スキルを探す

Use when you need to know where a piece of reporting actually came from — the user gives an article URL and asks "where does this come from?", "who is the original source?", "is this just a rewrite?", or another skill needs the provenance chain before grading or citing a report. Follows an article's links and named attributions back to the originating vendor, government, victim or actor document and returns the chain, the primary's stated access and confidence language, publication dates, and every hop it could not resolve. Deterministic — a script or the Liberty91 platform resolves the chain; the model does not reconstruct it from memory. Invoked by /quality-of-information-check, /threat-actor-profiling, /campaign-tracking and /intelligence-writing. Works on any URL with no API key.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks "what TLP should this be?", applying TLP markings to a finished product, or the tradecraft pipeline calls for TLP determination before sharing. Covers TLP v2.0 (CLEAR / GREEN / AMBER / AMBER+STRICT / RED).

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about Russian state-sponsored cyber operations or specific actors (APT28/Fancy Bear, Sandworm, Cozy Bear/APT29, Turla, GRU-affiliated hacktivist fronts like CARR/NoName057), wartime ICS/OT campaigns, or pro-RU information operations. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Use when rating a source with the NATO Admiralty Scale, the user asks "is this reliable?" / "rate this source", or the tradecraft pipeline calls for source assessment before publishing. Reliability A-F, credibility 1-6.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks "which SAT should I use for X?", wants the index of Structured Analytic Techniques, or is choosing between quality-of-information-check, ACH, key-assumptions-check, devils-advocacy, indicators of change, etc. Quality of Information Check is the default first step of any diagnostic run.

日本語の概要は準備中です。原文の説明を表示しています。

Structured threat assessment methodology. Intent + Capability + Opportunity = Threat Level. Use when formally evaluating a threat. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Confidence is capped by the weakest load-bearing claim, and at Moderate when the evidence is ungraded.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to create, review, retire, or refine Priority Intelligence Requirements, or wants to align collection and analysis to the current PIR set. Covers the PIR lifecycle end-to-end.

日本語の概要は準備中です。原文の説明を表示しています。

ReversingLabs Spectra Analyze (A1000) API reference. File hash classification, detailed reports, dynamic analysis, network indicator reputation, advanced search, YARA, container relationships.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks for a SIGMA detection rule, "write a SIGMA rule for X", or `/hash-investigation` / `/malware-analysis` surfaces behaviour worth a vendor-agnostic detection. Format spec + writing guide.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks for a YARA rule, "write YARA for this sample/family", or `/hash-investigation` / `/malware-analysis` surfaces a sample worth a static-content rule. Pattern-matching rules for identifying malicious files.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks "who are our customers?" / "how do we tailor for X stakeholder?" / "who should this report go to?", or wants to map / re-map stakeholder needs. Ensures intelligence reaches the right people in the right format.

日本語の概要は準備中です。原文の説明を表示しています。

STIX 2.1 bundle creation reference. Object types, relationships, and JSON templates for structured threat intelligence sharing. Includes the per-claim mapping of evidence grades (access level and claim support) from /quality-of-information-check to STIX confidence, and the reverse mapping on import.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about supply-chain attacks, third-party / vendor compromise (SolarWinds, Kaseya, 3CX, MOVEit, XZ-utils-style), software-bill-of-materials risks, or library / dependency-injection attacks. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to build or update a threat-actor profile, "tell me about actor X" / "profile actor Y", or another skill needs the canonical profile template (attribution, TTPs, campaigns, infrastructure patterns, intelligence gaps).

日本語の概要は準備中です。原文の説明を表示しています。

Use when evidence needs grading before anyone reasons from it — the user asks "how reliable is this?", "grade this source", "check this report", "can I trust this article?", "is this corroborated?", or hands over a URL, a pasted report or a Liberty91 event ahead of an ACH or assessment. The Quality of Information Check from the CIA Tradecraft Primer, adapted for vendor and press CTI reporting. Resolves each document to its originating source, splits it into claims, and grades every claim on two written elements, access level (how the source knows) and claim support (what backs the statement), with a stated rationale, using a fixed rubric with hard caps. The grade is not an Admiralty rating. Five outlets citing one vendor report count as one source; anything that cannot be traced to a primary is capped, not guessed. Returns a graded claim table, gaps, a deception screen and JSON. /ach, /threat-assessment and /writing-assessments run it first by default.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about CTI standard operating procedures (daily triage, IOC processing, flash-report cadence, threat-actor profile updates, briefing schedule), or wants to look up a specific SOP.

日本語の概要は準備中です。原文の説明を表示しています。

Peer review checklist and quality standards for intelligence products, plus schema validation for graded evidence items and claim tables from /quality-of-information-check and /claim-extraction. Rejects outputs that break the evidence schema or the grading caps. Loaded by the quality-reviewer agent.

日本語の概要は準備中です。原文の説明を表示しています。

AlienVault OTX API reference. Community threat intelligence pulses and indicator lookups.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about the ransomware ecosystem, RaaS dynamics, affiliate markets, attribution between groups, leak-site behaviour, or recent group activity (LockBit lineage, ALPHV/BlackCat, RansomHub, Akira, Play, Qilin, Cl0p, Medusa, etc.). Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Shodan API reference. Host reconnaissance, port scanning, and vulnerability data.

日本語の概要は準備中です。原文の説明を表示しています。

MITRE ATT&CK local dataset reference. Query techniques, groups, software, and mitigations from the local enterprise-attack.json.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks about phishing campaigns, social-engineering techniques, BEC (business email compromise), pretexting, AiTM (adversary-in-the-middle) kits, or specific phishing-kit families. Self-updating knowledge cell.

日本語の概要は準備中です。原文の説明を表示しています。

Structured OSINT collection methodology. Planning, collection techniques, search operators, and documentation. Loaded by the osint-researcher agent.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a user asks to scan, investigate, or characterize a URL. Submits to URLScan (unlisted by default), cross-references with VirusTotal and OTX, extracts the parent domain and resolved IP for follow-up investigation. Returns verdict, redirect chain, contacted infrastructure, and screenshot. Invoked by /cti-orchestrator when the target is a URL.

日本語の概要は準備中です。原文の説明を表示しています。