CTI Expert

---

name: cti-expert description: "CTI Expert — cyber threat intelligence and OSINT analysis toolkit. Activates on: OSINT, CTI, threat intelligence, digital footprint, social media investigation, username enumeration, email tracing, domain recon, OPSEC, metadata analysis, people search, geolocation, breach checking, phone lookup, subdomain enumeration, case investigation, recon, due diligence, image forensics, face search, blockchain investigation, crypto tracing, flight tracking, maritime tracking, vehicle lookup, darknet search, WiFi SSID geolocation, vulnerability lookup, ransomware check. Commands: /case, /sweep, /query, /subject, /timeline, /report, /brief, /exposure, /username, /phone, /breach-deep, /vuln-check, /wifi, /flow, /threat-model. Techniques: social media platforms, advanced geolocation, web/DNS forensics, image forensics, blockchain, transport tracking, darknet, people search, cloud audit, incident triage, OWASP audit, prompt injection audit. Author: Hieu Ngo - chongluadao.vn" version: "2.0" author: "Hieu Ngo - chongluadao.vn"

CTI Expert

Cyber threat intelligence and open-source intelligence skill. Turns Claude into a trained CTI/OSINT analyst. Generates precision search queries, interprets public data, builds case timelines, and delivers structured intelligence products — no API keys, no paid subscriptions.

Collection method: `agent-browser` when available (JavaScript-heavy sites, infinite-scroll, screenshot evidence), with automatic fallback to web search / web fetch / direct URL fetch. Tool limitations are logged as collection gaps — never as case blockers.

---

1. Quick Start

# Full autonomous case — runs every applicable technique
/case target.com

# Guided flow for first-time investigators
/flow person

# Summary of what's been found so far
/brief

Append `--yolo` to any command to skip all interactive prompts and confirmations. The analyst makes every decision autonomously.

---

2. AEAD Case Lifecycle

Every investigation follows four phases:

Phase	What Happens
Acquire	Collect raw data — /sweep, /query, /username, /phone, /email-deep, /subdomain
Enrich	Expand leads — /branch, /crossref, /link-subjects, /signatures
Assess	Score and verify — /exposure, /threat-model, /validate, /coverage, /verify-finding
Deliver	Package output — /report, /brief, /render, /workspace save — auto-saves .md + .docx

Run `/progress` at any point to see which phase you're in and what's pending.

---

3. Command Reference

Commands grouped by AEAD phase.

Acquire

Command	What It Does	Example
/case [target]	Full pipeline — runs every applicable technique	/case example.com
/sweep [target]	Multi-vector recon on any target type	/sweep @username
/query [subject]	Builds 12–15 advanced search operator queries	/query example.com