/cti-recall

Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall <domain|indicator>

Boost this command

7onez@7onez

GitHub

From plugin

cti-expert

5939 skills9 commands2 hooks

Install

$ npx -y skills add 7onez/cti-expert --agent claude-code

How it fires

How this command gets triggered: by you, by Claude, or both.

Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/cti-recall

Context preview

What this command does when you run it.

Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall <domain|indicator>

Command definition

cti-recall.md

name: cti-recall
description: "Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall <domain|indicator>"
argument-hint: "<domain|indicator>"

/cti-recall — prior-knowledge check

Load the `cti-expert` skill, then check: `$ARGUMENTS`

**This is the cheapest command in the toolkit and it must run before any collection.** A seed already in the store carries prior case context and possibly an operator attribution.

| Layer | Call | |---|---| | **T1 MCP** | `mcp__intel__domain_verdict` · `mcp__intel__which_cases` | | **T2 CLI** | `python3 scripts/backend/intel.py recall <seed>` |

Accepts a domain or a raw indicator (`favicon:<h>`, `ga:<id>`, `wallet:<coin>:<addr>`, `email:<addr>`, `social:<net>:<handle>`).

Report: which case(s) it appears in, any operator attribution, and known KB facts/edges. An indicator seen across MULTIPLE cases is a cross-case link — surface it prominently.

If the seed is already resolved, **say so and stop**. Do not re-investigate unless asked.

Read it on GitHub ↗

Ships withcti-expert

CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.

Get the whole plugin

Stats

Python JavaScript Node HTML PowerShell

+7 tags

Ruby PHP GitHub Playwright Markdown Anthropic MCP

594

Stars

Forks

Active

Maintenance

Python

Language