How to use the Threat Intelligence OSINT agent skill

What the threat-intelligence skill makes the agent do

Once installed, the agent follows a fixed investigation method instead of answering from memory. It first defines a falsifiable intelligence question with a time window and result limit, then splits searches into small, repeatable query groups such as exact indicators of compromise (IOCs), aliases, campaign names and key phrases.

Every finding keeps its source metadata. Important claims must be checked against at least one independent source before they count as established. Public X/Twitter posts are treated only as leads.

• Turns a question about a domain, IP, URL, hash, email or wallet address into narrow, read-only queries.
• Records post URLs, author IDs, timestamps, the query that matched, and pagination state.
• Labels findings as lead, corroborated or confirmed, with stated confidence and known gaps.
• Hands detection work to threat-hunting, malware samples to malware-analysis, email to email-security, and case preservation to digital-forensics.

Install the skill: download the ZIP and unzip it

Download the ZIP for skills/threat-intelligence from the directory page, then unzip it into one of two locations. For a personal install available across projects, use ~/.claude/skills/. For a single project, use the project's .claude/skills/ folder.

In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: unzip into ~/.claude/skills/
• Project only: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Connect optional X/Twitter search (Xquik)

X/Twitter search is optional. The skill uses Xquik, an independent third-party service that is not affiliated with X Corp. The preferred route is the Xquik MCP remote connection (HTTPS with OAuth). The skill's bootstrap script only registers the remote URL https://xquik.com/mcp in an MCP client you explicitly choose. It does not install a local bridge, write keys, or start background services.

If you use REST instead, provide your key only through the XQUIK_API_KEY environment variable or an approved secret store. Do not put the key on a command line, in config files, or in reports.

• Default bootstrap mode (--mcp-host=none) changes no client configuration and returns registration-required.
• If OAuth is unavailable, the skill falls back to REST with the key from your secret store.
• Private reads, write actions, monitoring, webhooks and bulk jobs need explicit approval of target, duration and usage.

How to trigger the skill with natural requests

You do not need a special command. Describe a scoped public-source question that matches the skill's purpose. Include the target, the time window and the result limit, since the skill asks for these before it starts searching.

The skill is not for marketing, social listening for growth, or automated posting, and it will not attribute activity to a named person or group from social posts alone.

• "Check whether this domain appears in public phishing disclosures from the last 7 days. Stop after 20 results."
• "Find public reports linking this SHA-256 hash to a malware campaign alias. Show sources and confidence."
• "Investigate this impersonation account using only public posts and vendor advisories. Scope: brand impersonation, last 30 days."

Example: a scoped phishing-domain check

Suppose you want to know whether a domain appeared in public phishing disclosures. The skill first writes the question and the stop conditions, then runs query groups for the exact domain, the URL without protocol, brand plus phishing terms, and campaign aliases.

Stop conditions are either the result limit you set or two consecutive query groups that return no new candidates. Each candidate post is stored with its ID and URL, then checked against an independent source such as a vendor advisory or DNS record before it moves beyond lead status.