threat-intel

Scrape authoritative web sources for live CVEs, exploits, and threat intelligence.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/noname300989/Security-Claw --skill threat-intel
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: threat-intel
Source: https://github.com/noname300989/Security-Claw/tree/main/skills/threat-intel
Command: npx skills add https://github.com/noname300989/Security-Claw --skill threat-intel

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, beautifulsoup4, feedparser, lxml, httpx, rich, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the collection of the latest security information from various authoritative web sources, ensuring that security assessments are always backed by current data.

Core Features & Use Cases

  • Live CVE Feeds: Gathers real-time CVEs from NVD and CISA KEV.
  • Exploit Intelligence: Pulls public exploits from Exploit-DB and Packet Storm.
  • Threat Actor TTPs: Collects intelligence from open-source feeds.
  • Use Case: Automatically fetch the latest critical CVEs published in the last 7 days and check if they are listed in the CISA Known Exploited Vulnerabilities catalog to prioritize patching efforts.

Quick Start

Run a full threat intelligence refresh and provide today's security briefing.

Frequently Asked Questions about threat-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate scraping live CVE feeds from NVD and CISA KEV?

You can automate scraping live CVE feeds from NVD and CISA KEV by running this Skill, which uses Python requests and feedparser to aggregate real-time vulnerability data and security advisories automatically.

What is the best way to gather public exploits from Exploit-DB and Packet Storm?

The best way to gather public exploits from Exploit-DB and Packet Storm is using an automated scraping tool. This Skill extracts exploit intelligence and threat actor TTPs directly from these sources using beautifulsoup4 and lxml.

Does this threat intelligence scraper require API keys for Shodan or GreyNoise?

Based on the provided metadata, this threat intelligence scraper relies on web scraping using requests and httpx rather than requiring explicit API keys. It pulls trends from Shodan and GreyNoise via public web sources.

Can I fetch recent critical CVEs and cross-reference them with the CISA Known Exploited Vulnerabilities catalog?

Yes, you can fetch recent critical CVEs and cross-reference them with the CISA Known Exploited Vulnerabilities catalog. This Skill collects NVD data and correlates it with CISA KEV to help prioritize patching efforts.

How do I collect threat actor TTPs and security advisories using Python?

You collect threat actor TTPs and security advisories using Python by utilizing this Skill's scraping scripts. It integrates with AlienVault OTX, AttackerKB, and OWASP feeds to aggregate open-source intelligence.

What limitations exist when scraping threat intelligence from HackerNews RSS and GitHub advisories?

A limitation when scraping threat intelligence from HackerNews RSS and GitHub advisories is dependency on the structure of live web pages. The Skill uses beautifulsoup4 and lxml to parse feeds, which may break if source HTML changes.