Best agent skills for threat intelligence
We found 264 agent skills for threat intelligence in the catalog; these are the 15 that rank highest. The order comes from our rank, which weighs adoption, freshness, documentation and publisher identity. Nobody can pay for a place on this list. attack-surface-recon, initial-access-phishing and recon-phase lead it. fsi-ransomware-detect and fsi-ransomware-protect are published by the company that makes them. attack-surface-recon comes from the largest repository here (8,008 stars). 10 of the 15 had activity in the last 30 days. Each entry lists why it made the list and links to its install page.
Updated Oct 26, 2026 · Built from catalog data; how we rank and grade
Top 15 of 264
- 1attack-surface-recon
AIPentest
侦察/攻击面测绘:被动whois/amass/crt.sh/FOFA/Shodan,主动subfinder/httpx/naabu/katana/nuclei,DNS地域/CDN/Nginx catch-all/宝塔/UniApp指纹。开局第一动作,认知写入项目黑板。Use when starting recon…
- Largest repository here (8,008 stars)
- Active in the last 30 days
- Open source (Apache-2.0)
★ 8KLast active Oct 16, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 2initial-access-phishing
AIPentest
初始访问/钓鱼/社工:凭据喷洒,AiTM,设备码,OAuth同意钓鱼,载荷,vishing。Use when needing initial access, phishing, AiTM, device code, or social engineering.
- Largest repository here (8,008 stars)
- Active in the last 30 days
- Open source (Apache-2.0)
★ 8KLast active Oct 16, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 3recon-phase
s0ld13rr
Reconnaissance phase — passive OSINT then active enumeration.
- Active in the last 30 days
- Open source (MIT)
★ 883Last active Oct 23, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 4playbook-social-engineering
s0ld13rr
Social engineering assessment — phishing campaigns, vishing, physical tests, GoPhish setup.
- Active in the last 30 days
- Open source (MIT)
★ 883Last active Oct 23, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 5researchers-security
bitwize-music-studio
Researches malware analysis, CVEs, attribution reports, and hacker community sources.
- Active in the last 30 days
- Open source (CC0-1.0)
★ 585Last active Oct 13, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 6yara-rule-authoring
trailofbits
Guides authoring of high-quality YARA-X detection rules for malware identification.
- Repository has 7.8K stars
- Active in the last 30 days
- Open source (CC-BY-SA-4.0)
★ 7.8KLast active Oct 14, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 7transilience-report-style
transilienceai
Generate a Transilience-branded PDF report (pentest, vuln assessment, compliance, threat intel) from a single findings JSON using the bundled ReportLab…
- Open source (MIT)
- Ships helper scripts
- For Python
★ 591Last active Jul 28, 2026Claude Code, Claude apps, Codex, Cursor +6
BFreshness: B–Security: not graded yet - 8intelligence-collection-disciplines
deanpeters
Run competitive research like an intelligence agency: eight collection disciplines (OSINT to MASINT), signal-to-inference chains, and fusion.
- Repository has 7.6K stars
★ 7.6KLast active Aug 10, 2026Claude Code, Claude apps, Codex, Cursor +6
BFreshness: B–Security: not graded yet - 9problem-framing-canvas
deanpeters
Guide teams through MITRE's Problem Framing Canvas.
- Repository has 7.6K stars
★ 7.6KLast active Aug 10, 2026Claude Code, Claude apps, Codex, Cursor +6
BFreshness: B–Security: not graded yet - 10fsi-ransomware-detect
aws-jp-fsi-saOfficial
Provides design/assessment support for the detection/analysis aspect of ransomware countermeasures on AWS, for financial services organizations.
- Published by the vendor
- Active in the last 30 days
- Open source (MIT-0)
★ 15Last active Oct 15, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 11fsi-ransomware-protect
aws-jp-fsi-saOfficial
Provides architecture design and evaluation support for ransomware-resilient backup environments on AWS, for financial services industry organizations.
- Published by the vendor
- Active in the last 30 days
- Open source (MIT-0)
★ 15Last active Oct 15, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 12ctf-category
Encod3d-Sec
CTF challenge router - fingerprint a challenge (file type / prompt / artifacts) into its category (pwn, rev, crypto, forensics, stego, web, osint, hash) and…
- Open source (MIT)
★ 335Last active Aug 19, 2026Claude Code, Claude apps, Codex, Cursor +6
BFreshness: B–Security: not graded yet - 13wiki-recon
Encod3d-Sec
External recon and OSINT pipeline - subdomain enum, live host discovery, URL crawl, JS analysis, nuclei scan.
- Open source (MIT)
★ 335Last active Aug 14, 2026Claude Code, Claude apps, Codex, Cursor +6
BFreshness: B–Security: not graded yet - 14network-penetration-testing
langbyyi
网络渗透测试/红队攻击链深度专业技能（资深攻防专家版 v3.0）：红队攻击链整体规划与MITRE ATT&CK TTP映射、目标建模与决策树、高级外网打点(钓鱼联动/供应链/云资产入口)、隧道代理与C2隐蔽、内网信息收集与BloodHound CE图分析、AD域渗透深化(Kerberoast/DCSync/ADCS…
- Active in the last 30 days
- Open source (Apache-2.0)
★ 131Last active Oct 16, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 15virustotal
taracodlabs
Check file hashes, URLs, domains, and IP addresses against 70+ antivirus engines and threat intelligence feeds via VirusTotal
- Active in the last 30 days
- Open source (Apache-2.0)
- Ships helper scripts
★ 863Last active Oct 19, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet