Skip to content
Get packs

Threat Intelligence OSINT

Enriches security indicators and threat campaigns using bounded public-source research, including X/Twitter search

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

Once installed, the agent follows a structured public-source investigation method for cyber threat intelligence: it turns a question about a domain, IP, hash, campaign, impersonation or scam into narrow, repeatable searches, records where each finding came from, and requires an independent source to confirm important claims before treating them as established. It can optionally connect to a third-party service (Xquik) to search public X/Twitter posts, and it hands evidence packages to other security skills for detection or malware work.

Great for

  • Security analysts researching phishing campaigns or impersonation accounts from publicly disclosed sources
  • Threat intelligence teams who need traceable, source-backed evidence packages with stated confidence levels
  • Researchers who want a disciplined method that avoids treating a single social media post as proof

Skip it if

  • Brand marketing, social listening for growth, or automated posting, which the skill explicitly excludes
  • Attributing activity to a named person or group from social posts alone, since the skill itself says posts are only leads (risk of false accusations)
  • Investigations without authorization or a defined scope, since the skill requires a scope contract and authorized use

Try asking

  • “Check whether this domain appeared in public phishing disclosures in the last 7 days and list the original posts with links”
  • “Build a bounded query plan for a campaign alias and impersonated brand, with stop conditions”
  • “Summarise public reports on this malware hash and list which claims are corroborated by a second independent source”
  • “Prepare an evidence handoff package for the threat-hunting skill from these public X posts”
Step-by-step guide: how to use Threat Intelligence OSINTInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    threat-intelligence.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip threat-intelligence.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip threat-intelligence.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide a written scope (targets, time window, result limit, purpose) before starting, since the skill expects it and will pause without it
  • Keep the Xquik API key in an approved secret store and never paste it into prompts or reports; use OAuth via the MCP client where possible
  • Treat every X post as a lead only and ask for an independent technical or primary source before drawing conclusions

What's inside

  • references/x-public-intelligence.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.