CTI skills for every AI coding agent.
A free pack of 78 Cyber Threat Intelligence skills for AI coding assistants like Claude Code, Cursor, Codex and Windsurf. Install it, ask a question in plain English, and your assistant investigates the indicator, profiles the threat actor, or writes the report for you, using Structured Analytical Techniques. Built and maintained by a community of practitioners and free to use, fork, and extend.
$ /plugin marketplace add Liberty91LTD/cti-skills $ /plugin install cti-skills
or $ npx github:Liberty91LTD/cti-skills
What is this?
Claude Code is an AI assistant from Anthropic that runs on your computer and can use tools for you. This free pack teaches it the job of a threat intelligence analyst. Normally, checking a suspicious link or IP address means opening ten different websites and copy-pasting between them. With this pack of skills installed, you type one question and the assistant does the looking up, weighs what it finds, and writes it up using Structured Analytical Techniques, like an expert Intelligence Analyst.
1. Install it
With just two quick commands you can install this skills pack in Claude Code. It also works in Cursor, Codex and Windsurf. Adding API keys for the lookup sources is optional, and most of those tools have free tiers.
2. Ask a question
You can ask your threat data questions with: “investigate 8.8.8.8”, “profile the threat actor APT28”, “did this IP ever show up in our Sentinel logs?”. You don't have to know which specific skill to use; the orchestrator routes the question itself.
3. Read the answer
You get a structured report with a clear bottom line, the sources it used, and how confident it is, in the format real threat analysts use.
What kind of things can it do?
- Look things up: “is this IP address dangerous?” runs it through five threat-intel sources at once, VirusTotal, Shodan, AbuseIPDB, GreyNoise and OTX, instead of you checking each one.
- Investigate: “investigate this domain” runs every relevant check and comes back with one consolidated verdict.
- Check the evidence: new in v2.0, paste a link to a security article and ask “how reliable is this?”. The skills trace it to the original report and grade every claim in it. More on this below.
- Search your own logs: connect Microsoft Sentinel (for example) and ask “did we see this?”.
- Write detections: turn what you found into rules for your specific security tools.
- Write the report: assessments, indicator lists and briefings in the formats analysts and their stakeholders expect.
- Stay current: built-in reference notes on ransomware groups, nation-state actors and other threats, each with a freshness date.
Completely new to Claude Code? Start with this 5-minute getting-started video or this step-by-step tutorial for non-technical beginners, then come back and install the pack.
New in v2.0: grade the evidence before your assessments.
Structured analytic techniques (SAT) are the methods intelligence analysts use to keep their reasoning objective: write down every possible explanation, test each one against the evidence, check what you are assuming, and check the quality of your information before you rely on it. The skills put those techniques into the AI's workflow so it has to follow them. One of the big problems with relying on AI to do this though, is that it can ‘choose’ to trust a source, which makes the analysis look rigorous. But in fact it's not. Grading the evidence first, by fixed rules, with every step checkable, is what makes the analysis more reliable.
/quality-of-information-check
When you ask how reliable a piece of security news is, the skill works through seven steps in a fixed order. It does not grade before the source is found, and it does not count confirmations after grading.
- Find the original source. A small script follows the links in the article to the report it is based on. Fifteen articles can all lead to one report. That is one source, not fifteen. If the article links to nothing, the script flags that, and the AI is not allowed to fill the gap from memory.
- Break the report into claims. A sentence like “a criminal group broke into a hospital through a flaw in its network equipment and stole 400 gigabytes of data” is four claims from four different places: the hospital's own notice, the investigators' finding, the investigators' judgement about who did it, and the criminals' own number.
- Check whether the wording changed between the original and the article. “Possibly linked to” often becomes “was behind” in a news article about that primary report. The claim is graded on the original wording, and the way the news outlet covers it is recorded.
- Count who else confirms the event. A confirmation can only be from a second organisation with its own evidence. Several articles about the same report do not count, and neither does one company quoting another.
- Grade each claim on two axes, each with a reasoning and the exact wording it's based on, copied word for word from the report.
- Apply fixed limits. A script checks every grade against the published rules and rejects any that break them.
- Only then reason. Hypothesis testing and assessments are based on the graded claims, and those can never be more confident than the weakest claim.
Grading along two axes
Every claim is measured against two axes, written as two words. The first word is the access level. It answers: how does the source know this? The second word is the claim support. It answers: what backs this statement?
Access level: how does the source know this?
- direct: the source saw it, in its own systems or its own investigation, or it is the organisation that was attacked
- limited: the source examined a piece of evidence, such as a malware sample, but did not see the attack itself
- indirect: the source does not say how it knows, or repeats what others published
- untraced: no original source could be found
- adversary: the attackers said it themselves
Claim support: what backs this statement?
- established: a second organisation confirms it from its own evidence, or you saw it in your own systems
- firm: one source, which saw it directly, and nothing contradicts it
- tentative: one source, and the statement is second-hand or is a conclusion the source reached
- disputed: something contradicts it, or the source itself says it has low confidence
- unverified: nothing to judge it by
Two claims from one report can get different grades. What the investigators saw is “direct, firm”. Who they concluded did it is “direct, tentative”.
The skills that test hypotheses and write assessments, /ach and /threat-assessment, grade their evidence first by default. You can skip that step. The result is then labelled “ungraded” and cannot claim more than moderate confidence. Read the plain-English walkthrough with a worked example →
Also in this cti-skills pack: hunt for threats in your own Microsoft Sentinel.
Ask the pack about a suspicious IP and it tells you what the world knows about it. The /lookup-sentinel skill answers the question that comes right after: did this thing ever show up in our own environment? Connect your Microsoft Sentinel workspace and the same conversation searches your own logs.
If you use Sentinel today, you probably write KQL queries by hand in the portal. With /lookup-sentinel your AI assistant does that part for you: you ask in plain English, it writes a query that fits your workspace, runs it, and reports back what it found.
Connecting takes four values you copy from the Azure portal, plus one read-only role. That role means the assistant can search your logs but can never change anything in them. It works with the Sentinel workspace you already have.
/lookup-sentinel
No two Sentinel environments contain the same data, because that depends on which connectors you have set up. So before writing any query, the skill first checks which tables actually exist in your workspace and which of them are receiving data. Then it will write KQL queries that match your specific environment. If a table it would normally use is missing, it knows which alternatives can usually answer the same question.
You can ask it to sweep your logs for a suspicious IP, domain, file hash, URL or account, or to hunt for attacker behaviour described by MITRE ATT&CK techniques. For the Defender tables it follows Microsoft's advanced-hunting schema reference.
Read the full /lookup-sentinel page →It reports what it cannot see
Sometimes your logs simply cannot answer a question, because the data was never collected in the first place. Instead of running a query that proves nothing, the skill tells you exactly that: this behaviour is not visible in the logs you currently collect, and here is the gap. And when a search comes back empty, it reports “not seen in your logs over this period” rather than “you are safe”, because your logs only cover what your connectors collect and only go back so far.
It is also strictly read-only. The skill can search your logs and list what data you have, and nothing else: it cannot close incidents, change rules, or alter your data. Microsoft caps this kind of access at 200 requests per 30 seconds, far more than the skill ever uses.
See the skills in action.
Install the pack, point an agent at MISP, and let it run a Diamond Model cluster analysis end-to-end, strategic report, STIX bundles, IOC CSV. Plus a daily SOC alert workflow that enriches IOCs and models them in MISP automatically.
From what attackers are doing to what actually stops it.
/lookup-liberty91
Our own platform is finally in our own skills. This skill reads real-world events from the Liberty91 platform, deduplicated, so one breach covered by five outlets is one event and not five. Every event is enriched with the actors, the malware, the vulnerabilities and the techniques, and how each technique was used in that specific incident.
Filter by sector, country, Intelligence Requirement, affected organisation and date, and you have the threat picture for your patch rather than the internet's.
/control-coverage-mapping
Takes that technique list and tells you which controls address it, and how strongly. Built on 9,545 control-to-technique mappings from six public sources: MITRE's own guidance, plus independent assessments of NIST 800-53, AWS, Azure, Google Cloud and Microsoft 365.
This skill is based on public sources and does not need an API key. Every row cites its source and its score, so if your agents disagree, that becomes a conversation about a published assessment rather than about who sounds more confident.
A real question, start to finish
“What techniques have been trending against US financial services in the last 30 days, and what should we have in place?”
28 events, 79 techniques
Phishing, valid accounts, exploitation of public-facing apps. Named actors from BlueNoroff to Akira.
How, not just what
A remote access trojan shipped inside a package with over 100 million weekly downloads. A rootkit blinding EDR at kernel level.
The controls that match
Vulnerability scanning. Exploit protection. Limits on software installation. Application developer guidance. Each one cited, scored, and ranked.
Then the telemetry to catch what gets through: process creation on Windows and Linux, service-stop events correlated with registry edits, web server logs paired with outbound callbacks. Same session, no spreadsheet, no separate controls team, and every answer traceable to a query you actually ran.
It skips the generic advice
Rank controls by how many techniques they cover and you get the same answer every time, for every threat: user training, audit, account management. All true. All useless as a briefing, because they apply to everyone, everywhere, always.
So the skill measures each control twice: how much of your threat picture it covers, against how much of all known attacker behaviour it covers. Controls that stand out on the first and not the second are the ones worth your attention.
Also in the pack: OpenCTI, read and write.
The pack now speaks OpenCTI in both directions. Your agent can check whether an indicator is already in your knowledge base, pull the actors, reports, and campaigns you hold on a subject, and write vetted findings back as indicators, relationships, TLP markings, or whole STIX 2.1 bundles.
/lookup-opencti
Talks to your OpenCTI instance over GraphQL. Connect with OPENCTI_URL and OPENCTI_TOKEN, self-hosted or SaaS, localhost included.
One lookup checks observables and indicators at once. Global search spans every entity type, filtered listing covers ten of them, and single-entity reads walk the relationship graph. On the write side it creates indicators and observables, applies labels and TLP markings, relates entities, and imports STIX 2.1 bundles as-is, because OpenCTI is STIX-native. Writes are deliberate: destructive operations confirm first, and every command has a dry-run mode.
Read the full /lookup-opencti page →Your knowledge base becomes the memory
When credentials are present, /ip-investigation and the other three investigation skills check OpenCTI automatically, /ioc-enrichment-workflow correlates every indicator against it and pushes confirmed findings back at the end, and /threat-actor-profiling reuses the intrusion sets and reports you already hold before rebuilding a profile from scratch.
/campaign-tracking publishes clusters into it and /stix-bundle output imports without rework. No OpenCTI yet? It runs locally with Docker in an afternoon.
Also recent: CrowdStrike Falcon Intelligence, ReversingLabs Spectra Analyze, MISP two-way sync, and Ransomware.live tracking
/lookup-crowdstrike returns a vendor-authoritative verdict on an indicator or a full adversary profile with origin, targeting, and MITRE ATT&CK TTPs. /lookup-reversinglabs wraps the Spectra Analyze (A1000) API for hash classification, sandbox behaviour, and pivot candidates. /lookup-misp writes as well as reads, and /lookup-ransomwarelive puts 27,600+ leak-site claims across 330+ groups at the agent's fingertips.
78 skills, organised by job-to-be-done.
Skills compose. Investigation skills chain lookups. Analytical skills prioritise IOCs for further investigation. Production skills apply tradecraft to everything that comes out.
Investigation
Hand over an IP, domain, hash, or URL. The investigation skills chain every supported API, consolidate findings, and prioritise follow-up IOCs.
Analytical tradecraft
Structured analytic techniques from the CIA tradecraft primer, available on demand to keep analysis rigorous under pressure. New in v2.0: /quality-of-information-check traces a report to its original source and grades every claim before /ach or /threat-assessment reason from it.
Threat actor & campaign work
Build actor profiles, document campaigns, pivot on indicators, and dig into malware behaviour, with consistent structure every time.
Controls & coverage
The other half of the question. You know what attackers are doing; this tells you which of your controls actually stop it, which barely help, and where you have nothing. Built on 9,545 control-to-technique mappings from six public sources, so every answer cites where it came from.
Detection engineering
Turn intelligence into detections. SIGMA for SIEMs, YARA for files, KQL for Microsoft Sentinel, written to the conventions each format expects.
Intelligence production
Write assessments, build IOC exports in CSV / STIX 2.1 / OpenIOC / MISP, and quality-check the finished product before release.
Living knowledge cells
Self-updating reference cells on the threat groups and categories you need to speak to every week. Each carries a freshness date.
Lookups (external APIs)
Zero-dependency wrappers around the threat-intel APIs you already pay for. Free tiers work. Missing keys degrade gracefully. /lookup-liberty91 reads deduplicated real-world events straight from the Liberty91 platform; it, /lookup-misp and /lookup-opencti write as well as read. /lookup-sentinel looks inward instead: it searches your own Microsoft Sentinel logs to see whether an indicator ever showed up in your environment.
Management & methodology
The programme-level scaffolding that turns a library of skills into a running intelligence function: requirements, stakeholders, feedback, SOPs.
Try it in 30 seconds.
Type a natural request. The /cti-orchestrator skill routes it to the right investigation or analysis skill, then auto-applies rigour on the output, source rating, TLP marking, MISP confidence, and standard likelihood language.
Or direct-invoke a skill with a slash command when you know exactly what you want.
> Investigate 203.0.113.42 → routes to /ip-investigation
> Profile APT28 → routes to /threat-actor-profiling
> How reliable is this article? https://… → routes to /quality-of-information-check
Works with the tools you already use.
Skills follow the Agent Skills specification, so anywhere the spec is supported, the pack is supported.
AI coding agents
- Claude CodeFirst-class plugin install via marketplace
- CursorDrop into your agent skills directory
- CodexAgent Skills spec compatible
- WindsurfAgent Skills spec compatible
Threat-intel APIs
Optional. Skills degrade gracefully, no key, no enrichment, no crash.
- Liberty91First-party · two-wayLIBERTY91_API_KEY
- Microsoft SentinelYour workspace · read-onlySENTINEL_TENANT_ID + 3 more
- VirusTotal4 req/min, 500/dayVIRUSTOTAL_API_KEY
- URLScan.io100 scans/dayURLSCAN_API_KEY
- Shodan1 req/secSHODAN_API_KEY
- AbuseIPDB1,000 checks/dayABUSEIPDB_API_KEY
- GreyNoise50 req/dayGREYNOISE_API_KEY
- AlienVault OTX10,000 req/hourOTX_API_KEY
- Censys250 queries/monthCENSYS_PAT
- MISPSelf-hosted · two-wayMISP_URL + MISP_API_KEY
- OpenCTISelf-hosted or SaaS · two-wayOPENCTI_URL + OPENCTI_TOKEN
- Ransomware.livePRO: 3,000 calls/dayRANSOMWARELIVE_API_KEY
- ReversingLabsSpectra Analyze (A1000)REVERSINGLABS_USER + REVERSINGLABS_PASSWORD
- CrowdStrikeFalcon Intelligence subCROWDSTRIKE_CLIENT_ID + CROWDSTRIKE_CLIENT_SECRET
Five ways to install.
Pick whichever fits your workflow. All five land the same 78 skills in the same layout.
Claude Code plugin
Recommended for Claude Code. Two commands and you're running.
/plugin marketplace add Liberty91LTD/cti-skills /plugin install cti-skills
npx (one-shot)
Drops the whole pack into any project directory. No global install.
npx github:Liberty91LTD/cti-skills
Git clone
If you want to read the code, run the setup script, and iterate locally.
git clone git@github.com:Liberty91LTD/cti-skills.git cd cti-skills ./scripts/setup.sh claude
Git submodule
Embed the pack inside an existing repo under your own skills directory.
git submodule add https://github.com/Liberty91LTD/cti-skills.git skills/cti
Fork or direct copy
Hit Fork on GitHub, or copy the skills/ directory straight into your project. Every skill is self-contained.
# Each skill is a folder under skills/ # Grab the ones you want, leave the rest.
Already installed? Update to v2.0.0
New skills such as /quality-of-information-check arrive with a pack update, matched to however you installed.
# Claude Code plugin (restart required to apply) /plugin update cti-skills # npx install (re-installs, overwrites existing copies) npx github:Liberty91LTD/cti-skills update # git clone git pull # git submodule git submodule update --remote skills/cti
Full install docs and the setup script live in the README.
Frequently Asked Questions.
Pack or platform, which is for you?
Same tradecraft under the hood. Two different products for two different jobs.
The open-source pack: you want to build it yourself.
You’re comfortable on the command line. You want the skills handed to you as building blocks so you can compose, fork, and ship your own workflows. Total control, no opinions you didn’t ask for.
- •Free and MIT-licensed
- •Runs inside your coding agent
- •Bring your own API keys and infrastructure
The Liberty91 platform: you want the outcomes, not the plumbing.
You’re a security professional who wants these capabilities, and a lot more, running against your organisation every day, with a team-ready UI, without having to maintain the technical foundation underneath.
- •Continuous collection + analysis, 24/7
- •Dashboards, reports, and alerting out of the box
- •Integrations for SIEM, SOAR, and ticketing
Still deciding? See what the Liberty91 platform does →