Guide · Agent skill
How to use the Threat Actor Profiling from OSINT agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This agent skill helps an AI agent build a profile of a threat actor group from public information such as vendor reports, paste sites, forums, code repositories and threat feeds. It covers correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and organising the findings into a dossier of motivations, capabilities, infrastructure and techniques mapped to MITRE ATT&CK. After reading this guide you will know how to install the skill, how to ask for a profile in plain language, and what the skill needs to run.
Threat Actor Profiling from OSINTmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Install the Python libraries. Install Python 3.9 or newer with requests, shodan, beautifulsoup4, maltego-trx and stix2.
- 5Add API keys if needed. Add your own Shodan, VirusTotal, AlienVault OTX or PassiveTotal keys if you plan to run the example code.
- 6Ask for a profile. Name the threat actor and the output you want, such as a dossier covering motives, infrastructure and ATT&CK-mapped TTPs.
What the skill makes the agent do
An agent skill is a folder of instructions and optional scripts that an AI agent loads when your request matches the skill's purpose. This one is for threat actor profiling: turning open-source intelligence into a structured adversary dossier.
The skill's workflow has two main parts. First, it collects intelligence from several public sources, including AlienVault OTX searches, VirusTotal and Shodan lookups for indicators. Second, it organises that material into a STIX 2.1 threat actor profile covering aliases, suspected origin, motivation, targeted sectors, campaigns, TTPs mapped to ATT&CK, toolset, infrastructure patterns and a timeline. The included script also pulls MITRE ATT&CK group data to enrich a profile.
- Collects material from vendor reports, paste sites, dark web forums, social media and code repositories
- Correlates indicators and maps infrastructure with Maltego and SpiderFoot
- Produces a dossier covering motives, capabilities, infrastructure and TTPs
Install the skill (ZIP download or Claude Settings)
Download the skill ZIP from this page. To make it available in Claude Code for yourself, unzip it into your personal skills folder at ~/.claude/skills/. To make it available only inside one project, unzip it into that project's .claude/skills/ folder instead.
In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Set up the requirements
The skill expects Python 3.9 or newer and these libraries: requests, shodan, beautifulsoup4, maltego-trx and stix2. SpiderFoot and Maltego (Community or XL edition) are optional tools for mapping infrastructure. API keys for Shodan, VirusTotal, AlienVault OTX and PassiveTotal/RiskIQ are optional and are used by the example code.
The skill needs internet access to fetch the MITRE ATT&CK dataset from GitHub. The reference file shows a curl command for downloading the enterprise ATT&CK STIX file.
- Python 3.9+ with requests, shodan, beautifulsoup4, maltego-trx, stix2
- SpiderFoot (optional) and Maltego CE or XL (optional)
- API keys for Shodan, VirusTotal, AlienVault OTX, PassiveTotal/RiskIQ (optional, for example code)
curl -o enterprise-attack.json \
https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.jsonTrigger the skill with natural requests
You do not need to name the skill. Describe the task and mention the group, the sources or the output you want. The skill's description says it applies when you are performing attribution or building an adversary dossier from open-source intelligence, so phrase requests in those terms.
Give the agent a specific group name and a clear output format. Say whether you want a STIX profile, a narrative dossier or a list of ATT&CK techniques.
- Build an OSINT dossier on the APT29 group covering motivation, infrastructure and TTPs mapped to MITRE ATT&CK.
- Pull the MITRE ATT&CK group data for an intrusion set and list its techniques for my profile.
- Help me correlate these indicators with public vendor reports and tell me which actor they point to, with a confidence assessment.
Safety notes on scripts and network use
This skill runs scripts and uses the network. The example code calls external services such as the AlienVault OTX, VirusTotal and Shodan APIs, and it fetches data from GitHub. The example code uses placeholder keys such as YOUR_VT_KEY, so replace them only with your own keys and do not commit them to shared folders.
The skill's own guidance is cautious about scope. Public-source attribution is uncertain and needs analytic review, so do not treat a profile as proof of who attacked a live incident. Avoid gathering information on private individuals or targets, because social media and paste-site collection can raise privacy and legal concerns.
- Read the scripts in scripts/agent.py before running them
- Use your own API keys and keep them out of shared files
- Do not use the skill to attribute a live incident without independent corroboration
- Do not use it to collect information on private individuals or targets
Tips for better profiles
Start with a single named group and gather its public aliases first, since vendors use different names for the same actor. Keep a record of the source of each claim so the analytic review can check it. Treat the Diamond Model and Analysis of Competing Hypotheses as the structure for weighing evidence, and label your confidence level for each attribution point.
- Collect aliases across vendors before searching indicators
- Record the source and date for every claim
- Use ATT&CK mapping to document TTPs consistently
- Keep alternative hypotheses in the dossier
What people use it for
- Threat intelligence analysts drafting an adversary dossier from vendor reports and public indicators
- Security teams preparing an attribution discussion that relies on public evidence
- Students learning how OSINT-based threat profiles are structured, including STIX objects and ATT&CK mapping
- Pulling MITRE ATT&CK group data to list the techniques associated with an intrusion set
Frequently asked questions
How do I install the building-threat-actor-profile-from-osint skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.
What do I need to run this skill?
You need Python 3.9 or newer with requests, shodan, beautifulsoup4, maltego-trx and stix2. SpiderFoot and Maltego are optional, as are API keys for Shodan, VirusTotal, AlienVault OTX and PassiveTotal/RiskIQ, which the example code uses. Internet access is needed to fetch the MITRE ATT&CK dataset from GitHub.
Is the threat actor profiling skill free to use?
The skill is licensed under Apache-2.0. The source does not state pricing for Maltego or the API services, so check those providers' own terms for cost, since Maltego CE or XL and the API keys are optional add-ons.
Can the skill attribute an attack to a named group?
It can help structure evidence, but public-source attribution is uncertain and needs analytic review. Do not attribute a live incident to a named actor without independent corroboration.
Which tools does it use to map infrastructure?
The skill uses Maltego for link analysis and SpiderFoot for OSINT collection and infrastructure mapping. Both are optional, and the example code also queries Shodan for details on IP addresses.
How is this different from just asking an AI chatbot about a hacker group?
The skill follows a defined workflow: collecting from named source types, correlating indicators, building a STIX 2.1 profile and mapping TTPs to MITRE ATT&CK. It also pulls ATT&CK group data with its included script, so the output follows a consistent dossier structure.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you write adversary dossiers, prepare attribution discussions with public evidence, or are learning how OSINT threat profiles are structured. Pick something else if you need to attribute a live incident quickly with certainty, or if your task is collecting information on private individuals, which the skill itself warns against.
Download the skill