cti-expert

CTI Expert

Cyber Threat Intelligence & OSINT Analysis Toolkit

Transform Claude into a trained intelligence analyst — 120+ commands, 58 techniques, zero API keys required for core functionality.

Installation  |  Quick Start  |  Commands  |  Contribute

🇬🇧 English  ·  🇻🇳 Tiếng Việt  ·  🇨🇳 中文

Built by Hieu Ngo • hieu.ngo@chongluadao.vn • chongluadao.vn

Core contributor • Zeroska • khuong.nguyen@chongluadao.vn

🤝 Sponsors & Supporters

CTI Expert is built in the open. These organisations back the work — with data, tooling, and hard-won investigative tradecraft.

Important ANY.RUN lookups are read-only; case binary submissions are automatic when keyed. /cti downloads APK/installer links to cases/<case>/bin/, runs static analysis and, when ANYRUN_API_KEY is set in a spending run, submits each complete file through the private-by-default sandbox client. --free-only, case no_spend, default loop (unless --full) and hostile/no-direct-contact posture block submission; plan checks and privacy read-back still apply. A public-only account is refused unless ANYRUN_ALLOW_PUBLIC=1; public tasks are world-readable and irreversible. Direct anyrun_submit remains ask-first and requires HARNESS_ALLOW_SUBMIT=1. See SKILL.md.

Listing here reflects support for the project and does not imply affiliation, endorsement, or any verification of this tool by the organisations named. Integrations marked above are optional and key-gated — every core technique still runs with zero API keys. Always respect each provider's terms of service. The full list of open-source projects and free public-interest services this skill depends on is in Acknowledgments & Credits.

What is CTI Expert?

A Claude Code skill that transforms Claude into a trained cyber threat intelligence and open-source intelligence analyst. It runs structured intelligence collection using 120+ commands across 58 techniques — no API keys required for core functionality. To take full advantage, add your own free or paid API keys to the skill's .env — each is auto-detected and unlocks higher-tier access (e.g., Wigle, VirusTotal, URLScan.io, Shodan, Censys, SecurityTrails, WhoisXML).

Tip Keyless by default, more powerful with your keys. Every core technique runs with zero API keys. Add any free or paid keys to .env (or run /apikeys set <service> <KEY>) and the skill auto-detects them, unlocking higher-tier pivots: reverse favicon→host, passive DNS, certificate search, sibling-domain discovery. A missing or bad key never breaks a run — it just degrades to a note. Setup guide: handbook/api-keys.md.

Tip One skill, two layers. cti-expert is the broad collector — the wide net (/sweep, /webpivot, /subdomain, /username, /email-deep…). Built into the repo is a deep pipeline (intel_engine/) that turns raw collection into a real case: a persistent knowledge base, versioned cases, cross-case correlation, and calibrated assessment. The flow reads like a sentence — collect broadly → "seen this operator before?" → cluster → filter false positives → assess. No external setup: the backend resolves to SELF, and as of v2.9 the bundled installer (scripts/install.{sh,ps1}) provisions the deep layer automatically (or by hand: uv venv && uv pip install -r requirements.txt). Architecture: connectors/intel-backend.md.

Core Capability

Multi-vector reconnaissance on any target type — person, domain, organization, username, email, IP, WiFi — with automated finding validation, exposure scoring, and structured intelligence delivery.

AEAD Workflow

Acquire raw data → Enrich with pivot expansion → Assess findings → Deliver structured reports — the base bundle (Markdown + JSON + CSV + IOC bundle) always saves, then you pick a presentation report: PDF, DOCX, HTML, or all.

What's New in v2.12

The release where the premium keys start pulling their weight — and the report writes itself. v2.11 shipped detectors. v2.12 turns an eight-finding audit of the paid vendors into behaviour (every metered leg gated, bought once per case instead of once per host), adds Netlas as an independent index, makes the editorial PDF/DOCX a deterministic composition from the case directory, and closes the last honesty gap in the ANY.RUN docs: detonation exists, and it is gated five ways.