agentsclimarketplace

Enriching iocs with threat intel sources

Skill meltedinhex/analyst-ai-pack/skills/enriching-iocs-with-threat-intel-sources

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill enriching-iocs-with-threat-intel-sources

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Enriches indicators with context from threat-intel sources: planning lookups against reputation, passive DNS, WHOIS, and sandbox/sample databases, scoring confidence, and avoiding operational-security mistakes that tip off adversaries. Activates for requests to enrich IOCs, add threat context, or plan indicator lookups safely.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.2 KB, 530 tokens by cl100k_base, as published. Nobody here has run it

Enriching IOCs with Threat Intel Sources

When to Use

  • You have atomic indicators and need context: reputation, related infrastructure, first/last seen, and known associations.
  • You are scoring indicator confidence before acting or reporting.
  • You must plan lookups without leaking your investigation to the adversary.

Do not use active interaction (visiting a C2 URL, resolving a live domain from your own network) for enrichment — use passive sources to avoid tipping off the adversary.

Prerequisites

  • Defanged indicators (from the defanging skill) and access to enrichment sources/APIs.
  • Awareness of each source's operational-security implications.

Safety & Handling

  • Prefer passive sources (passive DNS, sample DBs, reputation feeds) over active probing.
  • Never submit a customer/internal sample to a public sandbox without authorization — it becomes publicly retrievable and can expose sensitive data.

Workflow

Step 1: Group indicators by type

Separate hashes, domains, IPs, and URLs; each maps to different enrichment sources.

Step 2: Plan the right lookups

Map each type to passive sources: hashes → sample/AV databases; domains → passive DNS, WHOIS, reputation; IPs → ASN/geo, passive DNS, reputation; URLs → URL reputation/sandbox history.

python scripts/analyst.py plan iocs.json

Step 3: Score confidence

Combine source agreement, age, and prevalence into a confidence score; a single hit on one feed is weaker than corroboration across independent sources.

Step 4: Annotate and pivot

Attach context (first seen, related infrastructure, family) and pivot on strong links (shared registrant, hosting, certificate) to expand the picture.

Step 5: Record provenance

Note which source provided each piece of context and when, so the enrichment is auditable and re-checkable.

Validation

  • Each indicator is routed to type-appropriate, passive sources.
  • Confidence reflects corroboration across independent sources, not a single feed.
  • Every enrichment carries source and timestamp provenance.

Pitfalls

  • Actively resolving/visiting live infrastructure and alerting the adversary.
  • Uploading sensitive samples to public services, leaking data.
  • Treating one feed's verdict as ground truth without corroboration.

References

What ships with it: 3 files

3.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Gives 0 of the 12 instructions most plan spec skills give in 530 tokens

Counted across 1,099 of the 1,860 authors here whose files we hold, read 2026-08-07

  • Ask one question at a timein 51 of 1099
  • Break plans into vertical slicesin 29 of 1099, across 11 files
  • Publish issues in dependency orderin 27 of 1099, across 9 files
  • Iterate until user approves the breakdownin 25 of 1099, across 7 files
  • Explore the repository to understand the codebase statein 24 of 1099, across 7 files
  • Use domain glossary vocabularyin 23 of 1099, across 5 files
  • Apply correct triage labels to published issuesin 23 of 1099, across 5 files
  • Prefer AFK slices over HITLin 22 of 1099, across 7 files
  • Write a specification before writing any codein 22 of 1099, across 14 files
  • Write failing tests before implementation codein 22 of 1099, across 20 files
  • Ask clarifying questions until requirements are concretein 21 of 1099, across 13 files
  • Respect existing architecture decision recordsin 20 of 1099, across 5 files

Said here and by no other author read

  • group indicators by type
  • map each type to passive sources
  • plan indicator lookups
  • score confidence from source agreement
  • annotate indicators with context
  • pivot on strong links

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 327,167. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.