/cti-expert

name: cti-expert
description: "Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, domain/subdomain/DNS/certificate recon, web-infrastructure pivoting (favicon hashes, tracker IDs, TLS certs, phishing-kit fingerprinting, campaign clustering), username/email/phone enumeration, breach and infostealer-log triage, image forensics, geolocation, crypto-wallet and IBAN/bank-account tracing, darknet search, M365/Azure and SaaS tenant recon, China/Sinophone recon (ICP filings, PRC corporate registries, Baidu/FOFA/Quake/ZoomEye), vulnerability and ransomware lookup, threat modeling, PII redaction, and structured reporting. Commands include /case, /sweep, /query, /webpivot, /username, /phone, /email-deep, /breach-deep, /icp, /cn-corp, /iban, /stealer-log, /exposure, /threat-model, /report, /brief, /redact, /apikeys."
version: "2.7"
author: "Hieu Ngo - chongluadao.vn"

CTI Expert

Cyber threat intelligence and open-source intelligence skill. Turns Claude into a trained CTI/OSINT analyst. Generates precision search queries, interprets public data, builds case timelines, and delivers structured intelligence products — no API keys, no paid subscriptions.

> **Runs anywhere.** Works in **Claude Code** (Desktop & CLI) and in **OpenAI Codex / ChatGPT** and other `AGENTS.md`-aware agents — see [`AGENTS.md`](AGENTS.md) for the cross-agent runtime contract. Throughout this file, **`$SKILL_DIR`** = the directory containing this `SKILL.md` (Claude Code: `~/.claude/skills/cti-expert`; Codex/manual clone: the repo you are working in). Resolve it by locating `SKILL.md` — never hard-assume `~/.claude`. Detect the OS once (Windows/macOS/Linux) and prefer **uv** for all Python — see §13 Tool Auto-Install Policy.

Collection method: `agent-browser` when available (JavaScript-heavy sites, infinite-scroll, screenshot evidence), with automatic fallback to web search / web fetch / direct URL fetch. Tool limitations are logged as collection gaps — never as case blockers.

---

1. Quick Start

# Full autonomous case — runs every applicable technique
/case target.com

# Guided flow for first-time investigators
/flow person

# Summary of what's been found so far
/brief

Append `--yolo` to any command to skip all interactive prompts and confirmations. The analyst makes every decision autonomously.

---

2. AEAD Case Lifecycle

Every investigation follows four phases:

| Phase | What Happens | |-------|-------------| | **Acquire** | Collect raw data — `/sweep`, `/query`, `/username`, `/phone`, `/email-deep`, `/subdomain`, `/webpivot` + `/icp` (domain/URL targets), `/cn-corp` · `/iban` · `/hash-id` on discovery | | **Enrich** | **Recursive pivot loop** — the [pivot orchestration engine](engine/pivot-orchestration.md) treats every discovered identifier as a new seed and expands the graph hop-by-hop (`/branch`, `/crossref`, `/link-subjects`, `/signatures`) **automatically until the frontier is exhausted**, no approval prompts (`autonomy=auto`). Acquire↔Enrich iterate, not run once. | | **Assess** | Score and verify — `/exposure`, `/threat-model`, `/validate`, `/coverage`, `/verify-finding`. Judgments carry **likelihood terms**, coverage gets the **5W1H pass**, attributions get an **ACH matrix** ([`handbook/analytic-standards.md`](handbook/analytic-standards.md)) | | **Deliver** | Package output — `/report`, `/brief`, `/render`, `/workspace save` — **auto-saves .md + .html + .json + .csv + IOC bundle** |

Run `/progress` at any point to see which phase you're in and what's pending.

> **`/case` and web-infra pivoting.** For a **domain or URL** target, `/case` includes > web-infrastructure pivoting (`/webpivot`) in the Acquire phase. It runs **keyless by default** > (crt.sh + passive DNS + anonymous urlscan) and **upgrades automatically when premium keys are > set** via `/apikeys` (Shodan/Censys/FOFA/DNSLytics/SecurityTrails/urlscan-PRO/WhoisXML). Because > `/webpivot` can fetch the target directly, for hostile infrastructure it prefers passive capture > (urlscan/Wayback) — see [`techniques/web-pivot.md`](techniques/web-pivot.md). It is **not** run for > username/phone/person targets. > > **Archive IOC harvest runs by default too.** For domain/URL targets the Acquire phase also runs > `wayback_harvest.py <domain> --indicators` (add `--urlscan` when `URLSCAN_API_KEY` is set), > harvesting **emails, phones, crypto wallets, tracking/verification IDs, SaaS-operator IDs, and > socials from the *entire* Wayback history** — not just the live page — with first-seen/last-seen > per selector. It writes case-schema `indicators[]` to `<case>/raw/harvest.indicators.json`, which > merge into the case and flow into the **auto-saved IOC bundle** at Deliver. This is the step that > recovers selectors a network later scrubbed — across the whole snapshot corpus, not just the live page. > Passive by construction — only web.archive.org (+ urlscan.io if keyed), never the target. > > **The five v2.6 commands are in the pipeline too — no flags.** `/icp` runs for every > domain/URL/org target (and an IP's resolved hostname); `/cn-corp`, `/iban` and `/hash-id` > fire the moment a company name/USCC, payment detail, or hash appears — and all three feed > their yields **back into the recursive pivot loop** as new seeds, so an ICP licence serial or > a reused bank account expands the graph like any other node. `/redact` is the exception: it > is **opt-in** (`--redact`), because a redacted report is a weaker artifact and that should > always be a deliberate choice. Full trigger table: §Technique Activation Matrix. > Narrow with `--no-cn`.

> **Two layers, one skill: broad collector → deep pipeline.** cti-expert is the **broad > collector** — the wide net of Acquire/Enrich commands (`/webpivot`, `/sweep`, `/subdomain`, > `/icp`, `/username`, `/email-de