kevinmhorvath/threat-intel-toolkit
5 stars · Last commit 2026-08-18
Defensive IOC + vulnerability triage for Claude Code: a subagent plus two key-free skills that aggregate 10 free open-source threat feeds and rate a CVE's exploit maturity. No API keys required.
README preview
# Threat Intel Toolkit
A reusable, shareable bundle for **defensive IOC + vulnerability triage** built on free /
open-source intel. **Everything is fetched anonymously — no API keys, no registration** — so
any org can clone it and run it immediately. It ships a subagent and two complementary skills:
- **`agents/threat-intel-analyst.md`** — a subagent you invoke for multi-step investigations
("triage these 20 IOCs from the alert", "how bad is CVE-2024-3400?"). It routes each
indicator to the right skill and layers analyst judgment on top of the raw results.
- **`skills/threat-intel-lookup/`** — *indicator-centric*. A single stdlib-only script
(`ti.py`) that **aggregates** 10 curated free feeds into a local SQLite cache and **looks
up** IPs, domains, URLs, and CVEs against it. Triggers on its own whenever you drop an IOC.
- **`skills/exploit-availability-check/`** — *vulnerability-centric*. Given a CVE, it rates
**exploit/PoC maturity** and in-the-wild status via CISA KEV, EPSS, Metasploit, Nuclei,
Exploit-DB, and the nomi-sec/trickest PoC aggregators. Answers "how weaponized is this?"
The two skills meet at the CVE: threat-intel-lookup gives a fast KEV verdict inside a mixed
IOC batch; exploit-availability-check goes deep on a specific CVE's exploit maturity. Use
either skill directly, or let the agent orchestrate both.