| name | technical-investigation |
| description | Passive technical methods for indicators, infrastructure history, local files, email headers, public GitHub, and verified export. |
| version | 1.0 |
| invocable_by | ["investigator","fact-checker","orchestrator","user"] |
| requires | ["epistemic-grounding","web-archiving","shell-safety"] |
| attribution | Adapted from 7onez/cti-expert (https://github.com/7onez/cti-expert), by Hieu Ngo / chongluadao.vn. MIT License with upstream Ethical Use Addendum. |
Technical Investigation
Use passive, source-linked technical observations as leads in a Spotlight investigation. This skill does not assign a risk score, identify a person from infrastructure alone, or turn provider labels into verified findings.
Adapted from CTI Expert by Hieu Ngo / chongluadao.vn (GitHub: 7onez; MIT License with upstream Ethical Use Addendum). Spotlight preserves the useful investigative methods while deliberately excluding the upstream runtime, installers, credential and breach workflows, active scanning, identity merging, and automatic trust scoring.
Route One Task at a Time
| Need | Reference |
|---|
| Triage a domain, IP, URL, or file hash using passive sources | references/indicator-triage.md |
| Reconstruct DNS, certificate, registration, or HTTP history | references/infrastructure-history.md |
| Examine local document metadata or raw email headers | references/document-message-forensics.md |
| Trace public GitHub repository, commit, fork, or release history | references/github-public.md |
| Export fact-checked technical indicators after Gate 1 | references/verified-indicator-export.md |
Model-tier loading
12b: read this root and exactly one matching *-compact.md reference. Do not load the expanded counterpart in the same cycle.26b or 31b: read the matching expanded reference, but only for the active task.frontier, api, Codex Desktop, or Claude Desktop with no smaller tier configured: read the matching expanded reference.- Verified export has one short reference for every tier and is only available after fact-checking.
The tier changes context density, not evidence standards, tool authority, or safety boundaries.
Record the Selected Method
When this skill is selected during methodology, include technical-investigation in skills_invoked[] and append one object per selected method to method_provenance[]:
{
"skill_id": "technical-investigation",
"method": "indicator-triage|infrastructure-history|document-message-forensics|github-public|verified-indicator-export",
"upstream": "7onez/cti-expert",
"active_sha": "f9ecc9b0258caff78d26c0b779d1687f4431749f",
"reference": "the one tier-selected reference filename"
}
This records method provenance, not evidence for a factual claim.
Non-negotiable Method
- Preserve the exact input and classify its type. Never silently normalize away path, port, case, or query-string evidence.
- Prefer passive records, public APIs, archives, and local artifacts. Do not visit a suspicious URL in a normal browser, probe ports, enumerate services, validate credentials, or interact with a target account.
- Record each observation with source URL or local artifact, collection time, observed time when supplied, access method, and provider wording. Archive public evidence when permitted.
- Separate observation from inference. Shared hosting, reused certificates, repository metadata, and provider classifications are pivots—not proof of common control, authorship, maliciousness, or identity.
- Record attempted, observed, null, skipped, and blocked paths. A null result is not exculpatory; a skipped path must include a reason.
- Invoke
epistemic-grounding before promoting a technical lead into findings.json. Search for contradictions and preserve unresolved conflicts.
- Put shell parameters through
shell-safety. Keep artifacts inside the case directory and never auto-install a dependency.
- During fact-checking, name every assessed explicit indicator in the claim's
technical_indicator_ids[] and include its exact value in claim_text. Unlisted or non-verified indicators cannot export.
Related Skills
invoke-skill("web-archiving") to preserve public technical evidence.invoke-skill("content-access") when a relevant public source is inaccessible.invoke-skill("follow-the-money") when a public blockchain trail becomes a financial-flow question.invoke-skill("investigate") for the investigation-wide coverage ledger.
Credits
Method selection and adaptation are documented in references/source-map.json. CTI Expert remains an independent upstream project; Spotlight ships reviewed adaptations, not its executable runtime.
