/cti

name: cti
description: "THE ENTRY POINT for cti-expert. Investigate any target — domain, IP, email, username, phone, wallet, hash or APK. Routes to the right chain automatically. Usage: /cti <target> [--deep|--quick|--passive]"
argument-hint: "<target> [--deep|--quick|--passive]"

/cti — cti-expert entry point

**Load the `cti-expert` skill now**, then investigate: `$ARGUMENTS`

This is the single entry to the whole toolkit. Everything else (`/cti-recall`, `/cti-case`, `/cti-pivot`, `/cti-cluster`, `/cti-check`, `/cti-report`, `/cti-status`) is a shortcut to one step of what this command does end-to-end.

Step 0 — ALWAYS FIRST: have we seen this before?

Run `recall` on the target before spending a single API credit. A known seed carries prior case context and possibly an existing operator attribution — re-investigating it wastes credits and risks contradicting a published assessment.

• **T1:** `mcp__intel__domain_verdict` + `mcp__intel__which_cases`
• **T2:** `python3 scripts/backend/intel.py recall <seed>`

If it is already attributed, **report that and stop** unless the user asks to extend the case.

Step 1 — Route by target type

| Target looks like | Do this | |---|---| | domain / URL | full pipeline (Step 2) | | bare IP | `pivot_extract` in IPPivot mode — ASN, co-tenancy, ports, passive DNS | | email | reverse-WHOIS (**preview first**), breach/stealer triage, cross-platform OSINT | | username | enumerate platforms, then pivot on anything the profiles expose | | phone | carrier + reputation + messaging-app presence, then reverse-WHOIS the number | | crypto wallet | chain tracing in **and out**; outbound identifies the cash-out venue | | file hash / APK / EXE | `mcp__intel__analyze_artifact` (BinaryPivot) |

Ambiguous input: say which reading you chose and why, then proceed. Don't stop to ask unless two readings would produce materially different work.

Step 2 — Run the pipeline, don't hand-run collectors

For a domain or URL, use the deterministic chain. It sequences collect → ingest → prior-overlap → risk → cluster → assess, and it records provenance that hand-running does not:

python3 scripts/backend/intel.py pipeline open <CASE-ID> <seeds-file>

Hand-running a collector is a fallback, not the default. If you do it, **say so in the write-up** — evidence archiving, the versioned assessment and the convergence check will not have run.

Step 2b — persist the versioned case, then deepen if it hasn't converged

`/case` is an **alias of `/cti`**, so `/cti` runs the *same* full pipeline — including the deep layer. When `/backend` is live (Tier 1/2) and the run produced ≥1 host seed, persist a **versioned** case with **zero extra egress** by reusing the pivots already collected (do **not** re-fetch):

python3 scripts/backend/intel.py pipeline open <CASE-ID> <seeds> --no-collect

That runs ingest → recall → risk → clusters → `case_graph.json` → ICD-203 `assessment.md` over `cases/<CASE-ID>/raw/`. Then check convergence — `intel.py convergence <CASE-ID>` (status ≠ `converged`, or `intel.py frontier <CASE-ID>` still lists open leads). If it has **not converged** and posture is active (not `--passive`, infra not classified hostile), **auto-escalate to the `/harness` deepening loop** — keyless-first (it uses the CLI's own model on your subscription; no separate LLM key), egress **hard-gated** on hostile infra, `--no-harness` opts out. Full contract: SKILL.md §2 (AEAD deep-layer note) and the technique-activation / auto-fire matrices for the `/webpivot`·`/icp`·`/iban`·`/hash-id` auto-fires that also run in a full `/cti` (= `/case`) run.

Step 2c — Auto-pivot enrichment: leaks · breach · OSINT · dorks (NOT optional)

The deterministic pipeline (Step 2) is **infra-only** — WHOIS/DNS/cert/IP/webpivot. It does **not** cover the identity/exposure surface. A `/cti` run is **not complete** until the enrichment layer has fired on the seed **and on every identifier the loop discovers** (email, username, person name, phone, wallet, GitHub handle, org). Do not report "nothing further found" from a run that never ran these — that is absence of collection, not absence of evidence (§2.5 *Dead seed*).

Fire by identifier type, then feed every hit **back into the recursive pivot loop** as a new seed:

| Discovered | Auto-fire (leaks / breach / OSINT / dork) | |---|---| | **email** | `/breach-deep` + `/email-deep` (LeakCheck·HudsonRock·CLD) → `/intelx <email>` (breach dumps, **infostealer logs**, pastes, darknet — logs-first pass is ~50% keyless) → `/github-osint` (commit attribution) → `/dork-sweep --telegram --docs` on the address and `@domain` | | **username** | `/username` (3000+ platforms) → social-platform recon → `/intelx` on any email the profiles expose → `/github-osint` if a GitHub profile/hit exists (`github_harvest`: `.patch` From: e-mails, first 2 + last 2 commits per repo, org about-profile + members + top contributors, former logins from no-reply addresses) → `/dork-sweep --telegram --docs` | | **person name** | `/dork-sweep --docs` + `/docleak` (author/uploader fields) → `/github-osint` only after a likely handle/commit-email surfaces → `/email-permute` **against the case's own domains** (hypothesis only — never a finding, never ingested; §2.5) | | **phone** | `/phone` (carrier + reputation + **infostealer exposure** + VN scam reports) → `/intelx <phone>` → `/dork-sweep` | | **domain / org** | `/intelx --phonebook <apex>` (every email/subdomain/URL IntelX has seen) → `/secrets` + `/github-osint` (org, primary domain, discovered repos) → `/dork-sweep --filetype --docs` + `/docleak` on domain + org → `wayback_harvest --indicators` (Acquire already runs this) | | **wallet / IBAN / hash** | `/intelx <selector>` → `/iban`·`/hash-id` (auto per §Auto-fire matrix); credential-material hashes route to `/breach-deep`, never a public sandbox |

Rules that keep this cheap and correct:

• **`/intelx` takes a STRONG selector only** — email / domain (`*.apex`)