A cyber threat intelligence and OSINT analysis toolkit that runs structured investigations and produces analyst-style reports with sourced, trust-scored findings. Built for security analysts working OSINT and CTI cases in Claude Code.
@7onezCyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence…
@7onezTHE ENTRY POINT for cti-expert. Investigate any target — domain, IP, email, username, phone, wallet, hash or APK. Routes to the…
@7onezRun the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment.…
@7onezFalse-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage:…
@7onezExpand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>
@7onezCollect pivot artifacts from ONE target — favicon, trackers, wallets, emails, CORS, mail/SPF/DMARC, WHOIS, co-tenancy. Usage:…
@7onezManage the egress proxy / rotation pool for the skill's HTTP(S) requests (keyless crt.sh, Wayback, urlscan, CLD, WHOIS, /apikeys…
@7onezHave I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall…
@7onezRender case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report <CASE-ID>…
@7onezHealth check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-status
@7onezIs this you? Claim your profilePut a plugin at the top of Plugins, from $9
