Quick Ref / Command
Engineer Kit
/ak:cti-expert
Cyber threat intelligence and OSINT analysis for exposure reviews, recon, breach checks, forensics, cloud tenant recon, threat modeling, and structured reports.
Acquire
Enrich
Assess
Deliver
Rule 01
Use public data only and preserve legal/ethical boundaries.
Rule 02
Every claim needs a source, trust score, and confidence level.
Rule 03
Tool limitations are collection gaps, not case blockers.
Rule 04
ASCII visualizations are the default for portable reports.
Rule 05
Deliver Markdown and DOCX for reports and briefs unless the format is machine-only.
Core lanes from input to output, aligned with the command's real execution path.
Start
Input, scope, route
Work
Agent / skill execution
Verify
Gate, review, validation
Close
Report, handoff, artifact
How to invoke the skill: syntax, positional arguments, shared options, then each subcommand with its own syntax and outcome.
Syntax
/ak:cti-expert [target] [--yolo] [--sequential] [--format html] [--no-antv|--no-diagram-design|--no-editorial-visuals][target] Investigation target
Permitted public identifier such as a domain, IP, email, username, phone number, image, organization, CVE, or threat indicator. Keep authority, purpose, allowed sources, retention, and contact boundaries explicit.
/ak:cti-expert "Run a case on own-domain.example. Use public passive sources only, label inference, redact personal data, install nothing, and stop before contacting any account or system."--yolo Skip prompts
Runs without clarification or confirmation prompts. It does not approve new scope, paid providers, credential use, active probing, dependency installation, or publication.
--sequential Disable parallel enrichment
Disables packaged parallel enrichment. Case operations such as /case, /sweep, /query, and /flow run inside the CTI workspace; they are not AgentKit skill flags.
--format html HTML mirror
Adds an optional self-contained HTML mirror beside the default Markdown and DOCX auto-save. Docs do not document --format md as a skill flag.
case Full case /case [target] Run the full case pipeline inside the CTI workspace for the supplied target.
Outcome: Cited findings, subject graph, confidence and coverage notes, and saved Markdown plus DOCX reports when conversion tools are available.
/case example.com sweep Multi-vector sweep /sweep [target] Collect broad public records and observations for any target type.
Outcome: Raw leads with collection method, source, confidence, and collection gaps recorded.
/sweep @username query Operator queries /query [subject] Generate advanced search-operator queries for public-source collection.
Outcome: A query set ready for acquire-stage collection, with uncertainty and source limits preserved.
/query example.com flow Guided flow /flow [type] Start the first-time guided workflow for a target category.
Outcome: Step-by-step prompts that keep purpose, sources, confidence, and safety checks explicit.
/flow person progress Progress /progress Show the current case phase and what remains pending.
Outcome: Current acquire, enrich, assess, or deliver status with pending work.
/progress validate Validate findings /validate Audit case quality and evidence completeness; it is a workflow check, not proof that every claim is true.
Outcome: Quality score and issues to revisit before final delivery.
/validate coverage Coverage matrix /coverage List sources, target areas, and blind spots that were or were not covered.
Outcome: Coverage matrix with collection gaps recorded as limitations.
/coverage brief Brief /brief Produce a plain-language summary for non-technical readers.
Outcome: Concise cited brief, saved as Markdown and DOCX when conversion tools are available.
/brief report Report export /report [brief|json|csv|legal|journalist|ioc] Export the case in the selected report format.
Outcome: Selected report artifact with citations, confidence, contradictions, and unresolved gaps. Markdown and DOCX are saved for narrative reports; machine exports are separate.
/report legal render Render view /render <entities|timeline|risk|network|threat-path|attack-surface> Render a portable ASCII relationship, timeline, risk, network, threat-path, or attack-surface view unless Mermaid is explicitly requested.
Outcome: ASCII visualization suitable for Markdown and DOCX reports.
/render entities workspace Workspace /workspace <save|open|list|diff> [name] Save, resume, list, or compare CTI case workspaces.
Outcome: Case state is saved, resumed, listed, or compared without changing the evidence requirements.
/workspace save mycase Only flags that change the artifact or publish it. Not the full option set.
--no-antv Disable AntV
Disable preferred AntV chart rendering for HTML mirrors.
Example
/ak:cti-expert own-domain.example --format html --no-antv --no-diagram-design Disable diagram-design
Disable diagram-design layouts for HTML diagrams.
Example
/ak:cti-expert own-domain.example --format html --no-diagram-design --no-editorial-visuals Disable editorial visuals
Disable editorial visual enhancements for HTML output.
Example
/ak:cti-expert own-domain.example --format html --no-editorial-visuals Concrete invocations for each flag, subcommand, mode, or route available in the live workflow.
/ak:cti-expert "Run a case on own-domain.example. Use public passive sources only."/ak:cti-expertown-domain.example--sequential
/ak:cti-expertown-domain.example--formathtml
/ak:cti-expertown-domain.example--yolo
/sweep @username
/report legal
CTI report package
Pattern
OSINT-REPORT-[CASE-ID]-[YYYY-MM-DD].md + .docx; optional CTI-REPORT-[CASE-ID]-[YYYY-MM-DD].html mirror Reports preserve narrative evidence, structured JSON for charts, source citations, confidence, gaps, and recommendations.