Guide · Agent skill
How to use the IOC Defanging and Sharing Pipeline agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the building-ioc-defanging-and-sharing-pipeline agent skill does, how to install it, and how to ask an agent to use it. It is for security analysts who write threat reports and engineers who publish threat-intel feeds. By the end you will know how to get raw indicators cleaned, defanged and prepared for STIX 2.1 sharing, and what to check before anything leaves your team.
IOC Defanging and Sharing Pipelinemukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it on your machine.
- 2Place the folder. Move the folder into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install the Python libraries. Use Python 3.9 or newer and install defang, ioc-fanger, stix2, requests and validators.
- 4Ask for a defanged list. Paste your raw indicators and ask the agent to clean, deduplicate and defang them.
- 5Review the results. Check each indicator for false positives and misses before it goes into a report or feed.
- 6Build a STIX bundle if needed. Ask for a STIX 2.1 indicator bundle, then validate it against your sharing requirements before sending it to TAXII or MISP.
What the skill makes the agent do
The skill teaches an agent to take raw threat indicators, such as malicious URLs, IP addresses, domains, email addresses and file hashes, and turn them into a cleaned, deduplicated list. The source describes normalizing values (lowercasing, removing trailing slashes and whitespace, extracting domains from URLs, resolving URL encoding) and then removing duplicates across sources.
It also produces defanged versions, where the indicator is deliberately broken so it cannot be clicked or executed by accident. Defanging turns http:// into hxxp://, https:// into hxxps://, dots into [.] and @ in emails into [@]. Analysts can paste these into reports, emails or chat without auto-linking to live infrastructure.
For distribution, the skill describes building machine-readable STIX 2.1 indicator bundles for TAXII servers, MISP instances or email reports. The bundled Python script (scripts/agent.py) extracts indicators from text and defangs them. SKILL.md also contains a fuller example pipeline.
Install the skill from the ZIP
Download the ZIP for this skill from this page and unzip it. To make it available for your own use, place the unzipped folder in ~/.claude/skills/. To make it available only inside one project, place it in that project's .claude/skills/ folder.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: the .claude/skills/ folder inside your project
- Claude apps: Settings → Capabilities → Skills
Install the Python requirements
The skill needs Python 3.9 or newer. SKILL.md lists the libraries it uses: defang, ioc-fanger, stix2, requests and validators. The source does not give a single install command, so check the library names against your own environment before you run anything.
Sharing through MISP or a TAXII server also requires access to that instance. The files do not specify how to obtain or store API keys or credentials, so set those up according to your organisation's practice.
- Python 3.9+
- Libraries: defang, ioc-fanger, stix2, requests, validators
- A MISP instance or TAXII server, only if you want automated sharing
Trigger the skill with a natural request
You do not need a special command. Describe the job in plain language and mention the outcome you want, such as a defanged list, a deduplicated set or a STIX bundle. The agent should pick up the skill when the request matches its description.
Good requests name the input and the output. Include the indicators or the file that holds them, and say whether you want defanged text for a report, a STIX 2.1 bundle, or both.
- Defang these indicators so I can paste them into my incident report: hxxp is not needed, just give me the list with [.] in place of dots.
- Clean up and deduplicate the IOCs in this text, then give me the defanged version.
- Turn these URLs, IPs and hashes into a STIX 2.1 indicator bundle that I can review before sharing.
- Pull the indicators out of this threat write-up and sort them by type.
Review the output before sharing
The source warns that regex-based extraction can produce false positives and misses. Read the list before it goes to a report or a community feed. Wrong indicators shared publicly can cause harm or get legitimate sites blocked.
The sample extraction code in SKILL.md removes common domains such as google.com and github.com with a whitelist. Check that your own trusted domains are handled correctly, and check that defanged output still makes sense to the people reading it.
- Confirm each indicator is real and malicious before sharing it
- Check for false positives from text such as file names or ordinary domains
- Verify that the defanged form is correct for every type
Example of the defanging rule
The defang helper in SKILL.md replaces the protocol and dots for URLs. The rule for URLs is shown below, copied from the source. Your agent may use a different implementation, so compare its output with the rules table in the reference file.
return url.replace("http://", "hxxp://").replace("https://", "hxxps://").replace(".", "[.]")What people use it for
- Turn indicators from a malware write-up into a defanged list for an internal incident report.
- Remove duplicate IOCs gathered from several threat-intel sources before comparing them.
- Prepare STIX 2.1 indicator bundles for review before distribution through a TAXII server.
- Share email-based indicators in a team chat without creating clickable links.
Frequently asked questions
Is the IOC Defanging and Sharing Pipeline skill free to use?
The skill is published under the Apache-2.0 licence, as stated on this page. Check the licence file in the downloaded package for the full terms before reusing it in your own work.
What do I need to run this skill?
You need Python 3.9 or newer and the libraries defang, ioc-fanger, stix2, requests and validators. You also need a MISP instance or TAXII server only if you want automated sharing.
Where do I install the skill?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Does the skill run code and access the network?
Yes. The source says the skill runs scripts and uses the network, and the bundled script makes network requests. Review scripts/agent.py before running it, especially in environments where scripts must not run unreviewed.
Why not just use find-and-replace to defang indicators?
For a one-off list, a simple find-and-replace or an existing tool is faster and avoids running extra code. The skill is more useful when you need a repeatable process for many indicators or automated STIX sharing.
Why are some indicators missing or wrong after extraction?
The source notes that the regex extraction can produce false positives and misses. Review the output by hand, and compare results against the extraction patterns in references/api-reference.md if something looks off.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits analysts who defang indicators by hand and want a repeatable process, and engineers who need to build STIX 2.1 feeds for TAXII or MISP. Use a simple find-and-replace or an existing tool if you only need one defanged list, and avoid unreviewed production sharing because the extraction can be wrong.
Download the skill