Skip to content
Security
Command

/cti-report

Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report <CASE-ID> [--graph|--pdf]

From plugin
cti-expert
4448 skills8 commands
Install
$ npx -y skills add 7onez/cti-expert --agent claude-code

How it fires

How this command gets triggered: by you, by Claude, or both.

  • Fires itselfClaude auto-loads it when your prompt matches the work.
  • You can call itInvoke it directly when you want it.
  • Slash command/cti-report

Context preview

What this command does when you run it.

Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report <CASE-ID> [--graph|--pdf]

Command definition

cti-report.md
name: cti-report
description: "Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report <CASE-ID> [--graph|--pdf]"
argument-hint: "<CASE-ID> [--graph|--pdf]"

/cti-report — render deliverables

Load the `cti-expert` skill, then render for: `$ARGUMENTS`

**Graph** (editable .mmd + SVG + hi-res/thumb PNG):

python3 scripts/backend/intel.py graph "$PWD/<case_graph.json>" "$PWD/<out-stem>" --legend

Pass **absolute paths** — the dispatcher runs with its own working directory and relative paths will not resolve.

**Report** (PDF/DOCX from the assessment markdown):

python3 scripts/backend/intel.py report <assessment.md> <out-stem> --pdf --docx

Before rendering, confirm the assessment: states confidence on both axes (Admiralty per finding, ICD-203 per judgment — High/Moderate/Low, no hyphenated hybrids); tags each link with its evidence rung; reports empty findings as empty; and includes alternative hypotheses wherever attribution reaches a named individual.

**Inherit the source's TLP marking.** A TLP:RED case must not be published to an Artifact or any hosted URL.

Ships withcti-expert

CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code. 67+ commands, 35 techniques, no API keys required.

Get the whole plugin