Threat Actor Profiling from OSINT
Builds structured threat actor dossiers from public intelligence sources and ATT&CK data
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can help build a profile of a hacker group from public information: vendor reports, paste sites, forums, code repositories, and threat feeds. It guides correlating indicators, mapping infrastructure with tools like Maltego and SpiderFoot, and organizing findings into a dossier covering motives, capabilities, infrastructure, and techniques mapped to MITRE ATT&CK. The included script also pulls MITRE ATT&CK group data to enrich a profile.
Great for
- Threat intelligence analysts writing adversary dossiers
- Security teams preparing for attribution discussions with public evidence
- Students learning how OSINT-based threat profiling is structured
Skip it if
- Attributing a live incident to a named actor without independent corroboration, since public-source attribution is uncertain and needs analytic review
- Gathering information on private individuals or targets, as social media and paste-site collection can raise privacy and legal concerns
Try asking
- “Build a threat actor profile for APT29 from public vendor reports and ATT&CK data”
- “Map the infrastructure and TTPs associated with a named ransomware group”
- “Create a STIX 2.1 threat actor bundle summarizing an adversary's aliases and techniques”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
building-threat-actor-profile-from-osint.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-threat-actor-profile-from-osint.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-threat-actor-profile-from-osint.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review the agent.py script before running it, since it downloads data and executes Python code on your machine
- Keep API keys in environment variables rather than hardcoding them, as the example code shows placeholder keys inline
- Treat OSINT-derived attribution as a hypothesis and document confidence levels and contrary evidence
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.