aldegad

Security Threat Intel — Security skill for Claude Code

Security community

Security Threat Intelligence skill for AI code review agents — MITRE ATT&CK infostealer mapping, detection checklist, review guidelines.

How to install Security Threat Intel

This entry records only its repository, not the path inside it, so there is no exact command to give. Open aldegad/security-threat-intel and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Security Threat Intel does

Security Threat Intelligence skill for AI code review agents — MITRE ATT&CK infostealer mapping, detection checklist, review guidelines.

Alternatives in Security

Security Threat Model — Generate repo-specific threat models identifying trust boundaries 14.6k ★
Skills — Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows 4k ★
Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★

README

Security Threat Intelligence Skill

A knowledge-base skill for AI code review agents. Gives your agent deep understanding of **infostealer threats, MITRE ATT&CK techniques, and detection methodology** so it can review security tools and incident response scripts with real domain expertise.

What This Is

A `SKILL.md` file that you drop into your AI agent's skill directory. It contains:

MITRE ATT&CK mapping for infostealer-related techniques (24 techniques across 6 tactics)
Infostealer family profiles (13 families: Atomic Stealer, RedLine, Lumma, Vidar, etc.)
Detection checklist (P0-P3 priority levels for evaluating security tools)
Security tool review guidelines (what to check when reviewing detection scripts)
CLI scanner references (Semgrep, Trivy, YARA, Sigma rules)
Threat intelligence API references (NVD, GitHub Advisory, OSV.dev)

Who This Is For

AI agents that review security code (e.g., detection scripts, incident response tools)
Code review bots that need to evaluate security coverage against real-world threats
Anyone building AI-assisted security workflows

Quick Start

Claude Code

# Copy to your skills directory
cp -r security-threat-intel ~/.claude/skills/

# Or symlink
ln -s /path/to/security-threat-intel ~/.claude/skills/security-threat-intel

The skill will be automatically loaded when Claude Code starts.

Other AI Agents

Include the contents of `SKILL.md` in your agent's system prompt or knowledge base.

What Your Agent Can Do With This

**Before** (without the skill):

"The code looks fine. No obvious issues."

**After** (with the skill):

"This detection script covers T1555.003 (browser credential theft) but misses T1539 (session cookie theft). The infostealer check should also verify Chrome `Cookies` DB access by non-Chrome processes. Based on the P0 checklist, the following items are missing..."