Intelligence skills for Claude Code and AI agents. Threat actor profiling, IOC investigation, OSINT methodology, detection engineering (SIGMA/YARA/KQL), intelligence writing, and self-updating knowledge cells on nation-state and cybercrime threats.

Built by Liberty91 Ltd. MIT-licensed. Works in Claude Code, Cursor, Codex, Windsurf — any agentic IDE that supports Agent Skills.

What is this? (the simple version)

Imagine you're investigating something suspicious on the internet — a weird link in an email, an IP address that keeps trying to log into your server, or a hacking group you read about in the news. Normally you'd open ten different websites, copy-paste between them, write up notes, and try to remember the right way to score what you found.

This pack teaches Claude Code (an AI coding assistant) how to do all of that for you. You type a question in plain English, and Claude:

1. Looks the thing up in fourteen trusted threat-intel sources (Liberty91, VirusTotal, Shodan, AbuseIPDB, and others) — and, if you connect your Microsoft Sentinel, in your own logs too.
2. Pulls together what they all say about it.
3. Writes you a report in the format real threat analysts use — with confidence ratings, sources, and a clear bottom line.

You don't need to know which database to use. You don't need to know how to score a source. The pack handles the boring parts so you can focus on the thinking.

How to use it (5 steps)

1. Install Claude Code if you don't have it: https://claude.com/claude-code
2. Install this pack in Claude Code:

   /plugin marketplace add Liberty91LTD/cti-skills
   /plugin install cti-skills
   

3. Add your API keys (free signups, all optional). Inside Claude Code, type:

   /cti-setup
   

   Claude will walk you through it. Or skip this and the pack still works — it just won't be able to do live lookups.
4. Ask a question. Examples:

   investigate 8.8.8.8
   profile the threat actor APT28
   write a flash report on this URL: http://example.com/login
   what do we know about Lazarus Group?
   

5. Read the report. Claude returns a structured analysis with confidence levels, sources, and recommended next steps.

That's it. If you get stuck, type /cti-setup to fix keys, or npx github:Liberty91LTD/cti-skills list to see every skill the pack has.

What's in the pack

• 75 skills covering analytical tradecraft, CTI methodology, detection engineering, intelligence production, and living knowledge cells on China, Russia, Iran, DPRK cyber espionage, ransomware, infostealers, initial access brokers, and more.
• 14 threat-intel integrations — Liberty91, VirusTotal, URLScan.io, Shodan, AbuseIPDB, GreyNoise, AlienVault OTX, Censys, MISP, OpenCTI, Ransomware.live, ReversingLabs, CrowdStrike Falcon Intelligence, Microsoft Sentinel. Each exposed as a lookup skill any other skill can chain.
• Local MITRE ATT&CK dataset — TTP mapping without network calls.
• Tradecraft vocabularies — TLP, NATO Admiralty Scale, MISP confidence, probability yardstick. Auto-applied by the orchestrator; also invokable directly.
• A single orchestrator skill that routes requests and auto-applies rigor to every output.

Install

The recommended path for Claude Code users is the plugin. Other paths are listed below for non-Claude-Code IDEs and embedding scenarios.

Claude Code plugin (recommended)

/plugin marketplace add Liberty91LTD/cti-skills
/plugin install cti-skills

Then run /cti-setup inside Claude Code to add API keys.

npx (one-shot install into any project)

npx github:Liberty91LTD/cti-skills

Copies all 75 skills + tool integrations + plugin manifest into the current directory. Use --target <dir> to install elsewhere, or npx github:Liberty91LTD/cti-skills list to browse skills first.

Git clone (for development or contribution)

git clone [email protected]:Liberty91LTD/cti-skills.git
cd cti-skills
./scripts/setup.sh      # prompts for optional API keys + downloads MITRE data
claude

setup.sh supports non-interactive use too:

# Pass keys as flags
./scripts/setup.sh --non-interactive --virustotal=KEY --shodan=KEY

# Pass keys as env vars
VIRUSTOTAL_API_KEY=KEY SHODAN_API_KEY=KEY ./scripts/setup.sh --non-interactive

# Verify configured keys (dry-run, no API calls)
./scripts/setup.sh --verify

The script merges keys into .claude/settings.local.json non-destructively — existing fields like permissions are preserved. Re-run anytime to add more keys.

Other install paths

• Git submodule (embed in another repo): git submodule add https://github.com/Liberty91LTD/cti-skills.git skills/cti
• Fork: hit "Fork" on GitHub, then install via plugin or clone from your fork.
• Direct copy: copy the skills/ directory into your project. Each skill is self-contained.
• Cursor, Codex, Windsurf, other Agent-Skills-compatible IDEs: clone the repo into your agent skills directory per your IDE's documentation. The orchestrator is itself a skill — no Claude-specific subagent required.

Try it

Once installed:

Investigate 203.0.113.42

The orchestrator routes this to /ip-investigation, which chains /lookup-virustotal + /lookup-otx + /lookup-shodan + /lookup-abuseipdb + /lookup-greynoise, scores sources, applies TLP, and returns a rated investigation report.

Profile APT28

Routes to /threat-actor-profile — produces an actor card with aliases, targeting, TTPs, attribution confidence.

/ach

Direct-invoke Analysis of Competing Hypotheses.

/iran-cyber-espionage

Load the Iran knowledge cell.

/pir-management

Set up Priority Intelligence Requirements.

What's new

Three additions along one arc: knowing what is coming at you, knowing whether you can stop it — and now, knowing whether it already reached you.

0. Microsoft Sentinel hunting — /lookup-sentinel

What it is. Every other integration in this pack asks the world about an indicator. This one asks your own telemetry: has this IOC been seen in our environment? Is this ATT&CK technique's behaviour in our logs? It connects to your Microsoft Sentinel workspace (read-only) and turns intelligence findings into exposure answers.

The idea that makes it different. No two Sentinel environments have the same tables — availability follows the connectors you've deployed. So the skill discovers before it hunts: it inventories which tables your workspace actually ingests, probes the candidates, and only then generates KQL, restricted to tables that verifiably exist. No queries that fail on missing tables; no hunts that silently "succeed" against telemetry you don't collect. When your environment can't observe a technique, it tells you that — a telemetry-gap finding is often the most valuable line in the report.

What you get:

• IOC exposure sweeps — hand it the malicious subset from an investigation or /ioc-enrichment-workflow and it sweeps IPs, domains, hashes, URLs, and accounts across every relevant table your workspace has, with fallback ladders when the preferred table is absent.
• Behavioural TTP hunts — from a MITRE ATT&CK technique to table-adapted KQL, composed with /kql-writing's per-technique patterns and /mitre-attack's local dataset.
• Honest misses — a clean sweep is reported as "not observed in collected telemetry over this window", never "not compromised", with retention and connector coverage stated.

Setup: four values from the Azure portal (app registration + a read-only role on the workspace) — the walkthrough is in tools/integrations/sentinel.md.

1. Liberty91 platform integration — /lookup-liberty91

What it is. The pack's only first-party integration. Where VirusTotal tells you whether an indicator is bad, Liberty91 tells you what happened, who reported it, how well corroborated it is, and which of your organizations it touches.

The idea that makes it different. Everything else in the pack works on indicators. This works on occurrences. One breach covered by a vendor write-up, three news articles and a leak-site post is one Threat Event and five Events. You read the occurrence once, with the disagreement between sources still visible, instead of deduplicating five reports by hand.

What you get:

• Deduplicated occurrences with every source you are entitled to, each carrying NATO Admiralty source reliability, occurrence credibility, a verification stage, and a per-report stance (claims / corroborates / disputes). When sources disagree, the skill reports the dispute rather than averaging it away.
• ATT&CK techniques per occurrence, with a note on how each was actually used in that specific event, not a generic definition. This is the single most useful field for turning "an actor targets aviation" into "here is what they did".
• Named actors, malware, vulnerabilities and victims on every list row, keyed to a canonical cross-tenant catalog, so you can pivot straight from a result to the full entity record.
• Two-way: push your own finished reports back in with ingest, and they are enriched, entity-extracted and matched into an occurrence, private to your account.

Why it matters for the pack. It supplies the Threat Capability evidence that /control-coverage-mapping below needs, and it is the only source here that can say what is happening to your sector and region rather than the world in general.

Setup: one key, LIBERTY91_API_KEY. Full reference in tools/integrations/liberty91.md.

2. Control coverage mapping — /control-coverage-mapping

What it is. Answers "which attacker techniques do our controls actually stop, and how well?" by joining your control baseline to 9,545 control-to-technique mappings drawn from six public sources: MITRE ATT&CK's own mitigations, and independent CTID assessments of NIST 800-53, AWS, Azure, GCP and Microsoft 365.

The problem it solves. Control gap analysis is normally a negotiation. Someone asserts a coverage percentage, someone else disputes it, and neither can show their working. This replaces the negotiation with a table both sides can read, where every row cites its source and its score. A disagreement becomes a disagreement about a published assessment rather than about someone's confidence.

What you get. Four lists, not three:

That fourth list is the point. Merging it into "gaps" is the standard mistake: it pads the gap list with things no security programme could ever close, and it costs you credibility with the first competent reader.

Honesty is enforced, not encouraged. Effectiveness scores are never synthesized. Where no source rates a control's strength, the output says "relevance asserted, no strength claim" rather than inventing a number. A vendor-specific score is never presented as a control-class score. Controls that do not map cleanly get their own section instead of being forced to the nearest-looking identifier.

Where it fits. It supplies the Resistance Strength half of Vulnerability in a FAIR risk assessment. Pair it with /lookup-liberty91 for Threat Capability and you have both halves: a technique list without controls tells you what is coming, a control list without techniques tells you what you bought. Joined, they tell you what to do next.

Runs offline, stdlib only, no API key. Evidence base bundled in data/attack-control-mapping/.

Pick a skill

All skills live flat under skills/ and are user-invocable as /<skill-name>. Grouped here for browsing:

• Entry point — /cti-orchestrator (default routing), /cti-setup (configure API keys)
• Investigation — /ip-investigation, /domain-investigation, /hash-investigation, /url-investigation
• Analysis — /threat-actor-profiling, /ach, /indicator-pivoting, /campaign-tracking, /malware-analysis, /threat-assessment, /control-coverage-mapping (which techniques your controls actually stop, and how well), /horizon-scanning, /key-assumptions-check, /red-team-analysis, /structured-analytic-techniques
• Tradecraft rigor — /tlp-guide, /source-assessment, /confidence-levels, /likelihood-language
• Production — /intelligence-writing, /writing-assessments, /quality-control, /ioc-export, /stix-bundle, /ioc-enrichment-workflow
• Detection engineering — /sigma-writing, /yara-writing, /kql-writing
• Knowledge cells — /china-cyber-espionage, /russia-cyber-espionage, /iran-cyber-espionage, /dprk-cyber-espionage, /ransomware-ecosystem, /infostealers, /initial-access-brokers, /phishing-social-engineering, /supply-chain-threats, /carding-financial-fraud, /hacktivism
• OSINT + collection — /osint-methodology, /darkweb-collection, /vulnerability-intelligence
• Lookups — /lookup-liberty91 (first-party: deduplicated occurrences, threat library, IOCs — query + write), /lookup-virustotal, /lookup-otx, /lookup-urlscan, /lookup-shodan, /lookup-abuseipdb, /lookup-greynoise, /lookup-censys, /lookup-misp (two-way: query + write), /lookup-opencti (two-way: knowledge-base query + write), /lookup-ransomwarelive, /lookup-reversinglabs, /lookup-crowdstrike (IOC reputation + threat-actor / TTP / report intelligence), /lookup-sentinel (hunt your own Sentinel workspace: IOC exposure sweeps + ATT&CK TTP hunts, table-adaptive KQL), /mitre-attack
• Management — /pir-management, /stakeholder-management, /feedback-loops, /sops, /maturity-assessment, /intelligence-sharing
• Methodology — /cti-hyperloop (optional operating doctrine)

API keys

Optional. The pack degrades gracefully — skills skip enrichments for which no key is configured.

Three ways to configure:

1. Inside Claude Code (works for all install paths): type /cti-setup and Claude walks you through it.
2. Shell script (clone install only): ./scripts/setup.sh — interactive prompts, or use --non-interactive --virustotal=KEY flags for scripted setup.
3. Environment variables: export the variable in your shell rc; the CLIs read them at runtime. Copy .env.example to .env (gitignored) as a starting point listing every supported variable, or pass them inline (VIRUSTOTAL_API_KEY=… ./scripts/setup.sh --non-interactive).

Keys are merged into .claude/settings.local.json (gitignored). The pack degrades gracefully — skills skip enrichments for which no key is configured.

To verify keys are wired up: ./scripts/setup.sh --verify (or ask Claude to verify after /cti-setup).

Acknowledgements

This pack codifies established Cyber Threat Intelligence tradecraft into composable agent skills. It rests on decades of public scholarship, open standards, free training material from CTI educators, and vendor research that the community publishes openly. The full per-skill credits live in CREDITS.md.

If we missed you. We've tried to credit sources where we could find them. If you've contributed to work this pack draws on and feel you haven't been properly credited, please reach out at [email protected] and we'll update the credits.

Contributing

Forks and PRs welcome from anyone. Merges reserved to Liberty91 Ltd maintainers. See CONTRIBUTING.md.

Status

Version 1.0.0 — see VERSIONS.md for per-skill versions and changelog.

License

MIT — see LICENSE.

About Liberty91

Liberty91 Ltd builds AI-native threat intelligence tooling. Contact: [email protected].