agentsclimarketplace
Sign in

Defanging and sharing iocs

Skill meltedinhex/analyst-ai-pack/skills/defanging-and-sharing-iocs

Prepares indicators of compromise for safe sharing: defanging URLs, domains, IPs, and emails so they cannot be accidentally clicked or resolved, and formatting them into STIX/CSV/MISP-friendly output. Activates for requests to defang IOCs, sanitize indicators for a report, or export indicators for sharing.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill defanging-and-sharing-iocs

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 466 tokens by cl100k_base, as published. Nobody here has run it

Defanging and Sharing IOCs

When to Use

  • You are about to put indicators in a report, ticket, chat, or email and must prevent accidental clicks or resolution.
  • You need to export indicators in a structured format for a sharing platform (MISP/STIX) or feed.
  • You are normalizing a messy indicator list before distribution.

Do not use raw, live indicators in any document a human or tool might auto-process — a clicked URL or auto-resolved domain can tip off the adversary or infect a reader.

Prerequisites

  • A list of extracted indicators (from the IOC-extraction skill) and the target sharing format.

Workflow

Step 1: Normalize the indicators

Deduplicate and canonicalize (lowercase domains, strip trailing dots) so the output is clean.

Step 2: Defang for safety

Apply standard defanging: http→hxxp, .→[.], @→[at], ://→[://]. This blocks hyperlinking and casual copy-paste resolution.

python scripts/analyst.py defang iocs.txt

Step 3: Classify and structure

Tag each indicator by type (url, domain, ipv4, email, hash) and emit a structured form (CSV or a minimal STIX-style bundle) for the target platform.

Step 4: Add context

Attach the source, first-seen date, confidence, and related ATT&CK technique so consumers can act on the indicator.

Validation

  • No output indicator is clickable or auto-resolvable (all are defanged).
  • Each indicator is correctly typed and deduplicated.
  • The structured export imports cleanly into the target platform.

Pitfalls

  • Defanging inconsistently, so some indicators remain live.
  • Sharing indicators without context (source, confidence), reducing their value.
  • Over-defanging hashes (no need) or mangling indicators so they cannot be re-fanged for use.

References

What ships with it: 3 files

3.6 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.