78건(Liberty91LTD의 저장소) · 인기순
Use when the user asks to write a threat / risk / vulnerability assessment, or wants the appropriate template for each type. Distinct structures and section ordering per assessment kind. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Confidence is capped by the weakest load-bearing claim, and at Moderate when the evidence is ungraded.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Peer review checklist and quality standards for intelligence products, plus schema validation for graded evidence items and claim tables from /quality-of-information-check and /claim-extraction. Rejects outputs that break the evidence schema or the grading caps. Loaded by the quality-reviewer agent.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when rating a source with the NATO Admiralty Scale, the user asks "is this reliable?" / "rate this source", or the tradecraft pipeline calls for source assessment before publishing. Reliability A-F, credibility 1-6.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when prioritising CVEs, the user asks "should we patch X first?" / "is CVE-YYYY-NNNNN being exploited?", or wants weaponisation, EPSS, and KEV context combined into a patch-now-vs-later recommendation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks "who are our customers?" / "how do we tailor for X stakeholder?" / "who should this report go to?", or wants to map / re-map stakeholder needs. Ensures intelligence reaches the right people in the right format.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks for a YARA rule, "write YARA for this sample/family", or `/hash-investigation` / `/malware-analysis` surfaces a sample worth a static-content rule. Pattern-matching rules for identifying malicious files.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks about the ransomware ecosystem, RaaS dynamics, affiliate markets, attribution between groups, leak-site behaviour, or recent group activity (LockBit lineage, ALPHV/BlackCat, RansomHub, Akira, Play, Qilin, Cl0p, Medusa, etc.). Self-updating knowledge cell.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks about CTI standard operating procedures (daily triage, IOC processing, flash-report cadence, threat-actor profile updates, briefing schedule), or wants to look up a specific SOP.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks "what TLP should this be?", applying TLP markings to a finished product, or the tradecraft pipeline calls for TLP determination before sharing. Covers TLP v2.0 (CLEAR / GREEN / AMBER / AMBER+STRICT / RED).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
VirusTotal API v3 reference. File, IP, domain, and URL analysis endpoints.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
AlienVault OTX API reference. Community threat intelligence pulses and indicator lookups.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Structured OSINT collection methodology. Planning, collection techniques, search operators, and documentation. Loaded by the osint-researcher agent.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
MITRE ATT&CK local dataset reference. Query techniques, groups, software, and mitigations from the local enterprise-attack.json.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks "which SAT should I use for X?", wants the index of Structured Analytic Techniques, or is choosing between quality-of-information-check, ACH, key-assumptions-check, devils-advocacy, indicators of change, etc. Quality of Information Check is the default first step of any diagnostic run.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks to create, review, retire, or refine Priority Intelligence Requirements, or wants to align collection and analysis to the current PIR set. Covers the PIR lifecycle end-to-end.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when evidence needs grading before anyone reasons from it — the user asks "how reliable is this?", "grade this source", "check this report", "can I trust this article?", "is this corroborated?", or hands over a URL, a pasted report or a Liberty91 event ahead of an ACH or assessment. The Quality of Information Check from the CIA Tradecraft Primer, adapted for vendor and press CTI reporting. Resolves each document to its originating source, splits it into claims, and grades every claim on two written elements, access level (how the source knows) and claim support (what backs the statement), with a stated rationale, using a fixed rubric with hard caps. The grade is not an Admiralty rating. Five outlets citing one vendor report count as one source; anything that cannot be traced to a primary is capped, not guessed. Returns a graded claim table, gaps, a deception screen and JSON. /ach, /threat-assessment and /writing-assessments run it first by default.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
ReversingLabs Spectra Analyze (A1000) API reference. File hash classification, detailed reports, dynamic analysis, network indicator reputation, advanced search, YARA, container relationships.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks for a SIGMA detection rule, "write a SIGMA rule for X", or `/hash-investigation` / `/malware-analysis` surfaces behaviour worth a vendor-agnostic detection. Format spec + writing guide.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you need to know where a piece of reporting actually came from — the user gives an article URL and asks "where does this come from?", "who is the original source?", "is this just a rewrite?", or another skill needs the provenance chain before grading or citing a report. Follows an article's links and named attributions back to the originating vendor, government, victim or actor document and returns the chain, the primary's stated access and confidence language, publication dates, and every hop it could not resolve. Deterministic — a script or the Liberty91 platform resolves the chain; the model does not reconstruct it from memory. Invoked by /quality-of-information-check, /threat-actor-profiling, /campaign-tracking and /intelligence-writing. Works on any URL with no API key.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks about supply-chain attacks, third-party / vendor compromise (SolarWinds, Kaseya, 3CX, MOVEit, XZ-utils-style), software-bill-of-materials risks, or library / dependency-injection attacks. Self-updating knowledge cell.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a user asks to scan, investigate, or characterize a URL. Submits to URLScan (unlisted by default), cross-references with VirusTotal and OTX, extracts the parent domain and resolved IP for follow-up investigation. Returns verdict, redirect chain, contacted infrastructure, and screenshot. Invoked by /cti-orchestrator when the target is a URL.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
URLScan.io API reference. URL submission, scanning, and result retrieval.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user asks about Russian state-sponsored cyber operations or specific actors (APT28/Fancy Bear, Sandworm, Cozy Bear/APT29, Turla, GRU-affiliated hacktivist fronts like CARR/NoName057), wartime ICS/OT campaigns, or pro-RU information operations. Self-updating knowledge cell.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Shodan API reference. Host reconnaissance, port scanning, and vulnerability data.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.