Classify CTI requests and route them to downstream skills.
npx skills add https://github.com/Liberty91LTD/cti-skills --skill cti-orchestrator
Please help me install this Agent Skill. Skill: cti-orchestrator Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/cti-orchestrator Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill cti-orchestrator
The orchestrator provides a single entry point for CTI requests that do not specify a target skill, classifies the request, delegates to downstream skills, and automatically applies rigor to the results to produce a source-rated, confidence-marked product. It does NOT query external APIs directly and is designed to compose other skills to perform the work.
Route an unknown CTI request to the orchestrator and observe it handing off to the appropriate downstream skill.
High-intent search queries and answers about installing and using this skill.
CTI routing solves this by classifying ambiguous cyber threat intelligence requests and automatically delegating them to the correct downstream investigation skill for IOCs, actors, or campaigns.
Automated rigor in threat intelligence workflows applies source assessment, TLP, confidence, and likelihood markings to outputs automatically, ensuring produced intelligence is prepared for writing or sharing without user prompts.
No, the orchestrator does not query external APIs directly. It composes and coordinates other downstream skills to perform the work, acting as a single entry point for CTI requests.
You coordinate multi-skill chains for threat investigations by routing an unknown CTI request to the orchestrator, which executes internal routing logic and invokes the necessary downstream lookup and production skills automatically.
No, you do not need to manually specify a target skill. The orchestrator acts as a single entry point for CTI requests that do not specify a target, classifying and delegating the request automatically.
Liberty91LTDCoordinate CTI lifecycle phases across strategic, operational, and tactical levels.
Liberty91LTDApply TLP designations to intelligence outputs via YAML frontmatter and headers.
dapperdiversAutomate threat intelligence collection and indicator enrichment workflows for security analysis.
bbrowningAutomate security reviews of JWT, OAuth 2.0/2.1, PKCE, and token exchange code.
