Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Dark web intelligence collection methodology — vendor-first access posture, sourced reference lists for 35+ underground forums and 30+ Telegram channels, OPSEC primer, passive-monitoring strategy, and bundled Python CLIs for onion-indexer search, Telegram channel monitoring, and local keyword matching. Use when the user wants to design or run dark-web collection, build a selector list, pick a vendor, or set up monitoring infrastructure.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when challenging a prevailing analytical judgment, the user asks "what is the opposing case?" / "argue the other side" / "play devil's advocate", or wants an assessment stress-tested before release. Takes the team's own lead judgment and builds the strongest case that it is wrong. A contrarian technique. It does not model what an adversary would do next, which is Red Team Analysis. Formerly /red-team-analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Feedback loop implementation for continuous CTI improvement. Consumer feedback, analyst retrospectives, source quality tracking.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
GreyNoise API reference. Internet scanner/noise classification for IPs.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.