How to use the Analyzing Threat Intelligence Feeds agent skill

What does the skill make the agent do?

The skill gives the agent a structured playbook for threat intelligence feed work. Following its workflow, the agent can rank feed sources, normalize indicators into STIX 2.1, remove duplicates, enrich indicators with lookups from services such as VirusTotal, Shodan and PassiveTotal, and suggest how long each indicator should stay active before it expires.

The skill also includes a Python helper script, scripts/agent.py, that can connect to a TAXII 2.1 server to list collections and download indicators. The reference file references/api-reference.md shows the taxii2-client and stix2 calls the script relies on.

• Rank feed sources by update frequency, accuracy, sector coverage and attribution depth
• Convert IP addresses, domains and file hashes into STIX 2.1 indicator objects
• Deduplicate using normalized value plus type as the key
• Suggest time-to-live values: IP addresses 30 days, domains 90 days, file hashes 1 year
• Pull indicators from TAXII 2.1 servers with the helper script

Install the skill

Download the skill ZIP from this page and unzip it. You can install it for yourself or for a single project.

For a personal install, unzip it into ~/.claude/skills/. For a project install, unzip it into the .claude/skills/ folder inside your project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check the requirements before you start

The skill assumes a working CTI setup. You need Python 3, the taxii2-client and stix2 Python packages, and access to a threat intelligence platform such as ThreatConnect, MISP or OpenCTI for the full workflow. Commercial feed API keys (Recorded Future, Mandiant Advantage or VirusTotal Enterprise) are optional and depend on your use. A TAXII server URL and credentials are only needed if you run the script against a server.

• Python 3
• taxii2-client Python package (the source shows pip install taxii2-client)
• stix2 Python package
• A TIP such as ThreatConnect, MISP or OpenCTI, with read/write access to its indicator database (optional for the script)
• Commercial feed API keys (optional)
• TAXII server URL and credentials (optional, for the script)

How do you trigger the skill with a natural request?

You do not need special syntax. Describe the task in plain language and mention the feed, platform or format involved. The skill's description names ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX and feed aggregation pipelines, so including one of these helps it activate.

Ask for a specific outcome rather than a general review. Good requests name the input, such as a feed or collection, and the output, such as STIX 2.1 objects or a deduplicated list.

• "Score these five feeds on update frequency and accuracy before we pay for one."
• "Convert this list of IPs and SHA-256 hashes into STIX 2.1 indicators with confidence scores."
• "Deduplicate these MISP and OTX indicators and suggest TTLs for each type."
• "List the collections on this TAXII 2.1 server and pull the indicators from one of them."

Run the TAXII helper

The skill's reference shows how the helper uses the taxii2-client library. Discovery connects to a TAXII 2.1 server and prints each collection's ID and title. Fetching reads a collection in pages of 100 and prints the pattern of each indicator object. Replace the example URL and credentials with your own server details.

The source also shows the CLI form for discovery and collection retrieval. These are the commands the skill's workflow lists for TAXII-enabled feeds.

Safety notes: scripts and network access

This skill runs scripts and uses the network. The helper connects to the TAXII server you specify and can push indicators back to it. Review scripts/agent.py and check which server and credentials it uses before running it against production systems.

The skill warns that blocking decisions should not be made directly from agent output. For indicators with confidence below 50, it advises detection-only rules rather than blocking. A shared CDN IP can be malicious-adjacent and still carry legitimate traffic, so have a human review changes before they reach a firewall or EDR.

• Check the server URL and credentials before running the script
• Keep TLP restrictions in mind: RED intelligence must not be shared outside authorized boundaries
• Use detection-only rules for confidence below 50
• Require human review before any blocking rule is deployed

Tips for better results

Give the agent the feed source and its type (commercial, government, ISAC or OSINT) so it can apply the right scoring. Provide the target format and the system receiving the output, such as Splunk, Microsoft Sentinel or a TIP. The skill also flags a common mistake: ingesting the same indicator from several feeds without deduplication inflates counts and SIEM rule complexity.

• Name the feed and the destination system in the same request
• Ask for TTLs and confidence values alongside the conversion
• Expect stale indicators to cause false positives, so enforce expiry