implementing-threat-intelligence-platform 100/100

Is implementing-threat-intelligence-platform safe to install?

SaferSkills independently audited implementing-threat-intelligence-platform (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

implementing-threat-intelligence-platform/SKILL.md · 1 file

implementing-threat-intelligence-platform/SKILL.md1.6 KB · Markdown

name: implementing-threat-intelligence-platform

description: >-

Build a MISP-backed threat intelligence platform that ingests IOCs from multiple feeds,

correlates events with galaxy clusters, and enriches indicators via VirusTotal and AbuseIPDB.

Uses PyMISP to create events, add attributes with IDS flags, tag with MITRE ATT&CK techniques,

and export STIX 2.1 bundles for downstream SIEM consumption.

domain: cybersecurity

subdomain: threat-intelligence

tags: [implementing, threat, intelligence, platform]

version: "1.0"

author: mahipal

license: Apache-2.0

Instructions

Install dependencies: pip install pymisp requests stix2
Deploy MISP instance and generate an API key from Administration > Auth Keys.
Use PyMISP to connect and create threat intelligence events:

Create events with threat level, distribution, and analysis status
Add attributes (ip-dst, domain, sha256, url) with to_ids flags
Tag events with MITRE ATT&CK technique identifiers
Correlate events across organizations

Ingest from external feeds: URLhaus, Feodo Tracker, MalwareBazaar.
Enrich IOCs via VirusTotal and AbuseIPDB APIs.
Export correlated events as STIX 2.1 bundles.

python scripts/agent.py --misp-url https://misp.local --misp-key <api_key> --ingest-feeds --output misp_report.json

Examples

Create MISP Event with IOCs

from pymisp import PyMISP, MISPEvent, MISPAttribute
misp = PyMISP("https://misp.local", "api_key")
event = MISPEvent()
event.info = "Phishing Campaign - 2024-Q1"
event.threat_level_id = 2
event.add_attribute("ip-dst", "185.143.223.47", to_ids=True)
misp.add_event(event)

implementing-threat-intelligence-platform— agent skill

Is implementing-threat-intelligence-platform safe to install?

Instructions

Examples

Create MISP Event with IOCs

Audit the pieces. Scan the whole. Decide.