| name | cti-expert |
| description | Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, domain/subdomain/DNS/certificate recon, web-infrastructure pivoting (favicon hashes, tracker IDs, TLS certs, phishing-kit fingerprinting, campaign clustering), username/email/phone enumeration, breach and infostealer-log triage, image forensics, geolocation, crypto-wallet and IBAN/bank-account tracing, darknet search, M365/Azure and SaaS tenant recon, China/Sinophone recon (ICP filings, PRC corporate registries, Baidu/FOFA/Quake/ZoomEye), vulnerability and ransomware lookup, threat modeling, PII redaction, and structured reporting. Commands include /case, /sweep, /query, /webpivot, /username, /phone, /email-deep, /breach-deep, /icp, /cn-corp, /iban, /stealer-log, /exposure, /threat-model, /report, /brief, /redact, /apikeys. |
| version | 2.7 |
| author | Hieu Ngo - chongluadao.vn |
CTI Expert
Cyber threat intelligence and open-source intelligence skill. Turns Claude into a trained CTI/OSINT analyst. Generates precision search queries, interprets public data, builds case timelines, and delivers structured intelligence products — no API keys, no paid subscriptions.
Runs anywhere. Works in Claude Code (Desktop & CLI) and in OpenAI Codex / ChatGPT and other AGENTS.md-aware agents — see AGENTS.md for the cross-agent runtime contract. Throughout this file, $SKILL_DIR = the directory containing this SKILL.md (Claude Code: ~/.claude/skills/cti-expert; Codex/manual clone: the repo you are working in). Resolve it by locating SKILL.md — never hard-assume ~/.claude. Detect the OS once (Windows/macOS/Linux) and prefer uv for all Python — see §13 Tool Auto-Install Policy.
Collection method: agent-browser when available (JavaScript-heavy sites, infinite-scroll, screenshot evidence), with automatic fallback to web search / web fetch / direct URL fetch. Tool limitations are logged as collection gaps — never as case blockers.
1. Quick Start
/case target.com
/flow person
/brief
Append --yolo to any command to skip all interactive prompts and confirmations. The analyst makes every decision autonomously.
2. AEAD Case Lifecycle
Every investigation follows four phases:
| Phase | What Happens |
|---|
| Acquire | Collect raw data — /sweep, /query, /username, /phone, /email-deep, /subdomain, /webpivot + /icp (domain/URL targets), /cn-corp · /iban · /hash-id on discovery |
| Enrich | Recursive pivot loop — the pivot orchestration engine treats every discovered identifier as a new seed and expands the graph hop-by-hop (/branch, /crossref, /link-subjects, /signatures) automatically until the frontier is exhausted, no approval prompts (autonomy=auto). Acquire↔Enrich iterate, not run once. |
| Assess | Score and verify — /exposure, /threat-model, /validate, /coverage, /verify-finding. Judgments carry likelihood terms, coverage gets the 5W1H pass, attributions get an ACH matrix (handbook/analytic-standards.md) |
| Deliver | Package output — /report, /brief, /render, /workspace save — auto-saves .md + .html + .json + .csv + IOC bundle |
Run /progress at any point to see which phase you're in and what's pending.
/case and web-infra pivoting. For a domain or URL target, /case includes
web-infrastructure pivoting (/webpivot) in the Acquire phase. It runs keyless by default
(crt.sh + passive DNS + anonymous urlscan) and upgrades automatically when premium keys are
set via /apikeys (Shodan/Censys/FOFA/DNSLytics/SecurityTrails/urlscan-PRO/WhoisXML). Because
/webpivot can fetch the target directly, for hostile infrastructure it prefers passive capture
(urlscan/Wayback) — see techniques/web-pivot.md. It is not run for
username/phone/person targets.
Archive IOC harvest runs by default too. For domain/URL targets the Acquire phase also runs
wayback_harvest.py <domain> --indicators (add --urlscan when URLSCAN_API_KEY is set),
harvesting emails, phones, crypto wallets, tracking/verification IDs, SaaS-operator IDs, and
socials from the entire Wayback history — not just the live page — with first-seen/last-seen
per selector. It writes case-schema indicators[] to <case>/raw/harvest.indicators.json, which
merge into the case and flow into the auto-saved IOC bundle at Deliver. This is the step that
recovers selectors a network later scrubbed — across the whole snapshot corpus, not just the live page.
Passive by construction — only web.archive.org (+ urlscan.io if keyed), never the target.
The five v2.6 commands are in the pipeline too — no flags. /icp runs for every
domain/URL/org target (and an IP's resolved hostname); /cn-corp, /iban and /hash-id
fire the moment a company name/USCC, payment detail, or hash appears — and all three feed
their yields back into the recursive pivot loop as new seeds, so an ICP licence serial or
a reused bank account expands the graph like any other node. /redact is the exception: it
is opt-in (--redact), because a redacted report is a weaker artifact and that should
always be a deliberate choice. Full trigger table: §Technique Activation Matrix.
Narrow with --no-cn.
Two layers, one skill: broad collector → deep pipeline. cti-expert is the broad
collector — the wide net of Acquire/Enrich commands (/webpivot, /sweep, /subdomain,
/icp, /username, /email-deep, /breach-deep, …) that pull artifacts from anywhere. The
intel_engine engine is now vendored in-repo under intel_engine/ (intel_engine/harness/,
intel_engine/tools/, intel_engine/WebPivot/, intel_engine/IntelGraph|IntelReport|BinaryPivot|IntelAnalysis/)
and supplies the pipeline chains + deeper pivoting logic: a persistent knowledge base (intel_engine/knowledge/), versioned cases
(cases/), cross-case correlation, calibrated assessment, and rendering.
The chain: broad collection (cti-expert) → the pipeline (/pipeline, /harness) ingests it,
then applies the deep logic — "seen this operator before?" (/recall), whole-KB clustering
(/kb --cluster, /cert-overlap), false-positive control (/reference), risk scoring
(/risk), hypothesis generation, confidence calibration, and a versioned Assessment. The
pipeline drives cti-expert's own scripts/webpivot/pivot_extract.py collector, so the broad and
deep layers share one artifact shape end-to-end.
Self-contained & self-resolving. /backend resolves to SELF (in-repo) — no external
setup. Deps: uv venv && uv pip install -r requirements.txt (harness SDK/MCP + IntelGraph
renderers; the collector + KB + deterministic pipeline are stdlib and need none). An explicit
$INTEL_HOME still overrides for a shared external KB. Full architecture, the op map, and the
evidence-envelope schema: connectors/intel-backend.md.
2.5. Pivot Priority & False-Positive Control (CRITICAL)
Two failure modes ruin a cluster: asserting a link that isn't there, and missing one that is.
This section governs both. Apply it in Enrich, before anything reaches a report.
Pivot priority ladder
Work down this ladder. Never assert same-operator on a lower rung when a higher rung is
available or contradicts it. Tag every asserted link in the report with the rung it rests on.
| Rung | Indicator | Strength |
|---|
| 1 | Registrant email / phone / org — including historic WHOIS | decisive |
| 2 | One domain carrying two identities across its own WHOIS history | decisive — proves an alias |
| 3 | Site-verification token (Google Search Console, etc.) | decisive — proves account control |
| 4 | Shared TLS certificate / SAN cross-cover | strong |
| 5 | Nameserver delegation to a host the operator runs themselves | strong — proves zone control |
| 6 | APK signing certificate | strong |
| 7 | Distinctive favicon / analytics / tracker / backend tenant ID | moderate — verify below |
| 8 | Co-tenancy on a dedicated host (few tenants) | moderate |
| 9 | Site template / framework / kit | weak — kit-level, never operator-level |
| 10 | Co-tenancy on shared/reseller hosting; managed-provider nameservers | information, not a link |
Reverse-WHOIS is the highest-yield pivot here. Always mode=preview first — the count is
free. A term returning hundreds is shared boilerplate; do not purchase it.
Mandatory false-positive control
Before any indicator becomes a cluster edge, run /reference check <value>. If it returns
UNKNOWN, decide and record it with /reference add so the next case inherits the judgement.
Six traps, all of which have produced real false clusters:
| Trap | Why it fools you | Test |
|---|
| Commodity site kit | A template sold to hundreds of unrelated fraud operators | Search the template path in urlscan/FOFA — a large population means kit-level |
| Privacy-proxy contacts | The registrar's boilerplate phone/email, shared by every customer of that service | Reverse-WHOIS it; a spread of unrelated domains means noise |
| Shared/reseller hosting IP | A 20+-tenant cPanel box links nothing | Count tenants before clustering |
| Managed-provider nameservers | Cloudflare/GoDaddy/Gandi/Wix NS are shared by millions | Self-hosted NS is rung 5; provider NS is rung 10 |
| Org-name collision | A registrant org string that also matches a real, unrelated company | Reverse-WHOIS the org; inspect what comes back before attributing |
| Shared analytics / tag container | Often one web developer reusing a container across unrelated clients | Check domain creation dates — a decade-old business sharing a tag with a new fraud domain is a third party |
Never put an unvalidated indicator into a report that recommends abuse reporting. Naming an
uninvolved business is the most damaging error this skill can produce. When a cluster rests on a
single rung-7-or-below indicator, label it candidate, single-indicator — not a cluster member.
Never submit the case's own sample to a public sandbox (CRITICAL)
/anyrun is lookup-only. It reads detonations that already happened; it has no submit path,
and the submission endpoint is deliberately absent from BinaryPivot/references/anyrun.json.
tests/test_no_sample_submission.py enforces that as a gate, so it cannot regress quietly.
Do not work around it. Uploading the case's own APK / installer / archive to ANY.RUN —
or VirusTotal, or any public sandbox — is an outbound, irreversible act:
- A public task is world-readable: the file, its hash, screenshots and full network log.
- Operators watch for their own samples. The standard response is to rotate the backend,
revoke the signing key and re-skin the front — destroying the infrastructure the case is built
on, often days before a takedown or referral can land.
- It cannot be recalled. Unlike a query from the wrong egress, there is no cleanup.
If detonation is genuinely necessary, stop and put it to the analyst in plain terms — what
becomes public, and that it is permanent — and let them do it themselves in the sandbox UI on a
private plan. Never as a side effect of a pivot, and never on standing permission inferred
from an earlier approval. The same reasoning governs --submit (urlscan/Wayback): a public
urlscan scan of a live scam funnel is visible to the operator too.
A permuted email is a hypothesis, never a finding (CRITICAL)
When a case yields a real person's name or a username, and you already hold a domain that
matters to the case, run /email-permute. An operator's mailbox is almost never published, but
it is usually derivable — mail hosts use a small set of local-part conventions, and the operator's
own domain is the highest-yield thing to permute against.
That value comes with a matching hazard, so this rule is absolute:
- Permute against the case's own domains. Name × the operator's domain is a narrow, high-prior
question. Name ×
gmail.com is volume with no prior behind it — --free exists, is capped, and
should be a deliberate choice, not a reflex.
- Never ingest a candidate into the KB, cite one in a report, or contact one. A fabricated
address that reaches
kb_ingest becomes a shared indicator, and a shared indicator merges two
operator clusters. A permutator wired straight into correlation does not enrich a case — it
silently names an innocent party. This is the same failure RULE 5 exists to prevent.
- Candidates are not seeds. They never enter the spider-map frontier. Only an address in the
tool's
promote list — corroborated by independent evidence (Gravatar registration, breach
corpus, a GitHub commit, a page/DOM hit, a dork) — may be treated as a real email seed, and that
promotion is an analyst decision.
- Never validate over SMTP.
RCPT TO probing connects to the target's mail server, which the
egress posture exists to prevent on a hostile case; and a catch-all domain answers 250 for
every address ever tried, so it manufactures confidence instead of measuring it. Use --verify,
which gates on MX (RFC 7505 null MX included) and checks Gravatar — both keyless, neither
touching the target.
State the status in the turn. "12 candidates, 0 corroborated" is an honest result; presenting
those 12 as discovered addresses is not.
Dead seed? Do not stop
Zero pivots, a parked page, or NXDOMAIN is not an answer. Run /fallback <domain> — crt.sh,
the full Wayback timeline, archive.today, and the local KB. A parked apex frequently has live
subdomains: enumerate CT and the Wayback CDX host histogram before writing a seed off. Report an
empty result as empty; a collector that returned nothing is a finding, not something to omit.
3. Command Reference
3.0 Entry point & registered commands
/cti <target> is the single entry to this skill. It routes any target type — domain, IP,
email, username, phone, wallet, hash, APK — through recall → collect → cluster → assess. Plain
English works identically ("analyze example.com and pivot the infrastructure"); the command form
just removes ambiguity.
Eight commands are registered with Claude Code by bash scripts/register.sh and work from a
cold prompt in any project:
| Command | Does | Equivalent T2 op | Equivalent T1 tool |
|---|
/cti <target> | entry point — routes by target type | (whole chain) | (whole chain) |
/cti-recall <seed> | seen before? run first, always | recall | domain_verdict, which_cases |
/cti-case <ID> <seeds> | full deterministic pipeline | pipeline open | (none — CLI only) |
/cti-pivot <url|ip> | collect one target | pivot-extract | pivot_extract |
/cti-cluster <domain> | correlate & expand | kb, cert-overlap | kb_cluster, cert_overlap |
/cti-check <indicator> | false-positive control | reference check | reference_check, reference_add |
/cti-report <ID> | render graph + PDF/DOCX | graph, report | render_diagram, render_report |
/cti-status | backend / MCP / credits health | backend.py status | api_usage |
Every other /command in §3 is a convention read from this file, not a registered command.
Once the skill is loaded they are unambiguous instructions; typed at a cold prompt they do
nothing. When in doubt use /cti and describe the goal.
Three layers, one operation. The same capability is reachable three ways and the names differ
by layer — T0 uses kebab-case after a slash, T2 uses kebab-case ops, T1 uses snake_case
tools. The table above is the canonical mapping; when you add a capability, add a row here in the
same commit or the layers drift apart again.
Capabilities that are not registered commands still carry their layer mapping inline in the §3
tables. The engine's WebPivot/BinaryPivot collectors add these: /capabilities (T2 capabilities,
T1 capability_check), /impersonate (T2 impersonate, T1 impersonation_hunt), /search-pivot
(T2 search-pivot, T1 search_pivot), /censys (T2 censys, T1 censys), /intelx
(T2 intelx, T1 intelx_search) and /anyrun (T2 anyrun, T1 anyrun_lookup).
Commands grouped by AEAD phase.
Acquire
| Command | What It Does | Example |
|---|
/case [target] | Full pipeline — runs every applicable technique | /case example.com |
/sweep [target] | Multi-vector recon on any target type | /sweep @username |
/query [subject] | Builds 12–15 advanced search operator queries | /query example.com |
/username [handle] | Enumerate handle across 3000+ platforms | /username johndoe |
/phone [number] | Carrier, line type, reputation, public associations | /phone +84901234567 |
/email-deep [email] | Accounts, breach history, infrastructure | /email-deep u@domain.com |
/subdomain [domain] | CT logs, brute-force, passive enumeration; flags admin/sensitive subdomains (admin,adm,kef,ador,panel…) per handbook/admin-endpoint-indicators.md | /subdomain example.com |
/breach-deep [email] | Multi-source breach lookup with context | /breach-deep u@domain.com |
/traffic [domain] | Traffic estimation, ranking, audience data | /traffic example.com |
/visitors [domain] | Full visitor intelligence: tech, geo, sources, analytics | /visitors example.com |
/techstack [domain] | Technology fingerprint (CMS, analytics, CDN, server) | /techstack example.com |
/competitors [domain] | Competitor & related site discovery | /competitors example.com |
/secrets [target] |
| /dork-sweep [target] [--telegram\|--docs\|--filetype\|--all] [--after DATE] [--clean] | Zero-auth dork sweep: Telegram ecosystem, 18 doc-hosts, filetype families; 4-tier fallback cascade | /dork-sweep example.com --filetype |
| /docleak [target] [--platform list] [--severity high] | 18-platform document leak hunt with severity classification (CRITICAL/HIGH/MEDIUM/LOW) | /docleak "Acme Corp" |
| /dns-history [domain] | Historical DNS record changes (A, NS, MX) via passive DNS | /dns-history example.com |
| /cert-history [domain] | SSL/TLS certificate timeline from CT logs (crt.sh) | /cert-history example.com |
| /email-permute [name] [domain] | Generate email permutations from name + domain | /email-permute "John Smith" company.com |
| /proton-check [email] | Proton Mail account creation date via PGP key | /proton-check user@proton.me |
| /pgp-lookup [email] | PGP key search — creation date, UIDs, signatures | /pgp-lookup dev@example.com |
| /wifi [ssid] | WiFi SSID geolocation via Wigle.net | /wifi "HomeNetwork" |
| /wifi --bssid [mac] | Exact AP lookup by MAC address | /wifi --bssid AA:BB:CC:DD:EE:FF |
| /register [name] | Add a subject to the case workspace | /register JohnDoe |
| /snapshots [url] | List/fetch archived Wayback snapshots. Note: WebFetch is blocked from web.archive.org (robots.txt) — use scripts/webpivot/wayback_fetch.py to list captures and pull archived content. See analysis/archive-explorer.md | /snapshots example.com |
Enrich
| Command | What It Does | Example |
|---|
/branch [data] | Expand a discovered identifier laterally | /branch john@mail.com |
/pivot-suggest | Rank "what to pivot on next" from findings — leet/variant/reuse/temporal/domain clusters | /pivot-suggest |
/email-permute [name|handle] | Derive email candidates from a person name or username against case domains. VN/CN/KR family-name-first aware; folds diacritics Unicode won't. --verify = MX gate + Gravatar. Output is hypotheses — see the rule below | /email-permute "Nguyen Van A" --domain example.com --verify |
/rank-relations | Score + rank same-operator relations across analyzed pages (noise-filtered, clustered) | /rank-relations |
/crypto-balance [addr] | On-chain balance + lifetime flow for a wallet, valued at spot | /crypto-balance 1A1z… |
/timeline [subject] | Assemble dated event sequence | /timeline Company Inc |
/crossref | Detect shared identifiers across subjects | /crossref |
/link-subjects [A] [B] | Define a connection between two subjects | /link-subjects John Jane |
/show-connections | Display all logged connections | /show-connections |
/show-trail [subject] | Show the evidence chain for a subject | /show-trail JohnDoe |
/watch [subject] | Add subject to active tracking list | /watch example.com |
/record-finding | Log a finding with source and confidence | Paste data after command |
/show-findings | List all recorded findings |
Assess
| Command | What It Does | Example |
|---|
/exposure [target] | Composite exposure score (0–100) | /exposure domain.com |
/threat-model | Build threat model from findings; every attribution claim carries an ACH matrix (competing hypotheses scored by inconsistency, runner-up named) per handbook/analytic-standards.md §3. Backend hook (Assess): if /backend is up, calibrate confidence on your own priors first — intel.py operators list + intel.py risk --case <id> + read knowledge/{calibration.jsonl,analyst_profile.md} — instead of scoring from scratch. See connectors/intel-backend.md §6 | /threat-model |
/signatures | Surface recurring behavioral patterns | /signatures |
/validate | Quality audit — score 0–100 | /validate |
/coverage | Coverage matrix with identified gaps — technique matrix plus the 5W1H substantive pass (Why/How unanswered blocks Deliver-ready) | /coverage |
/verify-finding [id] | Re-check a specific finding's sources | /verify-finding 12 |
/subject [name] | View or create subject record | /subject JohnDoe |
/lookup [name] | Retrieve a registered subject | /lookup JohnDoe |
/modify [name] | Update a subject record | /modify JohnDoe |
/archive-subject [name] | Remove subject from active tracking | /archive-subject JohnDoe |
/find [query] | Search across all subjects | /find domain:example.com |
Deliver
| Command | What It Does | Example |
|---|
/report | Full report — auto-saves .md + .html + .json + .csv + IOC bundle | /report |
/report html | Interactive self-contained HTML report (primary deliverable) | /report html |
/report brief | Single-page executive brief | /report brief |
/report json | Raw data as JSON | /report json |
/report csv | Spreadsheet-compatible export | /report csv |
/report docx | Word document (rich charts/diagrams) — on request | /report docx |
/report legal | Evidence-formatted for legal proceedings (adds DOCX/PDF) | /report legal |
/report journalist | Source-citation-heavy format | /report journalist |
/brief | Plain-language summary (non-technical) | /brief |
/render entities | ASCII subject relationship diagram | /render entities |
/render timeline | Chronological event chart | /render timeline |
/render risk | Exposure heatmap | /render risk |
/render network | Network topology of connections | /render network |
/stats | Counts and coverage statistics | /stats |
/workspace save [name] | Persist case state | /workspace save mycase |
/workspace open [name] |
UX & Navigation
| Command | What It Does | Example |
|---|
/flow [type] | Guided step-by-step case workflow | /flow person |
/template list | Browse pre-built case templates | /template list |
/template run [name] | Run a pre-built template | /template run security-audit |
/novice | Toggle simplified, low-jargon mode | /novice |
/terms | OSINT term glossary | /terms |
/progress | Current case phase and coverage | /progress |
/opsec | OPSEC checklist for current task | /opsec |
/onboard | Interactive first-time onboarding guide | /onboard |
/quality | Investigation quality composite score | /quality |
Configure
| Command | What It Does | Example |
|---|
/apikeys | Manage premium/pro API keys (Shodan, Censys, FOFA, SecurityTrails, DNSLytics, urlscan-PRO, WhoisXML, Hudson Rock, IntelX, GitHub, SerpAPI…) — status/set/unset/test/unlocks. Keys upgrade existing techniques (especially /webpivot); keyless/free stays the default. Stored chmod-600 in $SKILL_DIR/.env (gitignored), env-var override. See handbook/api-keys.md | /apikeys set shodan <KEY> |
/backend | Detect/report the optional persistent-intelligence backend and pick the tier — Tier 1 typed MCP (intel-harness) → Tier 2 CLI → Tier 3 stateless. Runs scripts/backend/backend.py to resolve $INTEL_HOME (env → .mcp.json → sibling dir → symlink) and print the tier line. All the backend commands below dispatch through scripts/backend/intel.py <op> at Tier 2 (or the typed MCP tool at Tier 1). intel.py list maps all ~39 engine ops (full CLI parity — CDN ranges, graph-build, hypothesize, calibration, evidence-report, case-store, cost, deterministic pipeline, …); intel.py mcp prints/writes the .mcp.json that enables Tier 1 ("the server"). See connectors/intel-backend.md | /backend · /backend check |
/kb [query] | Built-in. Query the shared knowledge base. T2: intel.py kb --stats/--entity <v>/--cluster <domain>/--shared --min N; intel.py operators list. T1: kb_entity/kb_cluster/kb_query_shared | /kb --entity example.com |
/recall [seed] | Built-in. "Have I seen this before?" — check a seed against every prior case before collecting. / (typed MCP). (query.py ; which_cases/domain_verdict are MCP-only). Surfaces known operators up front |
4. Subject & Connection Model
Reference: engine/case-schema.json, engine/subject-registry.md
Subject Types
| Type | Emoji | Examples |
|---|
| Person | 👤 | Full name, alias |
| Username | @ | Social handle |
| Email | 📧 | Address, domain |
| Domain | 🌐 | Site, subdomain |
| IP Address | 🖥 | IPv4, IPv6 |
| Organization | 🏢 | Company, group |
| Phone | 📱 | E.164 format |
| Location | 📍 | GPS, address |
| Asset | 📦 | Document, image |
| Event | 📅 | Dated occurrence |
| Device | 🖥️ | IoT device, server, workstation |
| Image | 🖼️ | Photograph, screenshot |
| Crypto Address | 💰 | Bitcoin, Ethereum wallet |
| Bank Account | 🏦 | IBAN, local account no., BIC |
| ICP Filing | 📋 | PRC licence serial (one registrant, many sites) |
| Custom | 🏷️ | User-defined entity type |
Connection Types
owns — domain, email, or asset ownership
uses — platform account or tool usage
works_at — employment or affiliation
linked_to — general association
alias — same identity, different handle
communicated_with — observed contact
Finding Trust Scores
| Score | Label | Meaning |
|---|
| 5 | PRIMARY | Authoritative or official source |
| 4 | DERIVED | Confirmed by 2+ independent sources |
| 3 | CONFIRMED | Single reliable source, verified |
| 2 | ANECDOTAL | Reported but unverified |
| 1 | CONTESTED | Conflicting data exists |
Source Reliability Scale
Complements numeric trust scores with source-level grading. Trust score rates finding content; source reliability rates the source itself.
| Grade | Label | Typical Sources |
|---|
| A | Completely Reliable | Official registries, government records |
| B | Usually Reliable | Established outlets, corporate sources |
| C | Fairly Reliable | Known blogs, industry publications |
| D | Not Usually Reliable | Anonymous forums, unverified claims |
| E | Unreliable | Known disinformation, fabricated content |
| F | Cannot Be Judged | Insufficient information to assess |
Confidence Levels
| Level | Label | Use When |
|---|
| VERIFIED | Direct observation, primary source | |
| STRONG | Multiple corroborating sources | |
| MODERATE | Single reliable source | |
| WEAK | Circumstantial or inferred | |
| TENTATIVE | Analyst deduction only | |
| CHALLENGED | Contradicted by other findings | |
Likelihood Language (judgments, not findings)
The three scales above grade evidence. An analytic judgment built on that evidence —
an attribution, a motive, a forecast — carries a probability-anchored likelihood term instead.
Without an anchor, "MODERATE" routinely means a 30-point-different thing to writer and reader.
| Term | Band | | Term | Band |
|---|
| Almost no chance | 1–5% | | Likely / probable | 55–80% |
| Very unlikely | 5–20% | | Very likely | 80–95% |
| Unlikely | 20–45% | | Almost certain | 95–99% |
| Roughly even chance | 45–55% | | | |
Likelihood and confidence are orthogonal — report both:
The operator is very likely based in Guangdong (moderate confidence — single
registry record, unverified).
Never 0% or 100%. One term per judgment. Never attach a likelihood term to a directly
observed fact. findings[].confidence in the report JSON stays an integer describing
evidence quality — likelihood lives in the narrative.
Attribution claims additionally require an ACH matrix (competing hypotheses, scored by
inconsistency, runner-up named). Full rules — likelihood, the 5W1H coverage overlay, and ACH:
handbook/analytic-standards.md.
Map Rendering (ASCII Mandatory)
ALL visualization commands produce ASCII box-drawing art by default. This includes /graph, /render entities, /render network, /render timeline, /render risk, /pathfind, and /show-connections. Mermaid available only with explicit --mermaid flag.
Why ASCII-first: Universal terminal compatibility, renders correctly in .md and .docx exports, no external renderer dependency.
┌─────────────────────────────┐ owns ┌───────────────────────────┐
│ 👤 John Doe [3/5] │══════════▶│ 🌐 example.com [4/5] │
└─────────────────────────────┘ └───────────────────────────┘
│ works_at │ hosted_on
▼ ▼
┌─────────────────────────────┐ ┌───────────────────────────┐
│ 🏢 Acme Corp [4/5] │ │ 🖥 203.0.113.10 [4/5] │
└─────────────────────────────┘ └───────────────────────────┘
Connection arrows: ═══▶ owns · ───▶ confirmed · ···▶ inferred · ←─▶ bidirectional · ─·─▶ alias · ╌╌▶ works_at
Box styles: ┌──┐ confirmed · ┌ ─ ┐ unverified · ╔══╗ target
Badge: [n/5] trust score · emoji prefix = entity type
5. Finding Framework
Reference: engine/finding-framework.md, engine/conflict-resolver.md
Every finding logged via /record-finding captures:
Source URL / method
Collection method (browser | search | fetch | manual)
Trust score (1–5)
Confidence level (VERIFIED → CHALLENGED)
Timestamp
Linked subjects
Conflict detection (engine/conflict-resolver.md): When two findings about the same subject contradict each other, the system flags a CONTESTED state. Both findings are preserved. Resolution options: accept one, mark both TENTATIVE, or log the conflict as its own finding.
Deviation detection (analysis/deviation-detector.md): Automatically flags behavioral anomalies — account creation gaps, platform presence inconsistencies, metadata mismatches.
Weight engine (analysis/weight-engine.md): Aggregates trust scores across findings to compute subject-level confidence.
6. Technique Catalog
Reference directory: techniques/
| File | Covers |
|---|
fx-metadata-parsing.md | EXIF, email headers, document metadata analysis |
fx-image-verification.md | Image authenticity and provenance workflow |
fx-breach-discovery.md | Breach database methods and paste site search |
fx-geolocation.md | GPS extraction, W3W, Plus Codes, MGRS, Street View |
fx-social-topology.md | Social graph construction and topology |
fx-email-header-analysis.md | Header analysis, SPF/DKIM, SMTP routing |
fx-document-forensics.md | Document forensics and metadata extraction |
fx-http-fingerprint.md | HTTP fingerprinting and server signature analysis |
fx-leak-monitoring.md | Leak and breach monitoring, paste site search |
| fx-dork-sweep.md | Zero-auth Google/Bing dork sweeps — Telegram ecosystem, doc-hosts, filetype families + 4-tier fallback cascade (WebSearch → Bing → DDG → agent-browser) |
| fx-document-leak-hunt.md | 18-platform document leak discovery with severity classification, paywall handling, auto-snapshot |
| username-osint.md | 3000+ platform enumeration with pivot extraction |
| phone-osint.md | Carrier lookup, VoIP detection, spam databases, FreeCNAM CallerID, WhoCalld, USPhoneBook reverse lookup |
| email-osint.md | Full email investigation: accounts, breaches, infra, Proton API, PGP keys, permutation, manual reference tools |
| fx-dns-cert-history.md | Historical DNS records (passive DNS, A/NS/MX changes), SSL certificate timeline (crt.sh CT logs) |
| threat-intel.md | AbuseIPDB, GreyNoise, OTX, VirusTotal, URLScan.io, CIRCL CVE, NVD API, ransomware.live |
| web-traffic-analysis.md | SimilarWeb/Semrush estimation, audience data |
| secret-scanning.md | Credential/secret detection in repos and pastes |
| github-osint.md | GitHub user/org/repo profiling, code search, commit metadata, forks, collaboration networks |
| domain-advanced.md | Subfinder, Amass, CT log enumeration |
| social-media-platforms.md | Twitter/X Snowflake IDs, Discord, Strava, BlueSky, ShareTrace share link analysis |
| advanced-geolocation-techniques.md | Overpass Turbo, road sign analysis, reflected text |
| web-dns-forensics.md | Zone transfers, Tor lookups, GitHub, Telegram, WHOIS, Xeuledoc Google doc intel |
| fx-visitor-intelligence.md | Visitor stats, tech stack, geo, traffic sources, analytics/AdSense/advertising ID cross-domain linking, competitors |
| wifi-ssid-osint.md | WiFi SSID/BSSID geolocation via Wigle.net, encryption analysis, travel patterns |
| scam-check.md | Phishing/scam domain verification and detection |
| cloud-audit.md | Cloud infrastructure security (AWS/GCP/Azure): IAM, network, storage, compute, logging, secrets |
| microsoft-tenant-recon.md | M365/Azure tenant enumeration — federation, tenant ID, Azure AD config, MDI detection |
| china-recon.md | China/Sinophone layer — ICP filing → PRC entity + licence-serial sibling pivot, GSXT/信用中国/TianYanCha/QCC/Aiqicha registry chain, USCC validation, Quake/ZoomEye/FOFA cyberspace engines, Baidu dorking, CJK pinyin + Traditional variant generation, CN social platforms, access-reality gaps |
| fiat-payment-osint.md | Bank accounts as selectors — IBAN mod-97 validation + BBAN decomposition, BIC, VN/SEA non-IBAN rails (VietQR/NAPAS BIN), account-reuse pivot, mule-pattern signals |
| fx-edge-appliance-recon.md | Edge/VPN appliance fingerprint → CISA KEV/CVE catalog (Citrix/F5/Cisco/Ivanti/Forti/PAN/Exchange) + exposed-service port-risk matrix (Shodan InternetDB, passive-first) |
| | SaaS tenancy + identity-fabric mapping — DNS-TXT tenancy tokens, IdP fingerprinting (Okta/Auth0/OneLogin/Ping/Keycloak/ADFS/Entra), unauthenticated API/GraphQL/OpenAPI-spec discovery |
| | Supply chain security: CVE audit, framework-specific vulns, typosquatting, CI/CD security |
| | Digital evidence analysis: image integrity, Sleuth Kit, file carving, artifact recovery, timeline |
| | Security incident response: NIST 800-61 methodology, containment, evidence preservation, IOC extraction |
| | OWASP Top 10 (2021) source code audit with grep patterns and CWE references |
| | AI/LLM security: prompt injection classes, agent/MCP security, permission boundary audit |
| | Infostealer-log triage: family fingerprinting (RedLine/Vidar/StealC/Lumma/META/traffer), victim-vs-operator profiling, cross-log actor correlation, IOC + attribution extraction ( parser, raw artifacts shown) |
| | Interactive browser collection & evidence capture via vercel-labs/agent-browser (CDP, accessibility-tree snapshots, screenshots; primary interactive collector, complementary to Scrapling) |
7. Workflow Guides
Reference directory: workflows/
| Guide | Intended User | File |
|---|
| Journalist Source Verification | Journalists verifying claims | wf-journalist.md |
| HR Screening | HR professionals running background checks | wf-hr-screening.md |
| Cyber Threat Intelligence | Security analysts tracking adversaries | wf-threat-analyst.md |
| Private Investigator | Licensed PIs running person cases | wf-private-investigator.md |
Activate via /flow [type] — interactive guided prompts walk through each step.
8. Output Formats
Reference: output/reports/, connectors/
Conversational domain table — show this in chat on every collection turn (CRITICAL)
Whenever a collection command (/cti, /case, /sweep, /webpivot, /subdomain, or the
pipeline) returns one or more domains, the reply's first element — before any prose — is a
markdown table summarizing each domain, so the operator sees the yield at a glance in the
conversation. The §8 file exports are the durable record; this table is the live view and is
never skipped, even for a single domain.
| Domain | Resolves | Top pivots | Risk | Cluster / peers | Seen before |
|---|
site-a.example | ✓ | favicon:123456789 · G-XXXXXXXXXX | NRD, BPH | 3 peers | CASE-0001 (Operator A) |
site-b.example | ✓ | registrant@example.com | — | 3 peers | new |
Columns: Resolves ✓/✗ (collector got a host); Top pivots the 1–3 highest-rung indicators
(§2.5 ladder) as kind:value; Risk the risk_signals flags (NRD / BPH / money-trail, or —);
Cluster / peers shared-indicator peer count from the KB; Seen before the prior case +
operator from /recall, or new. Keep to these columns — detail goes in the prose below. One row
per domain; for a large sweep show the top 20 by risk and note how many rows were omitted.
Mandatory File Export (CRITICAL)
Every /report, /brief, and /case command MUST auto-save the default export set to disk at the end of delivery:
| # | Format | File | Role |
|---|
| 1 | Markdown | CTI-REPORT-[CASE-ID]-[YYYY-MM-DD].md | Diffable, greppable source of truth; also the input to the HTML/DOCX generators |
| 2 | Interactive HTML | CTI-REPORT-[CASE-ID]-[YYYY-MM-DD].html | Primary human-facing deliverable — self-contained, OFFLINE; charts + 2D entity graph + topology + timeline + indicator panel + search |
| 3 | JSON | CTI-REPORT-[CASE-ID]-[YYYY-MM-DD].json | Structured case data (the report JSON below); feeds the generators and downstream tooling |
| 4 | CSV | CTI-REPORT-[CASE-ID]-[YYYY-MM-DD].csv | Findings (and indicators, via the IOC export) for spreadsheets / SIEM lookups |
| 5 | IOC / selector bundle | IOC-[CASE-ID]-[YYYY-MM-DD].{stix.json,txt,csv} | Comprehensive indicators & selectors — STIX 2.1 + flat + CSV |
Save location: Current working directory, or ./osint-reports/ subdirectory if it exists. | | | |
The default set is unredacted — it is the analyst's working record. A shareable variant is
opt-in, never automatic, so nothing is ever quietly weakened. Request it with
/redact or /case … --redact:
S="$SKILL_DIR/scripts"; R="CTI-REPORT-[CASE-ID]-[YYYY-MM-DD]"
for f in md json csv; do
uv run "$S/redact.py" "$R.$f" -o "$R.redacted.$f" --map "$R.map.json"
done
One --map across all three files keeps a selector's placeholder identical everywhere.
Infrastructure (URL/domain/IP) stays visible even then — in a CTI report the actor's
infrastructure is the analysis, not incidental PII; add --all-types to cover it too.
Never ship the .map.json — it reverses the redaction.
--yolo: save the five-format default set with no prompt.- Interactive mode: save the default set, then ask the user at the end whether they also want DOCX (Word) or PDF.
- DOCX is NOT in the default set (heaviest, most failure-prone toolchain). Generate it on request (
/report docx) or automatically for /report legal (evidentiary, where a fixed Word/PDF artifact is expected). HTML "Print → Save as PDF" covers most PDF needs for free.
- Explicit machine-format subcommands always emit that format directly:
/report json, /report csv, /report ioc.
The HTML, JSON, CSV and IOC outputs all derive from one report JSON. Build it once, then run the generators below.
Step 1 — Build the report JSON file. The generators expect a SPECIFIC flat format (NOT the engine case-schema.json). You MUST construct the JSON matching this exact structure before calling the scripts. Reference: scripts/sample-cti-report-data.json.
{
"case": {
"id": "CTI-2026-001",
"label": "Case Title",
"classification": "OPEN SOURCE",
"analyst": "AI-Assisted CTI",
"date": "2026-04-08",
"subject": "target.com",
"status": "active",
"exposure_score": 72
},
"executive_summary": "Full paragraph summarizing investigation findings...",
"subjects": [
{
"id"
CRITICAL FORMAT RULES:
confidence on subjects and findings MUST be an integer (e.g., 85), NOT a string (e.g., "VERIFIED")findings MUST be a flat top-level array, NOT nested inside subjectslabel is REQUIRED on each subject (this is what displays in the report — not value or display_name)weight on findings drives severity coloring — use CRITICAL/HIGH/MEDIUM/LOW/INFOrecommendations must be an array of strings (not objects with priority/action keys)- All fields shown above should be populated with actual data — empty strings or "N/A" defeat the purpose
- Populate
executive_summary with a full paragraph — this is the most-read section of the report
Optional enrichment fields (backward-compatible — used by the HTML report & IOC export when present):
subjects[].role — actor | victim | infrastructure | associate | witness (drives the role chips and actor↔victim attribution; otherwise inferred from type/links)subjects[].selectors[] — contact/social points attached to a person/org: {type, value, platform, url} (e.g. a victim's phone, an actor's Telegram or LinkedIn) — surfaced in the Indicators panel and IOC exportindicators[] — analyst-curated indicators to force into the export verbatim: {type, value, category, role, confidence, source_url}
Step 2 — Generate the interactive HTML report (PRIMARY human-facing deliverable). Self-contained, OFFLINE, zero toolchain to view — opens in any browser:
S="$SKILL_DIR/scripts"
uv run "$S/generate-cti-html.py" "REPORT.json" "REPORT.html"
It injects the report JSON into cti-report-template.html and renders, entirely client-side and offline (no CDN, no network calls): KPI cards, an exposure gauge, a finding-type pie, severity bars, a draggable/zoomable 2D entity graph, infrastructure topology, an event timeline, and the comprehensive Indicators & Selectors panel (network IOCs + contacts + identities + social/messaging handles + wallets + actor↔victim attribution) — with global search, category menus, dark/light themes and a print-to-PDF stylesheet.
Step 3 — Generate the comprehensive IOC / selector bundle.
uv run "$S/generate-cti-iocs.py" "REPORT.json" "IOC-[CASE-ID]-[YYYY-MM-DD]" --format all
Extracts EVERY indicator that profiles or can reach an actor/victim — network IOCs, emails/phones, usernames/names/aliases, social-media profiles, messaging handles, crypto wallets, and the attribution links between subjects. Full spec: techniques/ioc-export.md.
Step 4 — DOCX (on request, or automatically for /report legal). Word is no longer auto-generated by default. When the user asks for it (or for evidentiary reports), build it from the SAME report JSON + MD. The generators carry PEP 723 inline dependency metadata, so the simplest, most portable runner is uv run — it provisions the deps on the fly with zero venv/pip setup, identically on every OS. The generator is also self-healing: it forces UTF-8 output and auto-locates pandoc (including Windows %LOCALAPPDATA%\Pandoc), so no PYTHONUTF8 / PATH prelude is needed. Replace REPORT with CTI-REPORT-[CASE-ID]-[YYYY-MM-DD].
Preferred — uv run (any OS, any agent, zero setup):
S="$SKILL_DIR/scripts"
uv run "$S/generate-cti-docx-hybrid.py" "REPORT.md" "REPORT.json" "REPORT.docx"
uv run "$S/generate-cti-docx.py" "REPORT.json" "REPORT.docx"
uv run "$S/generate-cti-docx-hybrid.py" "REPORT.md" "REPORT.docx"
Windows PowerShell: set $S = "$env:USERPROFILE\.claude\skills\cti-expert\scripts" (Claude Code) or "<repo>\scripts" (Codex/clone), and use backslash paths.
Fallback — no uv installed. Use the OS interpreter; the script's ensure_deps() installs the libs on first run (via uv if present, else pip):
- macOS / Linux (Bash):
python3 "$S/generate-cti-docx-hybrid.py" "REPORT.md" "REPORT.json" "REPORT.docx"
- Windows (PowerShell):
py "$S\generate-cti-docx-hybrid.py" "REPORT.md" "REPORT.json" "REPORT.docx" — the Store python3 stub will not run; use py or the venv python
- Last resort (no styling/charts):
pandoc "REPORT.md" -o "REPORT.docx" --from markdown --to docx --standalone
How the hybrid generator works:
- Phase 1: pandoc converts the MD file to a base DOCX (preserving ALL narrative content — tables, lists, formatting)
- Phase 2: python-docx post-processes to add CTI professional styling, prepend cover page + TOC, and inject charts/diagrams from JSON at matching section headings
The MD file is the primary content source. It carries the full narrative (detailed person profiles, infrastructure tables, wallet addresses, corporate structure, legal history, etc.). The JSON file provides structured data for visual elements (charts, diagrams, risk gauge). Using both together produces a complete report with zero content loss.
Rich hybrid DOCX includes: Cover page titled "CTI REPORT", table of contents, all narrative content from MD (every paragraph, table, list, code block), pie chart (finding types), bar chart (severity), risk gauge (exposure score), timeline chart, entity relationship diagram, network topology diagram, traffic/geo charts, CTI-themed styling (navy headings, styled tables), header/footer with classification and page numbers.
After saving, confirm all files to the user:
📄 Report saved (default export set):
→ CTI-REPORT-CASE001-2026-03-30.md
→ CTI-REPORT-CASE001-2026-03-30.html (interactive — open in any browser, fully offline)
→ CTI-REPORT-CASE001-2026-03-30.json
→ CTI-REPORT-CASE001-2026-03-30.csv
→ IOC-CASE001-2026-03-30.stix.json / .txt / .csv (indicators & selectors)
Need a Word (.docx) or PDF too? (PDF = open the .html and Print → Save as PDF)
Report Formats
| Format | Command | Audience |
|---|
| Interactive HTML | /report (default) · /report html | Everyone — analysts to execs; the primary deliverable |
| Technical INTSUM | /report | Analysts, security teams |
| Executive Brief | /report brief | Decision-makers, management |
| Plain-Language Summary | /brief | Non-technical stakeholders |
| Legal Evidence Format | /report legal | Attorneys, compliance teams (auto-adds DOCX/PDF) |
| Journalist Format | /report journalist | Reporters, media |
| JSON Export | /report json | Downstream tools, pipelines |
| CSV Export | /report csv | Spreadsheets, databases |
| IOC / selector bundle | /report ioc | SIEM/TIP ingest, threat-intel sharing |
| Word document | /report docx | Formal sharing (on request) |
Every narrative report auto-saves the default export set (.md + .html + .json + .csv + IOC bundle — see Mandatory File Export above). /report legal additionally produces DOCX/PDF. Machine-only subcommands (json, csv, ioc) emit their native format directly.
Visual Outputs
| Type | Command | Format |
|---|
| Subject relationship map | /render entities | ASCII (default) — --mermaid for Mermaid |
| Chronological timeline | /render timeline | ASCII Gantt |
| Exposure heatmap | /render risk | ASCII |
| Network topology | /render network | ASCII |
All visual outputs use ASCII box-drawing by default. Mermaid only on explicit --mermaid flag.
Diagram tradecraft: output/visuals/diagram-patterns.md — compile-check a Mermaid diagram before presenting it, and pick the right diagram type per CTI question (attack → sequence, lifecycle → state, handoffs → swimlane, infra → graph).
The interactive HTML report (default deliverable) renders all of these as live, explorable visuals — a draggable/zoomable 2D force-directed entity graph, infrastructure topology, an event timeline, and SVG charts (pie/bar/gauge/donut) — alongside the ASCII versions in the .md.
Connectors
| Tool | File | What It Exports |
|---|
| Maltego | connectors/maltego-export.md | GraphML entity graph |
| Obsidian | connectors/obsidian-setup.md | Linked markdown notes |
| Notion | connectors/notion-schema.md | Structured database |
| Intel backend | connectors/intel-backend.md | Optional persistent KB + cross-case correlation via the intel_engine engine (MCP/CLI). Absent → stateless as normal. Enables /backend, /kb, /recall, /binary |
9. Skill Tiers & Customization
Reference: experience/skill-tiers.md, experience/layered-detail.md
Tiers
| Tier | Command | What Changes |
|---|
| Novice | /novice | Jargon removed, steps explained, glossary auto-linked |
| Practitioner | (default) | Standard output, moderate detail |
| Specialist | /novice off | Full technical detail, raw findings, internal signals |
Switch tiers at any point — output adapts immediately.
Guided Flows
experience/guided-flows/ contains step-by-step interactive flows:
person-investigation.md — Full guided person casedomain-reconnaissance.md — Guided domain sweepemail-investigation.md — Guided email tracingrapid-case.md — 10-minute abbreviated sweep
Activate: /flow person · /flow domain · /flow email · /flow quick
Case Templates
experience/case-templates/ contains pre-built starting configurations:
due-diligence.md — Corporate partner vettingsecurity-audit.md — Organization exposure auditbackground-check.md — Individual background research
Activate: /template run [name]
10. Ethics & Boundaries
This skill operates strictly within publicly available information.
Permitted
- Journalists verifying facts about public figures or institutions
- Security professionals auditing their own organization's exposure
- Individuals reviewing their own digital footprint
- Corporate due diligence on business partners
- Academic research and educational demonstrations
Prohibited
- Stalking, harassment, or doxing of any individual
- Accessing accounts or systems without authorization
- Social engineering or deception campaigns
- Any activity violating applicable law
Ethical reminders are issued automatically when the investigation approaches sensitive territory. Public data is not a license to cause harm.
11. Autonomous Mode (--yolo)
Append --yolo to any command or activate at session start.
What changes:
- No clarifying questions — analyst infers context and proceeds
- No confirmation prompts — scope expands automatically on new discoveries
- Guided flows skip Q&A — reasonable defaults applied
- Both
/report and /brief generated without asking
What stays the same:
- Ethics and legal boundaries — always enforced
- Trust scores on every finding
- Source citations on every claim
/validate and /coverage run before final delivery
Activate per-command: /case target.com --yolo
Activate for session: /cti-expert --yolo
12. Architecture Reference
cti-expert/
├── SKILL.md This file
├── README.md User-facing overview
│
├── engine/ Case data model and state management
│ ├── case-schema.json Subject and finding data structures
│ ├── subject-registry.md How subjects are tracked and versioned
│ ├── finding-framework.md Finding lifecycle, trust scores, evidence chains
│ ├── pivot-orchestration.md Recursive spider-map pivot engine (BFS loop, edge matrix, gating)
│ ├── workspace-format.md Workspace serialization spec
│ ├── workspace-manager.md Save/open/list workspace logic
│ └── conflict-resolver.md CONTESTED finding resolution
│
├── analysis/ Pattern detection and intelligence engines
│ ├── deviation-detector.md Behavioral anomaly detection
│ ├── auto-branch-rules.md Automatic pivot trigger rules
│ ├── drift-monitor.md Subject state change tracking
│ ├── cross-reference-engine.md Shared identifier detection across subjects
│ ├── archive-explorer.md Wayback Machine integration and diff
│ ├── signature-catalog.md Behavioral pattern library
│ ├── exposure-model.md Exposure score calculation framework
│ ├── risk-trend-tracker.md Temporal risk score tracking (/drift)
│ ├── pattern-library.md Username, email, bot detection patterns
│ └── weight-engine.md Finding aggregation and confidence weighting
│
├── techniques/ Collection techniques and module specs
│ ├── fx-metadata-parsing.md EXIF, headers, document metadata
│ ├── fx-image-verification.md Image authenticity and provenance
│ ├── fx-breach-discovery.md Breach database and paste site methods
│ ├── fx-geolocation.md GPS, W3W, Plus Codes, Street View
│ ├── fx-social-topology.md Social graph construction and topology
│ ├── fx-email-header-analysis.md Header analysis, SPF/DKIM
│ ├── fx-document-forensics.md Document forensics and extraction
│ ├── fx-http-fingerprint.md HTTP fingerprinting and signatures
│ ├── fx-leak-monitoring.md Leak and breach monitoring
│ ├── username-osint.md Platform enumeration (3000+)
│ ├── phone-osint.md Phone carrier/VoIP/spam lookup
│ ├── email-osint.md Deep email investigation
│ ├── threat-intel.md Threat intelligence free lookups
│ ├── web-traffic-analysis.md Traffic estimation methods
│ ├── secret-scanning.md Credential/secret detection
│ ├── github-osint.md GitHub profiles, repos, code, commits, forks
│ ├── domain-advanced.md Subdomain enumeration methods
│ ├── social-media-platforms.md Platform-specific techniques
│ ├── advanced-geolocation-techniques.md Overpass Turbo, road signs, reflected text
│ ├── wifi-ssid-osint.md WiFi SSID/BSSID geolocation via Wigle.net
│ ├── web-dns-forensics.md DNS, GitHub, Telegram, WHOIS
│ ├── fx-visitor-intelligence.md Visitor stats, tech stack, geo analysis
│ ├── scam-check.md Phishing/scam domain verification
│ ├── cloud-audit.md Cloud infrastructure security audit
│ ├── microsoft-tenant-recon.md M365/Azure tenant enumeration
│ ├── china-recon.md ICP filings, PRC registries, CN cyberspace engines, CJK variants
│ ├── fiat-payment-osint.md IBAN/BIC/bank accounts as selectors, VN-SEA rails
│ ├── fx-edge-appliance-recon.md Edge/VPN appliance fingerprint → KEV/CVE catalog + port-risk matrix
│ ├── fx-saas-identity-recon.md SaaS tenancy + IdP fingerprint + API/GraphQL/spec discovery
│ ├── dependency-audit.md Supply chain security audit
│ ├── disk-forensics.md Digital evidence analysis
│ ├── incident-triage.md Security incident response
│ ├── owasp-audit.md OWASP Top 10 source code audit
│ ├── prompt-injection-audit.md AI/LLM security audit
│ ├── stealer-log-analysis.md Infostealer-log triage, actor attribution & IOC extraction
│ ├── agent-browser.md Interactive browser collection & evidence capture (vercel-labs/agent-browser)
│ └── ioc-export.md IOC export (STIX 2.1, flat list)
│
├── experience/ UX, tiers, and guided flows
│ ├── skill-tiers.md Novice/Practitioner/Specialist spec
│ ├── layered-detail.md Progressive disclosure rules
│ ├── guidance-system.md How guided flows work
│ ├── case-progress.md Progress tracking logic
│ ├── guided-flows/ Interactive step-by-step flows
│ │ ├── flow-person-lookup.md Person investigation guided flow
│ │ ├── flow-domain-sweep.md Domain reconnaissance guided flow
│ │ └── flow-image-check.md Image verification guided flow
│ ├── case-templates/ Pre-built case configurations
│ │ ├── tpl-index.md Template index and descriptions
│ │ ├── tpl-due-diligence.md Due diligence case template
│ │ ├── tpl-security-review.md Security audit case template
│ │ └── tpl-background-check.md Background check case template
│ ├── tutorial.md First-time onboarding guide (/onboard)
│ ├── feedback-system.md Investigation quality feedback loops
│ └── accessibility/ Glossary and accessibility settings
│ ├── glossary.md OSINT term glossary
│ └── accessible-mode.md Low-jargon mode settings
│
├── output/ Report and visualization specs
│ ├── reports/ Report format templates
│ │ ├── format-catalog.md Report format specifications
│ │ ├── leadership-brief-template.md Executive brief template
│ │ ├── export-specs.md Export format specifications
│ │ └── citation-guide.md Source citation standards
│ └── visuals/ Chart and visualization specs
│ ├── chart-templates.md Chart rendering templates
│ ├── ui-components.md UI component library
│ ├── render-engine.md ASCII render engine spec
│ ├── case-dashboard.md Dashboard layout spec
│ ├── attack-path-diagram.md Attack path flow visualization (/render threat-path)
│ └── attack-surface-map.md Attack surface exposure map (/render attack-surface)
│
├── scripts/ Cross-platform install + HTML / IOC / DOCX report generation
│ ├── platform-setup.md Cross-platform reference: OS detection, uv-first install matrix, gotchas
│ ├── install.ps1 Windows installer (uv-first: uv venv/pip/tool; winget + pip/pipx fallback)
│ ├── install.sh macOS/Linux/Git-Bash/WSL installer (uv-first; brew/apt + pip/pipx fallback)
│ ├── stealer_log_parse.py Infostealer-log analyzer — attribution, profiling, IOCs (PEP 723 / `uv run`, zero-dep)
│ ├── iban_analyze.py IBAN validate + decompose (ISO 13616/7064) → bank code, risk signals (PEP 723, zero-dep)
│ ├── redact.py Reversible PII redaction — stable placeholders + exportable map; md/json/csv (PEP 723, zero-dep)
│ ├── cti-report-template.html PRIMARY: interactive HTML report template — self-contained & OFFLINE (charts + 2D entity graph + topology + timeline + indicator panel + search; dark/light + print-to-PDF)
│ ├── generate-cti-html.py HTML report generator — injects the report JSON into the template (PEP 723 / `uv run`, zero-dep, self-heals UTF-8)
│ ├── generate-cti-iocs.py Comprehensive IOC/selector exporter → STIX 2.1 / flat / CSV (network IOCs + contacts + identities + social/messaging + wallets + attribution; PEP 723 / `uv run`, zero-dep)
│ ├── generate-cti-docx-hybrid.py Hybrid MD+JSON DOCX generator — on request / `/report legal` (PEP 723 / `uv run`; self-heals UTF-8 + pandoc)
│ ├── generate-cti-docx.py Fallback: JSON-only generator (PEP 723 / `uv run`)
│ ├── cti_docx_postprocess.py Post-processing: styling, chart injection, cover page
│ ├── cti_docx_charts.py Chart rendering (pie, bar, gauge, timeline, traffic, geo)
│ ├── cti_docx_diagrams.py Entity relationship + network topology diagrams
│ ├── cti_docx_sections.py Report section formatting (used by JSON-only generator)
│ ├── cti_docx_styles.py Document styling, colors, cover page, header/footer
│ ├── requirements.txt Python dependencies
│ └── sample-cti-report-data.json Example JSON report data
│
├── workflows/ Professional workflow guides
│ ├── wf-journalist.md
│ ├── wf-hr-screening.md
│ ├── wf-threat-analyst.md
│ └── wf-private-investigator.md
│
├── handbook/ Reference material
│ ├── operator-queries.md Search operator catalog
│ ├── quick-report.md Rapid reporting reference
│ ├── discovery-paths.md Per-target-type search paths
│ ├── report-template.md INTSUM format specification
│ ├── admin-endpoint-indicators.md Admin-panel / sensitive-endpoint detection vocab & rules
│ ├── analytic-standards.md Likelihood bands, 5W1H coverage overlay, ACH (competing hypotheses)
│ ├── pivot-artifacts.md Pivot-artifact catalog (favicon, trackers, wallets, certs…)
│ ├── pivot-services.md Reverse-lookup engines per artifact — hash algo, cost, API/key notes
│ ├── api-keys.md Premium/pro API key management and unlocks
│ └── tool-cascade-reference.md Tool priority and fallback chains
│
├── guides/ Worked case walkthroughs
│ └── walkthroughs/ Step-by-step investigation examples
│ ├── walkthrough-person-lookup.md
│ ├── walkthrough-domain-sweep.md
│ └── walkthrough-username-trace.md
│
├── validation/ Quality assurance
│ ├── coverage-matrix.md Investigation area coverage tracking
│ ├── quality-scoring.md Scoring methodology
│ └── verification-checklist.md Finding verification steps
│
└── connectors/ External tool integrations
├── maltego-export.md
├── obsidian-setup.md
└── notion-schema.md
Technique Activation Matrix
Which techniques activate per target type in a /case run:
| Technique | Person | Domain | Org | Username | Email | IP |
|---|
/sweep | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
/query | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
/username | ✅ | — | ✅* | ✅ | — | — |
/email-deep | ✅ | — | ✅* | — | ✅ | — |
/phone | ✅ | — | ✅* | — | — | — |
/breach-deep (LeakCheck + HudsonRock) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
/subdomain | — | ✅ | ✅ | — | — | — |
/traffic | — | ✅ | ✅ | — | — | — |
/threat-check | — | ✅ | ✅ | — | — | ✅ |
/secrets | — | ✅ | ✅ | ✅ | — | — |
/github-osint | ✅* | ✅ | ✅ | ✅ | ✅* | — |
/scam-check | — | ✅ | ✅ | — | — | — |
/branch | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
/gdoc | — | ✅ | ✅ | — | — | — |
/sharelink | ✅ | — | ✅ |
| /dork-sweep | ✅ | ✅ | ✅ | ✅ | ✅ | ✅* |
| /docleak | ✅ | ✅ | ✅ | ✅* | — | — |
| Social media platforms | ✅ | — | ✅ | ✅ | — | — |
| Metadata forensics | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Photo verification | ✅ | — | ✅* | ✅ | — | — |
