7onez/cti-expert

What it solves

CTI Expert transforms Claude into a professional cyber threat intelligence (CTI) and open-source intelligence (OSINT) analyst. It solves the problem of fragmented intelligence collection by providing a structured toolkit that automates the gathering, enrichment, and analysis of data across multiple vectors (people, domains, IPs, emails, etc.) to identify threat actors and assess risks.

How it works

It operates as a Claude Code skill using a two-layer system:

1. Broad Collector: Uses over 74 commands and 49 techniques to perform multi-vector reconnaissance. It is keyless by default, meaning core functionality works without API keys, but supports optional API keys (e.g., VirusTotal, Shodan) for higher-tier pivots.
2. Deep Pipeline: A built-in intelligence engine (intel_engine/) that converts raw data into structured cases. This includes a persistent knowledge base, versioned cases, cross-case correlation, and calibrated assessment.

The workflow follows the AEAD model: Acquire raw data $\rightarrow$ Enrich with pivot expansion $\rightarrow$ Assess findings $\rightarrow$ Deliver structured reports.

Who it’s for

Cybersecurity analysts, threat hunters, and OSINT investigators who need a standardized, automated way to conduct intelligence collection and attribution without manually jumping between dozens of different tools.

Highlights

• Extensive Command Set: 74+ commands and 49 techniques for comprehensive reconnaissance.
• Keyless Core: Core functionality requires no API keys, though optional keys unlock advanced capabilities.
• Structured Output: Generates interactive HTML, Markdown, JSON/CSV, and IOC bundles.
• Safety Rails: Includes built-in guards (e.g., leakguard.py, actionguard.py) to prevent accidental data leaks or unauthorized outbound actions.
• Deep Analysis: Features a case loop that runs to convergence, clustering indicators to separate signal from noise.