ak-cti-expert

name	ak:cti-expert
description	Analyze cyber threat intelligence and OSINT cases. Use for exposure reviews, domain recon, breach checks, username/email/phone research, image forensics, blockchain tracing, darknet checks, cloud tenant recon, vulnerability lookup, threat modeling, and structured reports.
user-invocable	true
when_to_use	Invoke for OSINT, exposure review, or threat intelligence reports.
category	security
keywords	["osint","cti","threat-intelligence","recon","investigation","darknet","breach","forensics"]
argument-hint	[target] [--yolo] [--case|--sweep|--query|--flow]
metadata	{"version":"2.0","author":"Hieu Ngo - chongluadao.vn","source":"https://github.com/7onez/cti-expert","license":"MIT"}

CTI Expert

Cyber threat intelligence and open-source intelligence skill. Turns Claude into a trained CTI/OSINT analyst. Generates precision search queries, interprets public data, builds case timelines, and delivers structured intelligence products — no API keys, no paid subscriptions.

Collection method: agent-browser when available (JavaScript-heavy sites, infinite-scroll, screenshot evidence), with automatic fallback to web search / web fetch / direct URL fetch. Tool limitations are logged as collection gaps — never as case blockers.

---

1. Quick Start

# Full autonomous case — runs every applicable technique
/case target.com

# Guided flow for first-time investigators
/flow person

# Summary of what's been found so far
/brief

Append --yolo to any command to skip all interactive prompts and confirmations. The analyst makes every decision autonomously.

---

2. AEAD Case Lifecycle

Every investigation follows four phases:

Phase	What Happens
Acquire	Collect raw data — /sweep, /query, /username, /phone, /email-deep, /subdomain
Enrich	Expand leads — /branch, /crossref, /link-subjects, /signatures
Assess	Score and verify — /exposure, /threat-model, /validate, /coverage, /verify-finding
Deliver	Package output — /report, /brief, /render, /workspace save — auto-saves .md + .docx

Run /progress at any point to see which phase you're in and what's pending.

---

3. Command Reference

Commands grouped by AEAD phase.

Acquire

Command	What It Does