{ "$schema": "https://readbeforerun.ai/schema/entry.schema.json", "entry": { "id": "kevinmhorvath-threat-intel-toolkit", "name": "Threat Intel Toolkit", "summary": "Claude Code plugin with a subagent and two skills that triage IOCs and CVEs against free threat-intel feeds, without API keys.", "draft": "review", "type": "plugin", "mission": [ "defensive" ], "task": [ "threat-intel-enrichment", "vuln-prioritization" ], "domain": [ "threat-intelligence", "vulnerability-management" ], "runtime": [ "claude-code" ], "tier": "listed", "last_checked": "2026-10-21", "next_check": "2027-01-19", "freshness": "fresh", "superseded": false, "in_my_kit": null, "advice": null, "code_shows": "writes outside the project · runs shell commands or eval · Secrets: unknown", "source": { "repo": "https://github.com/kevinmhorvath/threat-intel-toolkit", "subpath": null, "commit": "8b5acb27c154eb31234a6ea505b9505b0a682fe6", "version": null, "license": "MIT" }, "install": { "skills_cli": null, "claude_code": null, "upstream": "/plugin marketplace add kevinmhorvath/threat-intel-toolkit\n/plugin install threat-intel-toolkit@threat-intel-marketplace", "bundled": false }, "scan": { "status": "static scan pending (not run)" }, "reach": { "method": "reach-v0.1", "level": 2, "level_source": "static", "level_label": "open", "unknown_axes": 1, "verdict": "not-run", "badge": "reach ≥2 · not run yet", "long": "reach ≥2 from code (open, 1 right unknown); lab: not run yet", "declared": { "fs": 2, "net": 1, "exec": 2, "cred": 0, "persist": 1 }, "static": { "level": 2, "fs": 2, "net": 1, "exec": 2, "cred": null, "persist": 1, "hitl": 0, "unknown": [ "cred" ] }, "observed": null, "surplus": null, "fit": null, "exports": { "aivss": { "fs": 0.5, "net": 0.5, "exec": 0.5, "cred": null, "persist": 0.5, "hitl": 0 }, "usf_risk_tier": "L2" } }, "profile": { "read_at": "8b5acb27c154eb31234a6ea505b9505b0a682fe6", "read_on": "2026-10-25", "overview": "Threat Intel Toolkit is a Claude Code plugin with a subagent and two skills for defensive IOC and vulnerability triage on free open-source threat feeds that need no API keys.", "purpose": [ "Answer whether any reputable free feed flags an indicator, and how strongly, as a defensive triage aid.", "Rate how ready-made the public exploit material for a CVE is, so defenders and pentesters can prioritize.", "Build or refresh a local blocklist from free, key-free open-source feeds." ], "use_cases": [ { "text": "Enrich a batch of IOCs pasted from a SIEM alert, firewall log, phishing email or incident timeline.", "task": "threat-intel-enrichment" }, { "text": "Rate exploit maturity and in-the-wild status of CVEs during vulnerability triage, patch prioritization or pentest scoping.", "task": "vuln-prioritization" }, { "text": "Check a URL from a suspicious email, where a hit on the phishing-domain feed carries the most weight.", "task": "email-phishing-analysis" }, { "text": "Write a Markdown and CSV report of indicator verdicts for a ticket, IR timeline or client folder.", "task": "alert-triage" } ], "maturity": null, "capabilities": [ { "name": "ti.py aggregate", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "ti.py lookup", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "ti.py feeds", "effects": [ "reads" ], "enabled": "default" }, { "name": "exploit-availability-check", "effects": [ "reads", "changes" ], "enabled": "default" }, { "name": "threat-intel-analyst", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default" }, { "name": "healthcheck.py", "effects": [ "reads" ], "enabled": "optional" }, { "name": "Fallback (no shell)", "effects": [ "reads" ], "enabled": "optional" } ], "effects": [ "reads", "changes", "runs-commands" ], "runs": "local-process", "listens": [], "sends_to": [ { "to": "CISA KEV and abuse.ch Feodo Tracker", "kind": "download", "when": "default" }, { "to": "blocklist.de and stamparm/ipsum", "kind": "download", "when": "default" }, { "to": "Emerging Threats and GreenSnow", "kind": "download", "when": "default" }, { "to": "Tor Project and SANS DShield", "kind": "download", "when": "default" }, { "to": "Spamhaus and Phishing.Database", "kind": "download", "when": "default" }, { "to": "FIRST EPSS (api.first.org)", "kind": "vendor-api", "when": "default" }, { "to": "cisa.gov, GitHub and GitLab", "kind": "download", "when": "default" }, { "to": "nomi-sec and trickest PoC indexes", "kind": "download", "when": "default" }, { "to": "Client web search", "kind": "other", "when": "optional" } ], "model": "client", "needs": [ { "kind": "runtime", "text": "Needs Python 3.8 or later; the scripts use the standard library and need no pip installs." }, { "kind": "runtime", "text": "Installs as a plugin from the repository's own single-plugin marketplace (.claude-plugin/marketplace.json and .claude-plugin/plugin.json)." }, { "kind": "other", "text": "ti.py needs network access to each feed URL to build its cache; each download uses urllib with a 90-second timeout." }, { "kind": "other", "text": "The first exploit check downloads about 35 MB of feeds into ~/.cache/exploit-availability-check, kept for 24 hours." }, { "kind": "other", "text": "Indicator lookups need a cache built first with ti.py aggregate, about 13 seconds for about 435k indicators." } ] }, "urls": { "page": "/catalog/kevinmhorvath-threat-intel-toolkit/", "json": "/entries/kevinmhorvath-threat-intel-toolkit.json", "md": "/catalog/kevinmhorvath-threat-intel-toolkit.md", "badge": "/badge/kevinmhorvath-threat-intel-toolkit.svg" } }, "data": { "schema_version": "0.5", "slug": "kevinmhorvath-threat-intel-toolkit", "name": "Threat Intel Toolkit", "summary": "Claude Code plugin with a subagent and two skills that triage IOCs and CVEs against free threat-intel feeds, without API keys.", "draft": "review", "in_my_kit": null, "type": "plugin", "mission": [ "defensive" ], "task": [ "threat-intel-enrichment", "vuln-prioritization" ], "domain": [ "threat-intelligence", "vulnerability-management" ], "phase": [ "def:identify", "def:detect" ], "role": [ "cti", "soc" ], "runtime": [ "claude-code" ], "auth": "none", "autonomy": null, "addresses": [], "frameworks": { "owasp_ast": [], "owasp_asi": [], "attack_tactic": [], "atlas": [] }, "source": { "repo": "https://github.com/kevinmhorvath/threat-intel-toolkit", "commit": "8b5acb27c154eb31234a6ea505b9505b0a682fe6", "license": "MIT", "manifest": "plugin.json", "also_listed": { "tenable-cyberagents-exchange": "https://github.com/tenable/cyberagents-exchange/blob/9d0ddf1fe8dc9651a0c461a2a27d33cb8a160a2c/agents/threat-intel-toolkit.md" } }, "upstream": { "checked_at": "2026-10-21", "updated_at": "2026-08-18", "current_release": null, "archived": false, "stars": 13, "commit_history": {}, "releases_since_pin": 0 }, "install": { "upstream": "/plugin marketplace add kevinmhorvath/threat-intel-toolkit\n/plugin install threat-intel-toolkit@threat-intel-marketplace", "upstream_evidence": "README.md#L84-85", "bundled": false }, "scan": [ { "tool": "cisco-skill-scanner", "version": "not-run", "llm_judge": false, "date": "2026-10-21", "result": "pending" } ], "privileges": { "method": "reach-v0.1", "declared": { "axes": { "fs": 2, "net": 1, "exec": 2, "cred": 0, "persist": 1 }, "evidence": { "fs": "skills/threat-intel-lookup/SKILL.md#L47 the author puts the indicator cache under ~/.cache, outside the working directory", "net": "README.md#L116-117 the author states the toolkit only reports what public feeds say and never contacts an indicator", "exec": "agents/threat-intel-analyst.md#L12 the shipped subagent lists the Bash tool without restriction", "cred": ".claude-plugin/plugin.json#L4 the author states that no API keys are required", "persist": "skills/exploit-availability-check/SKILL.md#L36 the author declares a 24-hour feed cache under ~/.cache" } }, "static": { "level": 2, "axes": { "fs": 2, "net": 1, "exec": 2, "cred": null, "persist": 1, "hitl": 0 }, "evidence": { "fs": "skills/threat-intel-lookup/scripts/ti.py#L51 the cache directory lies in the user's home, outside the working directory, and --report writes into any --out path", "net": "skills/threat-intel-lookup/scripts/ti.py#L182-183 requests go only to the fixed feed registry, and indicators supplied by the user are never fetched", "exec": "agents/threat-intel-analyst.md#L12 the subagent may use Bash without restriction, while the bundled scripts start no processes", "cred": "no evidence: the code reads no key or token, but the search patterns for secrets match one line in skills/threat-intel-lookup/SKILL.md, so a zero cannot be written", "persist": "skills/exploit-availability-check/scripts/exploit_check.py#L29 downloaded feeds stay in a cache under ~/.cache after the run", "hitl": "none found: patterns hitl-v0.1 in 8 files at 8b5acb2" }, "unknown": [ "cred" ] }, "min_config": { "status": "derived", "claude_code": "permissions.allow: [Read, Grep, Bash(python3 skills/*)]; keep other Bash calls and Write on ask, and pass --out with a case folder", "note": "derived from the code, not tested in the lab" }, "override": null, "reviews": [] }, "status": { "tier": "listed", "last_checked": "2026-10-21", "next_check": "2027-01-19", "freshness": "fresh", "superseded": false, "superseded_by": null, "added": "2026-10-21", "added_by": "scout" }, "evidence": { "runs": [], "badge": "/badge/kevinmhorvath-threat-intel-toolkit.svg" }, "changes": [] }, "profile": { "schema_version": "0.1", "entry": "kevinmhorvath-threat-intel-toolkit", "draft": "review", "commit": "8b5acb27c154eb31234a6ea505b9505b0a682fe6", "read_on": "2026-10-25", "check": { "date": "2026-10-25", "facts": 59, "confirmed": 59, "verified": 53 }, "overview": { "text": "Threat Intel Toolkit is a Claude Code plugin with a subagent and two skills for defensive IOC and vulnerability triage on free open-source threat feeds that need no API keys.", "ev": ".claude-plugin/plugin.json#L4 plugin description" }, "purpose": [ { "text": "Answer whether any reputable free feed flags an indicator, and how strongly, as a defensive triage aid.", "ev": "skills/threat-intel-lookup/SKILL.md#L18 question the lookup skill answers" }, { "text": "Rate how ready-made the public exploit material for a CVE is, so defenders and pentesters can prioritize.", "ev": "skills/exploit-availability-check/SKILL.md#L8 question the exploit skill answers" }, { "text": "Build or refresh a local blocklist from free, key-free open-source feeds.", "ev": "agents/threat-intel-analyst.md#L7 subagent description" } ], "use_cases": [ { "text": "Enrich a batch of IOCs pasted from a SIEM alert, firewall log, phishing email or incident timeline.", "task": "threat-intel-enrichment", "ev": "agents/threat-intel-analyst.md#L8 subagent description" }, { "text": "Rate exploit maturity and in-the-wild status of CVEs during vulnerability triage, patch prioritization or pentest scoping.", "task": "vuln-prioritization", "ev": "skills/exploit-availability-check/SKILL.md#L3 skill description" }, { "text": "Check a URL from a suspicious email, where a hit on the phishing-domain feed carries the most weight.", "task": "email-phishing-analysis", "ev": "skills/threat-intel-lookup/SKILL.md#L80 weighing feeds to context" }, { "text": "Write a Markdown and CSV report of indicator verdicts for a ticket, IR timeline or client folder.", "task": "alert-triage", "ev": "skills/threat-intel-lookup/SKILL.md#L88 --report deliverable" } ], "not_for": [ { "text": "Meant for defensive prioritization; the author states it never contacts, scans or attacks an indicator.", "ev": "README.md#L116-117 scope statement" }, { "text": "Does not write new exploit code, weaponize a PoC or give exploitation steps; it locates and rates already-public material.", "ev": "skills/exploit-availability-check/SKILL.md#L85 guardrail" }, { "text": "File hashes are out of scope, because the free hash feeds the author considered require an API key.", "ev": "README.md#L28 coverage statement" } ], "capabilities": { "coverage": "complete", "count": { "n": 2, "unit": "skills", "by": "author", "text": "The author states the plugin ships a subagent and two skills.", "ev": "README.md#L5 bundle contents" }, "groups": [ { "name": "ti.py aggregate", "does": "ti.py aggregate downloads and normalizes the registry feeds into the local cache; --refresh forces re-download, --only and --exclude select feeds by key.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "skills/threat-intel-lookup/scripts/ti.py#L582-587 aggregate subcommand and flags" }, { "name": "ti.py lookup", "does": "ti.py lookup checks IPs, domains, URLs and CVEs (defanged accepted) against the cache; --json prints machine-readable output and --report writes Markdown and CSV files to --out.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "skills/threat-intel-lookup/scripts/ti.py#L589-594 lookup subcommand and flags" }, { "name": "ti.py feeds", "does": "ti.py feeds lists the curated feed registry.", "effects": [ "reads" ], "enabled": "default", "ev": "skills/threat-intel-lookup/scripts/ti.py#L579 feeds subcommand" }, { "name": "exploit-availability-check", "does": "exploit_check.py reports in-the-wild status and a public exploit maturity tier per CVE from CISA KEV, FIRST EPSS, Metasploit, Nuclei, Exploit-DB, nomi-sec and trickest.", "effects": [ "reads", "changes" ], "enabled": "default", "ev": "skills/exploit-availability-check/scripts/exploit_check.py#L5-13 script docstring listing sources" }, { "name": "threat-intel-analyst", "does": "The threat-intel-analyst subagent is granted the Bash, Read, Write, Glob and Grep tools.", "effects": [ "reads", "changes", "runs-commands" ], "enabled": "default", "ev": "agents/threat-intel-analyst.md#L12 subagent tools" }, { "name": "healthcheck.py", "does": "One healthcheck.py per skill: the lookup one fetches and parses all 10 feeds; the exploit one checks that every source returns a known canary CVE (Log4Shell).", "effects": [ "reads" ], "enabled": "optional", "ev": "README.md#L100-106 health check description" }, { "name": "Fallback (no shell)", "does": "Without a shell, the exploit skill tells the model to fetch EPSS, nomi-sec, trickest and Nuclei per CVE with its fetch tool and to WebSearch KEV, Metasploit and Exploit-DB.", "effects": [ "reads" ], "enabled": "optional", "ev": "skills/exploit-availability-check/SKILL.md#L52 no-shell fallback" } ] }, "architecture": { "summary": { "text": "A subagent routes indicators to two skills: threat-intel-lookup, whose stdlib-only script ti.py aggregates 10 free feeds into a local SQLite cache and looks indicators up in it, and exploit-availability-check, which rates a CVE via KEV, EPSS, Metasploit, Nuclei, Exploit-DB and PoC aggregators.", "ev": "README.md#L7-15 description of subagent and both skills" }, "runs": { "where": "local-process", "text": "The exploit skill has the client's model run the bundled script scripts/exploit_check.py with the CVE IDs as a local process.", "ev": "skills/exploit-availability-check/SKILL.md#L36 instruction to run the bundled script" }, "modes": [ { "where": "local-program", "mode": "direct CLI", "switch": null, "text": "The user can run ti.py feeds, aggregate and lookup directly from a shell in skills/threat-intel-lookup/scripts.", "ev": "README.md#L57-61 quick start commands" }, { "where": "in-client", "mode": "no-shell fallback", "switch": null, "text": "Without a shell, the lookup skill tells the client's model to fetch a single feed with its web tool and search it.", "ev": "skills/threat-intel-lookup/SKILL.md#L92 no-shell fallback" } ], "parts": [ { "name": "threat-intel-analyst subagent", "zone": "client", "does": "Subagent definition named threat-intel-analyst.", "ev": "agents/threat-intel-analyst.md#L2 subagent name" }, { "name": "Skills (SKILL.md)", "zone": "client", "does": "The threat-intel-lookup and exploit-availability-check skills, usable directly or orchestrated by the subagent.", "ev": "README.md#L17-19 how the two skills relate" }, { "name": "ti.py", "zone": "machine", "does": "Stdlib-only Python engine; keeps raw feed bodies under ~/.cache/ti-aggregator/raw with a TTL and the parsed data in ~/.cache/ti-aggregator/ti.db.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L27-31 design notes on cache paths" }, { "name": "exploit_check.py", "zone": "machine", "does": "Python script that caches KEV, Metasploit, Nuclei and Exploit-DB locally and fetches EPSS, nomi-sec and trickest data live per CVE.", "ev": "skills/exploit-availability-check/scripts/exploit_check.py#L15-17 cache and live-fetch note" }, { "name": "Indicator feeds", "zone": "outside", "does": "Ten public feeds, among them CISA KEV, abuse.ch Feodo Tracker, Spamhaus DROP and Phishing.Database, supply indicator and CVE data.", "ev": "README.md#L23-25 covered feeds" }, { "name": "Exploit sources", "zone": "outside", "does": "CISA KEV, FIRST EPSS, Metasploit, Nuclei, Exploit-DB, nomi-sec and trickest supply exploit and in-the-wild data per CVE.", "ev": "skills/exploit-availability-check/SKILL.md#L14-22 source table" } ], "listens": [], "connections": [ { "to": "CISA KEV and abuse.ch Feodo Tracker", "kind": "download", "when": "default", "what": "ti.py downloads the CISA Known Exploited Vulnerabilities JSON and the abuse.ch Feodo Tracker IP blocklist during aggregate.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L64-72 feed registry entries" }, { "to": "blocklist.de and stamparm/ipsum", "kind": "download", "when": "default", "what": "ti.py downloads the blocklist.de list and the stamparm/ipsum level 3 list from raw.githubusercontent.com during aggregate.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L73-80 feed registry entries" }, { "to": "Emerging Threats and GreenSnow", "kind": "download", "when": "default", "what": "ti.py downloads the Emerging Threats compromised-IP list and the GreenSnow list during aggregate.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L81-88 feed registry entries" }, { "to": "Tor Project and SANS DShield", "kind": "download", "when": "default", "what": "ti.py downloads the Tor Project exit list and the SANS DShield block list during aggregate.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L89-97 feed registry entries" }, { "to": "Spamhaus and Phishing.Database", "kind": "download", "when": "default", "what": "ti.py downloads Spamhaus DROP netblocks and the Phishing.Database active phishing domains during aggregate.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L98-106 feed registry entries" }, { "to": "FIRST EPSS (api.first.org)", "kind": "vendor-api", "when": "default", "what": "exploit_check.py sends each CVE ID to the FIRST EPSS API and reads the exploitation probability.", "ev": "skills/exploit-availability-check/scripts/exploit_check.py#L150-153 EPSS request" }, { "to": "cisa.gov, GitHub and GitLab", "kind": "download", "when": "default", "what": "exploit_check.py downloads KEV from cisa.gov, Metasploit and Nuclei indexes from GitHub, and the Exploit-DB CSV from GitLab.", "ev": "skills/exploit-availability-check/scripts/exploit_check.py#L33-38 cached feed URLs" }, { "to": "nomi-sec and trickest PoC indexes", "kind": "download", "when": "default", "what": "exploit_check.py fetches nomi-sec and trickest PoC index files live for each CVE it assesses.", "ev": "skills/exploit-availability-check/scripts/exploit_check.py#L16-17 per-CVE live feeds" }, { "to": "Client web search", "kind": "other", "when": "optional", "what": "For a vulnerability given by name, the exploit skill has the model run a WebSearch for the name plus CVE to find its CVE IDs.", "ev": "skills/exploit-availability-check/SKILL.md#L31 name-to-CVE resolution step" } ], "model": { "who": "client", "text": "The subagent runs on the AI client's model; its definition sets model: sonnet and lists the client tools it uses.", "ev": "agents/threat-intel-analyst.md#L12-13 tools and model frontmatter" } }, "needs": [ { "kind": "runtime", "text": "Needs Python 3.8 or later; the scripts use the standard library and need no pip installs.", "ev": "README.md#L70 runtime requirement" }, { "kind": "runtime", "text": "Installs as a plugin from the repository's own single-plugin marketplace (.claude-plugin/marketplace.json and .claude-plugin/plugin.json).", "ev": "README.md#L80-81 plugin install statement" }, { "kind": "other", "text": "ti.py needs network access to each feed URL to build its cache; each download uses urllib with a 90-second timeout.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L181-184 feed download" }, { "kind": "other", "text": "The first exploit check downloads about 35 MB of feeds into ~/.cache/exploit-availability-check, kept for 24 hours.", "ev": "skills/exploit-availability-check/SKILL.md#L36 cache size and TTL" }, { "kind": "other", "text": "Indicator lookups need a cache built first with ti.py aggregate, about 13 seconds for about 435k indicators.", "ev": "agents/threat-intel-analyst.md#L45-48 cache workflow" } ], "installer": [ { "text": "Two Claude Code commands add the GitHub repository as the marketplace threat-intel-marketplace and install the threat-intel-toolkit plugin; the commands name no tag or commit.", "ev": "README.md#L83-86 install commands" }, { "text": "The README also mentions sharing the folder as a zip file or installing a skill on its own.", "ev": "README.md#L89-90 alternative distribution" }, { "text": "The author also keeps a standalone exploit-availability-check skill; since 1.1.0 its exploit_check.py is byte-identical to the copy bundled in this toolkit.", "ev": "CHANGELOG.md#L22-23 changelog entry on syncing the standalone and bundled copies" } ], "limits": [ { "text": "Indicator lookups read the local cache at ~/.cache/ti-aggregator/ti.db and do not go to the network.", "ev": "skills/threat-intel-lookup/SKILL.md#L47 cache behaviour" }, { "text": "The subagent is granted Bash, Read, Write, Glob and Grep; its description asks the host to use it proactively when the user drops an IP, domain, URL or CVE, even without the words threat intel.", "ev": "agents/threat-intel-analyst.md#L4-12 description and tools" }, { "text": "The author states that a CLEAN verdict is never a safety guarantee.", "ev": "README.md#L117 scope statement" }, { "text": "blocklist.de and GreenSnow are in the default feed set but publish no formal licence; the README shows how to exclude them.", "ev": "README.md#L50-52 licence note" }, { "text": "Before 1.1.0, when a source such as CISA KEV was unreachable and no local cache existed, exploit-availability-check reported it as not listed; since 1.1.0 such sources show as unknown.", "ev": "CHANGELOG.md#L10-18 fail-open fix" }, { "text": "The exploit skill tells the model to flag low-star GitHub PoC repos as possibly non-functional or malicious.", "ev": "skills/exploit-availability-check/SKILL.md#L86 guardrail" }, { "text": "exploit_check.py does not query Packet Storm, CXSecurity or 0day.today, which the author says have no open data feed.", "ev": "skills/exploit-availability-check/SKILL.md#L24 coverage note" }, { "text": "exploit_check.py takes every command-line argument that starts with CVE- as a CVE ID to assess.", "ev": "skills/exploit-availability-check/scripts/exploit_check.py#L418 argument filter" }, { "text": "The threat-intel-lookup skill triggers on its own whenever the user drops an IOC into the conversation.", "ev": "README.md#L12 author statement on skill auto-trigger" }, { "text": "When a feed download fails, ti.py reuses the previously cached copy of that feed and notes this on stderr.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L189-193 stale-cache fallback in fetch()" }, { "text": "ti.py defines the User-Agent threat-intel-lookup/1.0 (+defensive-ioc-triage) for its feed requests.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L55 User-Agent constant" }, { "text": "ti.py rates an indicator MALICIOUS when three or more feeds list it, SUSPICIOUS when one or two do and CLEAN when none does; a hit only on the Tor exit list gives CONTEXT and a CVE on CISA KEV gives EXPLOITED.", "ev": "skills/threat-intel-lookup/scripts/ti.py#L401-410 verdict_for thresholds by number of flagging feeds" } ], "not_found": [ { "field": "maturity", "searched": "README.md, CHANGELOG.md, .claude-plugin/plugin.json, .claude-plugin/marketplace.json for preview, experimental, alpha, beta, stable, deprecated" }, { "field": "listen", "searched": "skills/threat-intel-lookup/scripts/ti.py, skills/exploit-availability-check/scripts/exploit_check.py, both healthcheck.py for socket, bind, host, port, HTTP server; both use urllib client requests" }, { "field": "autonomy", "searched": "entry type is plugin; agents/threat-intel-analyst.md read for budget, scope or confirmation rules" } ] }, "verdict": null, "runs": [] }