Guide · Agent skill
How to use the Adversary Infrastructure Tracker agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Adversary Infrastructure Tracker is an agent skill that teaches an AI agent to help you build a Python tool for mapping threat-actor command-and-control (C2) networks. Starting from a known malicious domain or IP, the resulting tool searches passive DNS, certificate transparency logs, WHOIS records and IP data, then links the findings into a graph. This guide is for threat intelligence analysts, security engineers and students who have never used an agent skill before. By the end you will know how to install the skill, ask for it with natural requests, and what API keys and safety checks you need before running anything.
Adversary Infrastructure Trackermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it so you have the building-adversary-infrastructure-tracking-system folder with SKILL.md.
- 2Place the skill folder. Move the folder into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills instead.
- 3Get your API keys. Obtain SecurityTrails, VirusTotal and Shodan API keys, and set up a PassiveTotal/RiskIQ account if you plan to use it.
- 4Install the Python libraries. Install Python 3.9 or newer with requests, dnspython, python-whois, shodan and networkx.
- 5Review the bundled script. Read scripts/agent.py and SKILL.md to understand which endpoints are called and what data is sent before you run it.
- 6Ask for a pivot. Describe your seed domain or IP and ask the agent to build or run a pivot with a set depth.
- 7Verify the results. Check the relationships the tool finds against a second source before treating any infrastructure as linked to a threat actor.
What the skill makes the agent do
Agent skills are folders of instructions and optional scripts that an AI agent loads when your request matches the skill's description. This one focuses on infrastructure pivoting: starting from one indicator and discovering related servers, domains and certificates.
The skill's SKILL.md describes a Python class that performs passive DNS lookups, reverse IP lookups, and WHOIS lookups through the SecurityTrails API, and a pivot function that follows these connections to a set depth. The skill also covers flagging newly registered domains that match known adversary patterns and keeping a continuously updated map of a threat actor's network.
- Passive DNS: historical records of which domains resolved to which IPs and when
- IP pivot: find domains hosted on an IP address
- Domain pivot: find IPs a domain resolved to
- WHOIS pivot: find domains sharing registration details
- Certificate pivot: find hosts sharing SSL certificates, using crt.sh
Install the skill from the ZIP
Download the ZIP for this skill from this page and unzip it. The folder contains SKILL.md, scripts/agent.py and references/api-reference.md. Place the skill folder in one of these locations:
- Personal skills: ~/.claude/skills/ so it is available in all your projects
- Project skills: .claude/skills/ inside a specific project folder, so it applies only there
- Claude apps: upload the ZIP under Settings → Capabilities → Skills
Trigger the skill with natural requests
You do not need a special command. The skill's description says it applies when you are pivoting from known indicators to find related C2 infrastructure, or when you want a continuously updated map of a threat actor's network. Describe your goal in plain language and name the indicator you have.
- Help me pivot from this suspicious domain to find related C2 infrastructure: example-bad-domain.com
- Build a Python tool that maps the IPs and domains connected to this IP using passive DNS and WHOIS
- Write a script that flags newly registered domains matching the naming pattern of this threat actor
- Set up a graph of how these three domains connect through shared IPs and certificates
Example: a pivot from a seed domain
A typical request is to start from one domain, look up its passive DNS history, then reverse-look up the IPs it used to find neighbouring domains. The skill's sample code limits reverse lookups to 20 domains per IP and stores each finding as a relationship with a type such as resolves_to or hosted_on. Those relationships are what you would load into NetworkX, or into Neo4j if you use it, to draw the network.
Treat the output as leads to verify, not conclusions. Shared hosting means two domains were on the same IP at some point, not that they belong to the same operator.
tracker = InfrastructureTracker(securitytrails_key="YOUR_KEY")
result = tracker.pivot_from_seed("example.com", indicator_type="domain", depth=2)What you need before you start
The skill assumes you can run Python and have access to several paid or account-based services. Most lookups will not work without the keys.
- Python 3.9 or newer
- Libraries: requests, dnspython, python-whois, shodan, networkx
- API keys: SecurityTrails, VirusTotal and Shodan
- A PassiveTotal/RiskIQ account, referenced in the prerequisites
- Optional: a Neo4j graph database for relationship visualisation
- Access to passive DNS data sources and an understanding of DNS, hosting and domain registration
Safety notes on scripts and network use
This skill runs scripts and makes network requests to external services. Read agent.py and SKILL.md before running anything, and keep your API keys out of shared code. The code samples are partial, and the bundled script has not been verified against current API behaviour, so review it before any production use.
Use the techniques only against infrastructure you are authorised to investigate, and within your legal and policy limits. The same reconnaissance methods can support attacks or takedown attempts against systems you do not own.
- Review scripts/agent.py before executing it
- Store API keys in environment variables or a secrets manager rather than in code
- Check the terms and quotas of each data provider before automated querying
- Do not use the output to target infrastructure you do not own or have permission to test
Tips for better results
Give the agent a specific seed indicator and state what you want the output to be, such as a graph, a list of candidate domains or a monitoring script. Ask it to consult references/api-reference.md for endpoints, since that file covers crt.sh, URLhaus and ThreatFox in addition to SecurityTrails.
Expect to iterate. Passive DNS data is historical and incomplete, so use several pivots (IP, WHOIS, certificate, name server) and compare results before drawing conclusions.
- Name the exact indicator type: domain, IP or certificate
- Ask for depth limits and result caps to control API usage
- Request the output format you need, such as NetworkX graph or JSON
What people use it for
- Pivoting from a known C2 domain to find other domains and IPs on the same hosting
- Mapping how a threat actor's servers connect through shared IPs and certificates
- Flagging newly registered domains that match a known naming pattern
- Building a NetworkX graph of relationships for analyst review
- Learning how C2 infrastructure is mapped using open data sources
Frequently asked questions
Is the adversary infrastructure tracker agent skill free?
The source does not state a price or licence fee for the API services. The skill itself is published under the Apache-2.0 licence. Most lookups in the skill need API keys from SecurityTrails, VirusTotal and Shodan, so check each provider's terms before use.
What do I need to install this agent skill?
You need Python 3.9 or newer, the requests, dnspython, python-whois, shodan and networkx libraries, and API keys for the services the skill uses. Optionally, you can use a Neo4j graph database. The skill folder is placed in ~/.claude/skills/ or a project's .claude/skills/ folder, or uploaded as a ZIP in Settings → Capabilities → Skills.
Does the skill run code on my machine?
Yes. The skill includes scripts/agent.py and it makes network requests to external services. Read the script before running it and keep your API keys secure.
Can I use this without API subscriptions?
Not really. The source says most lookups need paid keys, and the results depend on them. Without SecurityTrails, Shodan or VirusTotal access, most pivoting steps will not return data.
Is this tool ready for production use?
No, not without review. The code samples are partial and the bundled script has not been verified against current API behaviour. Treat it as a blueprint and test it carefully.
What are the alternatives to this skill?
The source does not compare this skill to other tools. Its references list crt.sh for certificate transparency, URLhaus and ThreatFox from abuse.ch, and PassiveTotal/RiskIQ for passive DNS and shared-IP pivots. Choose based on the data sources you can access.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Threat intelligence analysts and security engineers who already hold the relevant API keys and want a starting blueprint for automated pivoting will get the most from this skill. Users without those subscriptions, or anyone wanting a polished, tested product, should look elsewhere or plan significant review and testing first.
Download the skill