cti-expert is a Claude Code skill that turns an LLM agent into a structured cyber threat intelligence analyst, running 120+ collection commands across 57 techniques for authorized investigations and defensive research.
| Tool | 7onez/cti-expert — a Claude Code skill that turns Claude into a trained CTI/OSINT analyst with 120+ commands and 57 techniques |
| Category | AI-augmented OSINT and threat intelligence collection/analysis toolkit (Python) |
| Primary Use | Authorized multi-vector investigations across domains, usernames, emails, IPs and organizations, using commands like /sweep, /webpivot, /email-deep and /cti-pivot |
| Safe Use | Intended for authorized security assessments, CSIRT/incident-response casework, anti-fraud and anti-phishing research, and lab-based defensive training |
| Telemetry Note | Default posture is passive-first; sandbox submissions are private-by-default and gated behind five checks (--free-only, no_spend, loop mode, hostile-posture blocks, HARNESS_ALLOW_SUBMIT=1), and public detonations are refused unless explicitly overridden |
cti-expert sits at an interesting intersection of two trends: the rise of agent harnesses like Claude Code and the professionalization of open-source intelligence workflows. Rather than being a scanner or an exploitation framework, it is a skill package — written in Python, currently at version 2.12 with 613 stars — that installs into your Claude Code environment and gives the model a structured tradecraft layer: 120+ commands and 57 documented techniques covering collection, enrichment, assessment and reporting. The README is unusually explicit about its operating philosophy, describing an AEAD workflow: Acquire raw data, Enrich with pivot expansion, Assess findings, and Deliver structured reports in Markdown, JSON, CSV and IOC bundle formats, with optional PDF, DOCX or HTML presentation output.
The keyless-first design is the first thing an operator should notice. Every core technique runs with zero API keys, and the skill degrades gracefully: a missing or bad key in the .env file never breaks a run, it just produces a note. Add keys via /apikeys set <service> <KEY> and the skill auto-detects them, unlocking higher-tier pivots such as reverse favicon-to-host lookups, passive DNS, certificate search and sibling-domain discovery. This matters for authorized-team adoption because it means you can evaluate the tradecraft in a lab before committing to any commercial data subscriptions, and the README points to a dedicated setup guide at handbook/api-keys.md.
Architecturally, the project describes itself as two layers. The outer layer is the broad collector — commands like /sweep, /webpivot, /subdomain, /username and /email-deep cast a wide net across target selectors of any type: person, domain, organization, username, email, IP or WiFi. The inner layer, intel_engine/, turns that raw collection into a persistent case: versioned case directories, a knowledge base, cross-case correlation and calibrated assessment. The flow the README sketches reads like an analyst's sentence — collect broadly, ask "seen this operator before?", cluster, filter false positives, then assess. As of v2.9, the bundled installer (scripts/install.{sh,ps1}) provisions the deep layer automatically, or you can do it manually with uv venv && uv pip install -r requirements.txt.
The sponsor table reads like a who's-who of the intelligence-data ecosystem, and each integration is mapped to specific commands. ANY.RUN feeds /binary and /hash-id with sandbox-observed C2 data; ZETAlytics and Validin power passive DNS and co-tenancy pivots in /webpivot and /cti-pivot; IntelX supports /email-deep; Shodan and Censys contribute host, banner and certificate intelligence with a passive-first bias via InternetDB; URLScan.io provides no-contact page captures; GrayHatWarfare enables open cloud-bucket and leaked-secret searches through /grayhatwarfare, /secrets and /docleak. The README is careful to note that listing these organizations does not imply endorsement, and that every integration is optional and key-gated.
The ANY.RUN integration deserves specific attention because it is the one place where the tool touches live infrastructure rather than purely passive sources. The README is emphatic: lookups are read-only, and binary submissions are automatic only when an ANYRUN_API_KEY is set in a spending run. Detonation is gated five ways — --free-only, per-case no_spend, the default loop posture, hostile/no-direct-contact mode, and an explicit HARNESS_ALLOW_SUBMIT=1 for direct submissions. A public-only account is refused unless ANYRUN_ALLOW_PUBLIC=1 is set, precisely because public sandbox tasks are world-readable and irreversible. This is a well-reasoned safety model, and reviewers evaluating the tool for authorized use should read SKILL.md for the full contract.
Version 2.12 is described as the release where paid keys start pulling their weight. Metered vendor calls are now bought once per case rather than once per host — a meaningful cost control for teams running broad sweeps. A cross-type auto-pivot loop treats every selector type as a frontier node, with typed nodes feeding case_state.propose and a mandatory read-only Plan phase (PLAN_TOOLS) before any pivot executes, capped at N=25 hits per free/urlscan expansion. Netlas was added as an independent internet-asset index, and the editorial PDF/DOCX output became a deterministic composition from the case directory rather than a free-form generation — a change that makes reports reproducible and auditable.
The phishing-analysis side is where the academic grounding shows. The README credits the APWG eCrime research symposium's 2026 papers as the basis for eight of the toolkit's techniques, including ClickFix detection, domain-survival analysis, phishing-kit fingerprinting, visibility-aware HTML analysis, and a PhishTrace capability. Hudson Rock contributes infostealer-infection context through /breach-deep and /stealer-log, and ParanoidLab supplies dark-web and initial-access-broker monitoring. For defenders, this is the most valuable quadrant of the tool: understanding which credentials leaked from which machines, and which phishing kits are circulating, is directly actionable protective intelligence.
From a defensive-operations standpoint, the telemetry posture is worth stating plainly. The tool's default stance is passive collection — URLScan.io captures what a page served without touching the target, Shodan is queried passive-first through InternetDB, and the hostile/no-direct-contact posture blocks active submissions. Where activity does occur (sandbox detonation), it is confined to the analyst's own spending budget and marked private by default. This makes cti-expert far easier to justify inside an authorized investigation than tools that probe targets directly, and the per-case metering model produces a natural audit trail of what was bought and queried.
Installation is the standard Claude Code skill flow: clone the repository and let the bundled scripts/install.sh (or .ps1 on Windows) provision both layers, including the intel_engine/ backend that resolves to SELF with no external setup. The project ships a SKILL.md that defines the agent contract, a handbook/ directory with the API-key guide, and connectors/intel-backend.md documenting the deep-layer architecture. The license badge claims MIT, though GitHub metadata reports NOASSERTION, so commercial users should verify the LICENSE file directly before redistribution.
Caveats for professional adoption are the usual ones for AI-augmented tradecraft, amplified. An LLM agent running 120 collection commands against real-world selectors can generate volume without judgment, and the tool's own clustering, false-positive filtering and calibration layers exist precisely to counteract that — but the analyst remains accountable for the final assessment. The cross-case correlation in intel_engine/ means case data persists locally, so teams handling sensitive investigations should treat the case directories as protected evidence and apply their own retention policy. And because the skill auto-detects any key placed in .env, key hygiene and least-privilege API accounts matter.
Within its niche, cti-expert is one of the more mature expressions of the "agent as analyst" idea. The two-layer separation between broad collection and case-based deep analysis, the deterministic reporting, the five-way gating on detonation, and the keyless core all suggest a project designed by people who have run real casework rather than assembled a command grab-bag. For CSIRT teams, anti-fraud units, and authorized penetration testers building target intelligence packages, it is worth a lab evaluation — start keyless, watch how the AEAD workflow shapes the output, and only then decide which data providers earn a place in your .env.
7onez/cti-expert.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.