automation

Cti Expert

Name: Cti Expert
Author: 7onez

CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code. 67+ commands, 35 techniques, no API keys required.

494 stars70 forksPythonUpdated 8/23/2026100% free · open source

What it does

Provides 67+ ready‑to‑use CTI and OSINT commands that let Claude Code fetch, parse, and summarize cyber‑threat data without any external API keys.

When to use it

•You need quick intel on a new ransomware campaign for a board‑level security brief.
•Your product team must validate whether a newly reported indicator (IP, hash, domain) belongs to a known threat actor.
•You want to automate daily OSINT digests (e.g., latest CVEs, phishing kits) for your security newsletter.

Ready-to-paste prompt

In Claude Code, type:
```
threat-actor-profile "Lazarus Group" --include iocs, recent‑campaigns, mitigations
```

Heads up: The skill only works inside the Claude Code environment; trying to run the Python modules directly will raise a `RuntimeError: Claude Code runtime not detected`.

Saves to your device

Use with Claude

New

Skip the builder — one click puts this in Claude, Cursor, Antigravity and more.

⚡ Runs out of the box

A prompt/skill package — nothing to install beyond adding it to your AI tool.

Try it instantly — no install

Claude Code

mkdir -p ~/.claude/skills/cti-expert && curl -fsSL https://workflowstacks.com/api/skills/cti-expert/claude-skill -o ~/.claude/skills/cti-expert/SKILL.md

Open in another AI app

Opens the app with this repo with the prompt ready to go — no copy-paste needed.

Connect the whole catalog (MCP)

claude mcp add --transport http workflowstacks https://workflowstacks.com/api/mcp

Adds a WorkflowStacks connector to Claude Code: search and load any skill here by chatting.

How Cti Expert works

Codeflow

Free to inspect

Cti Expert is a very large Python project (~108k lines across 228 code files, plus 66 test files). You install it into your AI tool with one command; there is nothing to run yourself. Last commit this month, Other license, has a test suite.

Size

Very large codebase

~108k lines · 228 code files · days to read — use, don't read

Setup

Install as a skill / plugin

Add it to Claude Code (or your AI tool) with one command — 1 skill inside. Nothing to run yourself.

Runs on

Inside your AI tool

Helper scripts use Python · needs API keys

Python 94%HTML 2%Shell 2%PowerShell 1%JavaScript 1%

Where to start reading

1
README.md
Start here — what it does and how to install it
2
AGENTS.md
The instructions the AI actually follows
3
.env.example
The API keys and settings you must provide

What's in each folder

commands/Prompts, skills & agent definitions9 files

connectors/Sub-packages / plugins5 files

workflows/Workflows / pipelines4 files

guides/Documentation3 files

docs/Documentation1 files

intel_engine/Folder285 files

scripts/Helper scripts92 files

techniques/Folder57 files

READMEHas testsDocumentedCI checksOther licenseUpdated this month

Use with Claude

New

Skip the builder — one click puts this in Claude, Cursor, Antigravity and more.

⚡ Runs out of the box

A prompt/skill package — nothing to install beyond adding it to your AI tool.

Try it instantly — no install

Claude Code

mkdir -p ~/.claude/skills/cti-expert && curl -fsSL https://workflowstacks.com/api/skills/cti-expert/claude-skill -o ~/.claude/skills/cti-expert/SKILL.md

Open in another AI app

Opens the app with this repo with the prompt ready to go — no copy-paste needed.

Connect the whole catalog (MCP)

claude mcp add --transport http workflowstacks https://workflowstacks.com/api/mcp

Adds a WorkflowStacks connector to Claude Code: search and load any skill here by chatting.

Quick Actions

Details

Creator

7onez

Language

Python