What is CTI Expert?

A Claude Code skill that transforms Claude into a trained cyber threat intelligence and open-source intelligence analyst. It runs structured intelligence collection using 67+ commands across 36 techniques — no API keys required for core functionality. Some techniques offer optional enhanced access via free API keys (e.g., Wigle, VirusTotal, URLScan.io).

Demo

Full Case Investigation

CTI Report Generation

Screenshots

INTSUM Report	Network Topology	Risk Assessment

What's New in v2.4

What's New in v2.3

What's New in v2.2

Installation

Recommended: Use Claude Code CLI — it gives you the full terminal workflow, persistent sessions, and direct skill invocation. Download here or run npm install -g @anthropic-ai/claude-code.

Why Claude Code CLI?

The entire CTI Expert workflow is optimized for Claude Code CLI. The CLI gives you:

• Persistent sessions — investigations survive terminal restarts via /cti-expert /workspace save
• Full tool access — file writes, Python scripts, DOCX generation, all run natively
• Skill invocation — type /cti-expert directly in the terminal, no browser required
• Background agents — parallel enrichment via AgentFlow works best with the CLI

🖥️ Where to run it — the CLI is best for this skill

[!IMPORTANT]
CTI Expert is execution-heavy: it runs uv/Python, installs OSINT tools, writes .md/.docx/.json reports, reaches many external sites, and saves case workspaces. What matters is a real local shell + persistent files + open network — a CLI or local desktop agent gives you that; an ephemeral cloud sandbox does not. This applies equally to Claude and Codex.

[!TIP]
Run investigations in a CLI (Claude Code or Codex); open the generated .docx/report in a Desktop/IDE window if you prefer reading there. Use web/cloud surfaces only for analyst-reasoning, not execution-heavy recon.

Step 1 — Install Claude Code CLI

npm install -g @anthropic-ai/claude-code

Requires Node.js 18+. Full docs: docs.anthropic.com/en/docs/claude-code/overview

Step 2 — Clone + All-in-One Installer

The installer handles everything: Python dependencies, system tools (whois, dig, jq, exiftool), OSINT tools (maigret, sherlock, holehe, h8mail, and more), and optional headless browser + Go tools. It is powered by uv (Astral's ultra-fast Rust package manager) — the script bootstraps uv, then uses uv venv / uv pip / uv tool for all Python installs, falling back to pip/pipx/venv only if uv can't be installed. Use install.ps1 on Windows (PowerShell) or install.sh on macOS/Linux/Git Bash/WSL.

git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
bash ~/.claude/skills/cti-expert/scripts/install.sh

git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
bash ~/.claude/skills/cti-expert/scripts/install.sh

git clone https://github.com/7onez/cti-expert.git "$env:USERPROFILE\.claude\skills\cti-expert"
powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.claude\skills\cti-expert\scripts\install.ps1"

Windows users: install.ps1 is a full native installer (winget system tools + Python venv + OSINT tools) — no Git Bash or WSL required. It accepts the same -Headless, -Go, and -All flags (e.g. install.ps1 -All). Git Bash / WSL users can run install.sh instead. The DOCX generator self-heals UTF-8 output and auto-locates pandoc, so reports build on Windows with no extra environment setup. The skill itself detects the OS at runtime and installs any missing tool with the right manager (winget / brew / apt) — see scripts/platform-setup.md.

Installer Options

macOS / Linux / Git Bash / WSL:

bash scripts/install.sh               # Core: Python deps + system tools + OSINT tools
bash scripts/install.sh --headless    # + Scrapling headless browser (~200MB Chromium)
bash scripts/install.sh --go          # + Go tools (subfinder, amass, gau, gitleaks, httpx)
bash scripts/install.sh --all         # + Everything above

Windows (PowerShell):

powershell -ExecutionPolicy Bypass -File scripts\install.ps1              # Core
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Headless    # + Scrapling headless browser
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -Go          # + Go tools
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 -All         # + Everything above

Verify Installation

claude   # opens Claude Code CLI
# then type:
/cti-expert

If the skill loads, you'll see the CTI Expert command menu. Type /cti-expert /help for the full command list.

Use in ChatGPT / Codex (cross-agent)

CTI Expert is portable: the analyst logic is plain Markdown and the scripts are OS-detecting Python/shell, so it runs in OpenAI Codex (and other AGENTS.md-aware agents), not just Claude Code.

# 1. Clone the skill anywhere
git clone https://github.com/7onez/cti-expert.git

# 2a. In-repo: open Codex inside the clone — it auto-loads AGENTS.md. Then ask it to follow SKILL.md.
# 2b. Slash command: copy the bundled Codex prompt so /cti-expert works in the Codex CLI/IDE
cp cti-expert/codex/cti-expert.md ~/.codex/prompts/cti-expert.md   # Windows: copy to %USERPROFILE%\.codex\prompts\

• AGENTS.md is the cross-agent runtime contract (OS detection, uv, paths). Codex auto-concatenates it from the repo root; you can also reference it from ~/.codex/AGENTS.md.
• codex/cti-expert.md is a ready-to-copy custom prompt → gives Codex a /cti-expert <target> slash command.
• Plain ChatGPT (no code execution): the reasoning, query generation, and report drafting all work (load SKILL.md/AGENTS.md as instructions or Custom-GPT knowledge); only local steps (DOCX build, CLI tool runs) need a code-capable harness like Codex or Claude Code.

Paths are resolved relative to the skill directory (the folder containing SKILL.md), so nothing assumes the Claude-specific ~/.claude/skills/ location.

Alternative — Claude Code Desktop (macOS / Windows)

Download: claude.ai/download — available for macOS and Windows

Step-by-step (no terminal needed):

1. Install Claude Code Desktop — Download from claude.ai/download and install the app

2. Download CTI Expert — Go to the GitHub repository, click the green "Code" button, then select "Download ZIP"

3. Extract to your skills folder — Unzip the downloaded file, then move the extracted folder to your skills directory and rename it to cti-expert:

   Platform	How to navigate
   macOS	Open Finder → Press Cmd + Shift + G → Type ~/.claude/skills/ → Press Go → Move the folder here
   Windows	Open File Explorer → Type %USERPROFILE%\.claude\skills\ in the address bar → Press Enter → Move the folder here

   Note: If the skills folder does not exist, create it inside the .claude folder first.

4. Run the installer — Open Claude Code Desktop terminal and run:

   bash ~/.claude/skills/cti-expert/scripts/install.sh
   

   Or on Windows PowerShell (Python only):

   pip3 install -r "$env:USERPROFILE\.claude\skills\cti-expert\scripts\requirements.txt"
   

5. Restart Claude Code Desktop — Close and reopen the app

6. Verify — Type /cti-expert in the chat to confirm the skill is loaded

Quick Start

How to run commands: All commands below use the /cti-expert prefix. Type /cti-expert followed by the command in Claude Code.

Example: /cti-expert /case example.com — not just /case example.com

1 — Full Autonomous Case

/cti-expert /case example.com

Runs every applicable technique for the target type. Auto-generates .md and .docx reports.

2 — Guided Flows

/cti-expert /flow person           # Person investigation workflow
/cti-expert /flow domain           # Domain reconnaissance workflow
/cti-expert /flow image            # Image verification workflow

3 — Targeted Reconnaissance

/cti-expert /sweep @username                    # Multi-vector recon on handle
/cti-expert /query example.com                  # 12-15 advanced search queries
/cti-expert /username johndoe                   # Platform enumeration (3000+)
/cti-expert /email-deep [email protected]         # Deep email investigation
/cti-expert /subdomain example.com              # Certificate transparency + brute-force
/cti-expert /github-osint github.com/org/repo   # GitHub profiles, repos, code, commits, forks
/cti-expert /threat-check 185.1.1.1             # IP/domain/URL threat intelligence
/cti-expert /scam-check suspicious-site.xyz     # Phishing/scam domain check
/cti-expert /breach-deep [email protected]        # Multi-source breach lookup

4 — Analysis & Assessment

/cti-expert /exposure domain.com                # Composite risk score (0-100)
/cti-expert /threat-model                       # Build threat model from findings
/cti-expert /validate                           # Verify all findings
/cti-expert /coverage                           # Check investigation completeness

5 — Reporting

/cti-expert /report                             # Technical INTSUM report
/cti-expert /report brief                       # Executive summary
/cti-expert /brief                              # Plain-language summary
/cti-expert /workspace save                     # Save workspace + auto-generate .docx

Features

AEAD Case Lifecycle

Every investigation follows four automated phases:

                         ╭──────────────────────────────────────╮
                         │         AEAD CASE LIFECYCLE          │
                         ╰──────────────────────────────────────╯

   ┌─── ACQUIRE ────────────────────────────────────────────────────────┐
   │  Collect raw data via /sweep, /query, /username, /phone, etc.     │
   │  Database search, enumeration, collection gap logging             │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ENRICH ─────────────────────────────────────────────────────────┐
   │  Expand leads via /branch, /crossref, /link-subjects, /signatures │
   │  Shared identifier detection, relationship mapping                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── ASSESS ─────────────────────────────────────────────────────────┐
   │  Score & verify via /exposure, /threat-model, /validate, /coverage│
   │  Risk scoring, completeness check, evidence chains                │
   └────────────────────────────────┬───────────────────────────────────┘
                                    ▼
   ┌─── DELIVER ────────────────────────────────────────────────────────┐
   │  Package output via /report, /brief, /render, /workspace save     │
   │  Auto-save .md + .docx with charts & diagrams                     │
   └────────────────────────────────────────────────────────────────────┘

Run /progress at any point to see current phase and pending tasks.

Command Reference

Full command list: See SKILL.md for comprehensive reference.

Skill Tiers

Technique Catalog

Report Formats

Every /report, /brief, and /case auto-saves two files:

_{Generated by scripts/generate-cti-docx.py}

Architecture

cti-expert/
├── SKILL.md                       Command reference & skill definition
├── README.md                      This file
│
├── engine/                        Case data model & state management
│   ├── subject-registry.md        How subjects are tracked
│   ├── finding-framework.md       Finding lifecycle & evidence chains
│   ├── workspace-format.md        Workspace serialization spec
│   └── conflict-resolver.md       CONTESTED finding resolution
│
├── techniques/                    Collection techniques (32 files)
│   ├── whois-universal.md         Universal multi-TLD WHOIS cascade
│   ├── web-collection-scrapling.md Scrapling adaptive web collection
│   ├── agentflow-enrichment.md    Parallel enrichment orchestration
│   ├── fx-metadata-parsing.md, fx-image-verification.md, ...
│   ├── username-osint.md, phone-osint.md, email-osint.md
│   ├── cloud-audit.md, dependency-audit.md, disk-forensics.md
│   └── ...
│
├── experience/                    UX, tiers, guided flows
│   ├── guided-flows/              Interactive workflows
│   ├── case-templates/            Pre-built case templates
│   └── accessibility/             Glossary, low-jargon mode
│
├── analysis/                      Pattern detection & intelligence engines
│   ├── deviation-detector.md      Behavioral anomaly detection
│   ├── cross-reference-engine.md  Shared identifier detection
│   └── exposure-model.md          Risk score calculation
│
├── output/                        Report & visualization specs
│   ├── reports/                   Report templates
│   └── visuals/                   Chart & render engine specs
│
├── scripts/                       DOCX report generation
│   ├── generate-cti-docx.py       Main generator
│   ├── cti_docx_charts.py         Chart rendering
│   ├── cti_docx_diagrams.py       Entity relationship diagrams
│   └── requirements.txt           Python dependencies
│
├── workflows/                     Professional use-case guides
│   ├── wf-journalist.md           Journalist source verification
│   ├── wf-threat-analyst.md       Cyber threat intelligence
│   └── wf-hr-screening.md        Background checks
│
├── guides/walkthroughs/           Worked case examples
│   ├── walkthrough-person-lookup.md
│   ├── walkthrough-domain-sweep.md
│   └── walkthrough-username-trace.md
│
└── validation/                    Quality assurance
    ├── coverage-matrix.md         Investigation area coverage
    ├── quality-scoring.md         Finding scoring methodology
    └── verification-checklist.md  Evidence chain validation

Professional Workflows

Activate with /cti-expert /flow [type] for interactive guided prompts.

Ethics & Responsible Use

This skill is for lawful research and professional security investigation only.

You are responsible for all use of this skill. Comply with local laws, regulations, and platform terms of service. Always respect privacy and consent boundaries.

Contributing

We welcome research contributions, new techniques, and workflow improvements.

Adding techniques:

1. Create techniques/fx-[name].md with method description, free tool lists, limitations

Workflow improvements:

1. Document in workflows/ with success criteria

Pull request process:

1. Fork and create feature branch: git checkout -b feature/technique-name
2. Document changes in SKILL.md and README.md
3. Test on at least 3 real-world targets
4. Submit PR with description

Bug reports: File issues with command output, environment, and target type.

License

MIT License + Ethical Use Addendum

You are free to use, modify, and distribute this skill under the MIT license, provided that you include original attribution, comply with the ethical use guidelines above, and clearly mark any derivatives.

See LICENSE for full text.

🙏 Acknowledgments & Credits

CTI Expert stands on the shoulders of the open-source community and free, public-interest data providers. A huge thank-you to every project, vendor, and free API below — this skill simply would not exist without your work. (Listing here does not imply affiliation or endorsement; always respect each provider's terms of service.)

Built something here we should credit, or want your project's listing changed/removed? Open an issue or PR — we'll fix it fast. 💙