Investigate public threat intelligence with ak:cti-expert

Use ak:cti-expert to investigate a permitted cyber-threat or open-source intelligence target through collection, enrichment, assessment, and reporting. It can connect public identifiers into a case graph, but every connection still needs source, confidence, and legal review before you act on it.

Choose ak:cti-expert for a bounded investigation

Use ak:cti-expert when

• You are reviewing your own or your organization's public exposure.
• You need to examine a domain, IP, email, username, phone number, image, or threat indicator using public sources.
• You need a cited timeline, relationship map, threat model, or intelligence report that keeps uncertainty visible.

Choose another workflow when

• You need a source-code security audit. Use ak:security.
• You only need a quick repository secret or dependency scan. Use ak:security-scan.
• The request involves unauthorized access, stalking, harassment, doxing, deception, or destructive testing. Do not run this Skill.
• You need legal findings or verified identity attribution. The Skill produces investigative leads, not legal conclusions.

Prepare the target and runtime

Before starting, confirm your authority, purpose, target boundary, allowed sources, retention rules, and whether tool installation or network collection is permitted. Use test or organization-owned identifiers in examples.

Run the Skill

This example asks for a full case on a domain you control and makes the evidence and authority boundary explicit.

/ak:cti-expert "Run a case on own-domain.example. Use public passive sources only, label inference, redact personal data, install nothing, and stop before contacting any account or system."

/ak:cti-expert "Run a case on own-domain.example. Use public passive sources only, label inference, redact personal data, install nothing, and stop before contacting any account or system."

$ak:cti-expert "Run a case on own-domain.example. Use public passive sources only, label inference, redact personal data, install nothing, and stop before contacting any account or system."

The packaged workflow also recognizes case operations such as /case, /sweep, /query, /progress, /validate, /coverage, /brief, and /report. Treat those as instructions inside the ak:cti-expert run, not as AgentKit Skill names.

Understand the observable stages

1. Acquire: collect public records and observations for the bounded target, recording the collection method and source.
2. Enrich: register discovered subjects, cross-reference identifiers, and add connections or timeline events without collapsing distinct identities.
3. Assess: score trust and confidence, preserve contested findings, check coverage, and identify blind spots.
4. Deliver: render a cited brief or report, relationship view, timeline, risk view, or saved workspace.

The default graph output is ASCII. Mermaid is available only when explicitly requested with --mermaid inside the workflow.

Keep approval, privacy, and inference bounded

• The source workflow may attempt to install missing CLI tools and may use browser, search, fetch, or direct network fallbacks. State install nothing or use an isolated environment unless those changes are authorized.
• --yolo removes prompts; it does not authorize scope expansion, provider accounts, paid services, credential use, active probing, or publication.
• Keep PRIMARY observations separate from DERIVED conclusions. A correlation is not identity proof, and absence from a source is not evidence of absence.
• Preserve contradictory evidence as contested. Do not select the more convenient claim without a documented basis.
• Reports and saved workspaces can contain sensitive case data. Review access, retention, encryption, and redaction before saving or sharing them.

Verify outputs and evidence

A reviewable run should report the target and scope, sources consulted, collection gaps, subjects and connections, finding type, trust score, confidence, timestamps, contradictions, and unresolved intelligence gaps. /validate and /coverage are workflow checks, not independent guarantees that a claim is true or that collection was complete.

/case, /report, and /brief are specified to save Markdown and DOCX reports in the current directory or ./osint-reports/ when that directory exists. Machine-oriented JSON, CSV, IOC, or connector exports are separate outputs. Confirm every reported file and open it before treating delivery as complete; DOCX generation depends on available Python and document-conversion tools.

Troubleshoot safely

Know the current limits

• Source availability, rate limits, anti-bot controls, network access, and tool versions can make coverage partial or stale.
• Search results, breach mentions, username matches, image similarity, and graph proximity do not by themselves prove identity, ownership, intent, or threat.
• The packaged Skill describes many provider and tool paths, but the release evidence does not prove every integration works end to end in every runtime.
• Stable and beta contain identical ak:cti-expert source and resources.

Continue with ak:security for a source-code threat review or ak:plan to schedule approved remediation.