CTI skills for every AI coding agent.
A free pack of 75 Cyber Threat Intelligence skills for AI coding assistants like Claude Code, Cursor, Codex and Windsurf. Install it, ask a question in plain English, and your assistant investigates the indicator, profiles the threat actor, or writes the report for you. Built by practitioners and free to use, fork, and extend.
$ /plugin marketplace add Liberty91LTD/cti-skills $ /plugin install cti-skills
or $ npx github:Liberty91LTD/cti-skills
What is this?
Claude Code is an AI assistant from Anthropic that runs on your computer and can use tools for you. This free pack teaches it the job of a threat intelligence analyst. Normally, checking a suspicious link or IP address means opening ten different websites and copy-pasting between them. With the pack installed, you type one question and the assistant does the looking up, weighs what it finds, and writes it up the way an analyst would.
1. Install it
Two commands inside Claude Code and the pack is in. It also works in Cursor, Codex and Windsurf. Adding API keys for the lookup sources is optional and most have free tiers.
2. Ask a question
In plain English: “investigate 8.8.8.8”, “profile the threat actor APT28”, “did this IP ever show up in our Sentinel logs?”. No need to know which skill or database to use; the pack routes the question itself.
3. Read the answer
You get a structured report with a clear bottom line, the sources it used, and how confident it is, in the format real threat analysts use.
What kind of things can it do?
- Look things up: “is this IP address dangerous?” runs it through five threat-intel sources at once, VirusTotal, Shodan, AbuseIPDB, GreyNoise and OTX, instead of you checking each one.
- Investigate: “investigate this domain” runs every relevant check and comes back with one consolidated verdict.
- Search your own logs: new in v1.14, connect Microsoft Sentinel and ask “did it ever reach us?”. More on this below.
- Write detections: turn what you found into rules your security tools can alert on.
- Write the report: assessments, indicator lists and briefings in the formats analysts and their stakeholders expect.
- Stay current: built-in reference notes on ransomware groups, nation-state actors and other threats, each with a freshness date.
Completely new to Claude Code? Start with this 5-minute getting-started video or this step-by-step tutorial for non-technical beginners, then come back and install the pack.
New in v1.14: hunt for threats in your own Microsoft Sentinel.
Ask the pack about a suspicious IP and it tells you what the world knows about it. The new /lookup-sentinel skill answers the question that comes right after: did this thing ever show up in our own environment? Connect your Microsoft Sentinel workspace and the same conversation searches your own logs.
If you use Sentinel today, you probably write KQL queries by hand in the portal. With /lookup-sentinel your AI assistant does that part for you: you ask in plain English, it writes a query that fits your workspace, runs it, and reports back what it found.
Connecting takes four values you copy from the Azure portal, plus one read-only role. That role means the assistant can search your logs but can never change anything in them. It works with the Sentinel workspace you already have.
/lookup-sentinel
No two Sentinel environments contain the same data, because that depends on which connectors you have set up. So before writing any query, the skill first checks which tables actually exist in your workspace and which of them are receiving data. Then it will write KQL queries that match your specific environment. If a table it would normally use is missing, it knows which alternatives can usually answer the same question.
You can ask it to sweep your logs for a suspicious IP, domain, file hash, URL or account, or to hunt for attacker behaviour described by MITRE ATT&CK techniques. For the Defender tables it follows Microsoft's advanced-hunting schema reference.
Read the full /lookup-sentinel page →It reports what it cannot see
Sometimes your logs simply cannot answer a question, because the data was never collected in the first place. Instead of running a query that proves nothing, the skill tells you exactly that: this behaviour is not visible in the logs you currently collect, and here is the gap. And when a search comes back empty, it reports “not seen in your logs over this period” rather than “you are safe”, because your logs only cover what your connectors collect and only go back so far.
It is also strictly read-only. The skill can search your logs and list what data you have, and nothing else: it cannot close incidents, change rules, or alter your data. Microsoft caps this kind of access at 200 requests per 30 seconds, far more than the skill ever uses.
Three questions, one conversation
You do not have to remember to use it, either. When the pack investigates an indicator and concludes it is malicious or suspicious, it checks your logs for that indicator straight away. Put together with the rest of the pack, your assistant can now answer three questions in a row: which threats are relevant to you, whether your security controls can stop them, and, by hunting in your own Microsoft Sentinel, whether anything actually reached you.
See the skills in action.
Install the pack, point an agent at MISP, and let it run a Diamond Model cluster analysis end-to-end, strategic report, STIX bundles, IOC CSV. Plus a daily SOC alert workflow that enriches IOCs and models them in MISP automatically.
From what attackers are doing to what actually stops it.
Tracking threat actors and their techniques is hard enough, but mapping them against controls that actually help defend against them has always been a challenge. Combine our two latest skills to help find the answers.
/lookup-liberty91
Our own platform is finally in our own skills. This skill reads real-world events from the Liberty91 platform, deduplicated, so one breach covered by five outlets is one event and not five. Every event is enriched with the actors, the malware, the vulnerabilities and the techniques, and how each technique was used in that specific incident.
Filter by sector, country, Intelligence Requirement, affected organisation and date, and you have the threat picture for your patch rather than the internet's.
/control-coverage-mapping
Takes that technique list and tells you which controls address it, and how strongly. Built on 9,545 control-to-technique mappings from six public sources: MITRE's own guidance, plus independent assessments of NIST 800-53, AWS, Azure, Google Cloud and Microsoft 365.
This skill is based on public sources and does not need an API key. Every row cites its source and its score, so if your agents disagree, that becomes a conversation about a published assessment rather than about who sounds more confident.
A real question, start to finish
“What techniques have been trending against US financial services in the last 30 days, and what should we have in place?”
28 events, 79 techniques
Phishing, valid accounts, exploitation of public-facing apps. Named actors from BlueNoroff to Akira.
How, not just what
A remote access trojan shipped inside a package with over 100 million weekly downloads. A rootkit blinding EDR at kernel level.
The controls that match
Vulnerability scanning. Exploit protection. Limits on software installation. Application developer guidance. Each one cited, scored, and ranked.
Then the telemetry to catch what gets through: process creation on Windows and Linux, service-stop events correlated with registry edits, web server logs paired with outbound callbacks. Same session, no spreadsheet, no separate controls team, and every answer traceable to a query you actually ran.
It skips the generic advice
Rank controls by how many techniques they cover and you get the same answer every time, for every threat: user training, audit, account management. All true. All useless as a briefing, because they apply to everyone, everywhere, always.
So the skill measures each control twice: how much of your threat picture it covers, against how much of all known attacker behaviour it covers. Controls that stand out on the first and not the second are the ones worth your attention.
Also in the pack: OpenCTI, read and write.
The pack now speaks OpenCTI in both directions. Your agent can check whether an indicator is already in your knowledge base, pull the actors, reports, and campaigns you hold on a subject, and write vetted findings back as indicators, relationships, TLP markings, or whole STIX 2.1 bundles.
/lookup-opencti
Talks to your OpenCTI instance over GraphQL. Connect with OPENCTI_URL and OPENCTI_TOKEN, self-hosted or SaaS, localhost included.
One lookup checks observables and indicators at once. Global search spans every entity type, filtered listing covers ten of them, and single-entity reads walk the relationship graph. On the write side it creates indicators and observables, applies labels and TLP markings, relates entities, and imports STIX 2.1 bundles as-is, because OpenCTI is STIX-native. Writes are deliberate: destructive operations confirm first, and every command has a dry-run mode.
Read the full /lookup-opencti page →Your knowledge base becomes the pack's memory
When credentials are present, /ip-investigation and the other three investigation skills check OpenCTI automatically, /ioc-enrichment-workflow correlates every indicator against it and pushes confirmed findings back at the end, and /threat-actor-profiling reuses the intrusion sets and reports you already hold before rebuilding a profile from scratch.
/campaign-tracking publishes clusters into it and /stix-bundle output imports without rework. No OpenCTI yet? It runs locally with Docker in an afternoon.
Also recent: CrowdStrike Falcon Intelligence, ReversingLabs Spectra Analyze, MISP two-way sync, and Ransomware.live tracking
/lookup-crowdstrike returns a vendor-authoritative verdict on an indicator or a full adversary profile with origin, targeting, and MITRE ATT&CK TTPs. /lookup-reversinglabs wraps the Spectra Analyze (A1000) API for hash classification, sandbox behaviour, and pivot candidates. /lookup-misp writes as well as reads, and /lookup-ransomwarelive puts 27,600+ leak-site claims across 330+ groups at the agent's fingertips.
75 skills, organised by job-to-be-done.
Skills compose. Investigation skills chain lookups. Analytical skills prioritise IOCs for further investigation. Production skills apply tradecraft to everything that comes out.
Investigation
Hand over an IP, domain, hash, or URL. The investigation skills chain every supported API, consolidate findings, and prioritise follow-up IOCs.
Analytical tradecraft
Structured analytic techniques from the CIA tradecraft primer, available on demand to keep analysis rigorous under pressure. The same disciplines run continuously inside the Liberty91 platform's tradecraft agents.
Threat actor & campaign work
Build actor profiles, document campaigns, pivot on indicators, and dig into malware behaviour, with consistent structure every time.
Controls & coverage
The other half of the question. You know what attackers are doing; this tells you which of your controls actually stop it, which barely help, and where you have nothing. Built on 9,545 control-to-technique mappings from six public sources, so every answer cites where it came from.
Detection engineering
Turn intelligence into detections. SIGMA for SIEMs, YARA for files, KQL for Microsoft Sentinel, written to the conventions each format expects.
Intelligence production
Write assessments, build IOC exports in CSV / STIX 2.1 / OpenIOC / MISP, and quality-check the finished product before release.
Living knowledge cells
Self-updating reference cells on the threat groups and categories you need to speak to every week. Each carries a freshness date.
Lookups (external APIs)
Zero-dependency wrappers around the threat-intel APIs you already pay for. Free tiers work. Missing keys degrade gracefully. /lookup-liberty91 reads deduplicated real-world events straight from the Liberty91 platform; it, /lookup-misp and /lookup-opencti write as well as read. /lookup-sentinel looks inward instead: it searches your own Microsoft Sentinel logs to see whether an indicator ever showed up in your environment.
Management & methodology
The programme-level scaffolding that turns a library of skills into a running intelligence function: requirements, stakeholders, feedback, SOPs.
Try it in 30 seconds.
Type a natural request. The /cti-orchestrator skill routes it to the right investigation or analysis skill, then auto-applies rigour on the output, source rating, TLP marking, MISP confidence, and standard likelihood language.
Or direct-invoke a skill with a slash command when you know exactly what you want.
> Investigate 203.0.113.42 → routes to /ip-investigation
> Profile APT28 → routes to /threat-actor-profiling
> /ach → direct-invoke Analysis of Competing Hypotheses
Works with the tools you already use.
Skills follow the Agent Skills specification, so anywhere the spec is supported, the pack is supported.
AI coding agents
- Claude CodeFirst-class plugin install via marketplace
- CursorDrop into your agent skills directory
- CodexAgent Skills spec compatible
- WindsurfAgent Skills spec compatible
Threat-intel APIs
Optional. Skills degrade gracefully, no key, no enrichment, no crash.
- Liberty91First-party · two-wayLIBERTY91_API_KEY
- Microsoft SentinelYour workspace · read-onlySENTINEL_TENANT_ID + 3 more
- VirusTotal4 req/min, 500/dayVIRUSTOTAL_API_KEY
- URLScan.io100 scans/dayURLSCAN_API_KEY
- Shodan1 req/secSHODAN_API_KEY
- AbuseIPDB1,000 checks/dayABUSEIPDB_API_KEY
- GreyNoise50 req/dayGREYNOISE_API_KEY
- AlienVault OTX10,000 req/hourOTX_API_KEY
- Censys250 queries/monthCENSYS_PAT
- MISPSelf-hosted · two-wayMISP_URL + MISP_API_KEY
- OpenCTISelf-hosted or SaaS · two-wayOPENCTI_URL + OPENCTI_TOKEN
- Ransomware.livePRO: 3,000 calls/dayRANSOMWARELIVE_API_KEY
- ReversingLabsSpectra Analyze (A1000)REVERSINGLABS_USER + REVERSINGLABS_PASSWORD
- CrowdStrikeFalcon Intelligence subCROWDSTRIKE_CLIENT_ID + CROWDSTRIKE_CLIENT_SECRET
Five ways to install.
Pick whichever fits your workflow. All five land the same 75 skills in the same layout.
Claude Code plugin
Recommended for Claude Code. Two commands and you're running.
/plugin marketplace add Liberty91LTD/cti-skills /plugin install cti-skills
npx (one-shot)
Drops the whole pack into any project directory. No global install.
npx github:Liberty91LTD/cti-skills
Git clone
If you want to read the code, run the setup script, and iterate locally.
git clone git@github.com:Liberty91LTD/cti-skills.git cd cti-skills ./scripts/setup.sh claude
Git submodule
Embed the pack inside an existing repo under your own skills directory.
git submodule add https://github.com/Liberty91LTD/cti-skills.git skills/cti
Fork or direct copy
Hit Fork on GitHub, or copy the skills/ directory straight into your project. Every skill is self-contained.
# Each skill is a folder under skills/ # Grab the ones you want, leave the rest.
Already installed? Update to v1.14.0
New skills such as /lookup-sentinel arrive with a pack update, matched to however you installed.
# Claude Code plugin (restart required to apply) /plugin update cti-skills # npx install (re-installs, overwrites existing copies) npx github:Liberty91LTD/cti-skills update # git clone git pull # git submodule git submodule update --remote skills/cti
Full install docs and the setup script live in the README.
Frequently Asked Questions.
Pack or platform, which is for you?
Same tradecraft under the hood. Two different products for two different jobs.
The open-source pack: you want to build it yourself.
You’re comfortable on the command line. You want the skills handed to you as building blocks so you can compose, fork, and ship your own workflows. Total control, no opinions you didn’t ask for.
- •Free and MIT-licensed
- •Runs inside your coding agent
- •Bring your own API keys and infrastructure
The Liberty91 platform: you want the outcomes, not the plumbing.
You’re a security professional who wants these capabilities, and a lot more, running against your organisation every day, with a team-ready UI, without having to maintain the technical foundation underneath.
- •Continuous collection + analysis, 24/7
- •Dashboards, reports, and alerting out of the box
- •Integrations for SIEM, SOAR, and ticketing
Still deciding? See what the Liberty91 platform does →