threat-intelligence SKILL.md skillA
threat-intelligence from novaestellar/novahaku is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add novaestellar/novahaku/threat-intelligence@git:20260925.268b7c3Pins git:20260925.268b7c3 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- novaestellar/novahaku
- Path
testing/threat-intelligence/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260925.268b7c3, committed Sep 25, 2026
- First version recorded
- Sep 10, 2026
- Size
- 7,404 bytes
- Repository stars
- 28
- License
- MIT
Use for authorized OSINT and cyber threat intelligence that enriches IOCs, campaigns, impersonation, scams, or threat actors from public sources. Includes bounded X/Twitter search through Xquik, source preservation, corroboration, and evidence handoff.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Threat Intelligence & Public-Source OSINT ## ACTION REQUIRED（读完后立刻执行） 1. `NOW`: 读取 `../ops/scope-contract.md`，确认公开来源、目标实体、时间窗与交付用途。 2. `NOW`: 仅在需要操作先例时读取 `../field-journal/precedent-pentest.md`。先例不能授予权限。 3. `NOW`: 写出可证伪的情报问题，以及必须独立核验的候选结论。 4. `NEXT`: 读取 `../tool availability`。需要公开 X 数据时检查 `xquik-mcp`。 5. `ACT`: 从最窄的只读查询开始，保留来源元数据，再进入关联与核验。 ## 适用范围 - 用公开来源补充域名、IP、URL、哈希、邮箱或钱包地址等 IOC。 - 追踪公开披露的恶意活动、钓鱼活动、仿冒账号与诈骗叙事。 - 从公开 X/Twitter 帖子发现线索，并交给样本、网络或厂商来源核验。 - 为 `threat-hunting/`、`malware-analysis/`、`email-security/` 或 `digital-forensics/` 准备情报包。 本 Skill 不处理品牌营销、舆情增长、自动发帖或无安全目的的社交分析。 ## 语言行为契约 - 内部工具选择、阶段控制与字段名使用 English。 - 用户可见结论默认使用中文，除非用户要求其他语言。 - 证据状态使用 `线索 / lead`、`已佐证 / corroborated`、`已确认 / confirmed`。 ## 工具依赖 | 能力 | 必需 | 用途 | 接入方式 | |------|------|------|----------| | Xquik MCP | 否 | 公开 X/Twitter 搜索、帖子与账号读取 | `xquik-mcp`，远程 HTTPS + OAuth | | Xquik REST | 否 | 脚本化的公开 X 数据读取 | `https://xquik.com/api/v1` + `XQUIK_API_KEY` | | 其他独立来源 | 是 | 核验 X 来源的候选结论 | 厂商公告、样本、DNS、证书、仓库或案件证据 | Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp. ## 工作流 ### 1. 定义情报问题 …
Read the whole file at its exact version.
How to install
mdr add novaestellar/novahaku/threat-intelligence@sha256:d2d30803867d7327The line at the top of this page pins the label git:20260925.268b7c3, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_r3jw666rrum3ih63)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Sep 10, 2026 and Sep 25, 2026, about one every 15 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260925.268b7c3 latest | 2026-09-25 | 268b7c3 | 7,404 B | A | view · diff |
| git:20260910.546fe86 | 2026-09-10 | 546fe86 | 7,372 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (7404 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
novaestellar/novahaku · 28 stars · license MIT · pushed 2026-09-28 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_r3jw666rrum3ih63 GET https://markdownregistry.com/api/v1/resolve?ref=novaestellar/novahaku/threat-intelligence GET https://markdownregistry.com/api/v1/blob/d2d30803867d7327ed717ae0dce747090b1e0652a832ea3a28b1931ebfec2abf
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.