Cti Expert plugin for Grok Build
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
How to install Cti Expert in Grok Build
grok plugin install 7onez/cti-expert --trustReview before you trust it. --trust lets this plugin's hooks, MCP servers and scripts run code on your computer. It's a community repo that neither xAI nor GrokStacks has reviewed, so read its code first.
Security tool. Use it only on systems you own or are authorized to test.
Then start a new Grok session, or press r in /plugins, to load it.
Command format: Grok Build's plugin guide
Runs a local MCP server (with npx, uvx or similar), so that tool needs to be installed, for example Node.js for npx.
What we checked: on Oct 18, 2026 it installed with grok 1.0.62 and Grok found 10 skills, 9 slash commands. That's an install check only: we haven't run it in a live Grok session.
What it contains
Skills (10)
cti-expert— Cyber threat intelligence and OSINT analysis toolkit. Runs structured investigations and delivers analyst-grade intelligence products with sourced, trust-scored findings. Use for OSINT and CTI cases, digital-footprint and exposure review, dcti-case— Run the full deterministic pipeline on one or more seeds: collect, ingest, prior-overlap, risk, cluster, ICD-203 assessment. Usage: /cti-case <CASE-ID> <seed> [seed...]cti-check— False-positive control — is this indicator a real operator link or shared noise? Run BEFORE clustering on anything. Usage: /cti-check <indicator>cti-cluster— Expand and correlate an existing case — peers, shared indicators, TLS overlap, reverse-WHOIS. Usage: /cti-cluster <domain|CASE-ID>cti-pivot— Collect pivot artifacts from ONE target — favicon, trackers, wallets, emails, CORS, mail/SPF/DMARC, WHOIS, co-tenancy. Usage: /cti-pivot <url|domain|ip> [--passive]cti-proxy— Manage the egress proxy / rotation pool for the skill's HTTP(S) requests (keyless crt.sh, Wayback, urlscan, CLD, WHOIS, /apikeys test; raw TLS/JARM probes need a SOCKS proxy). Add one proxy or a rotation pool, choose a policy, test, or princti-recall— Have I seen this before? Check a seed against every prior case BEFORE collecting. Always run this first. Usage: /cti-recall <domain|indicator>cti-report— Render case deliverables — relationship graph (PNG/SVG/Mermaid) and a polished PDF/DOCX assessment. Usage: /cti-report <CASE-ID> [--graph|--pdf]cti-status— Health check — backend tier, case store, MCP tools, API credit balances. Run this when something behaves oddly. Usage: /cti-statuscti— THE ENTRY POINT for cti-expert. Investigate any target — domain, IP, email, username, phone, wallet, hash or APK. Routes to the right chain automatically. Usage: /cti <target> [--deep|--quick|--passive]
MCP servers (1)
intel— stdio server
Hooks (1)
hooks— PreToolUse, SessionStart
About this listing
Cti Expert is a community plugin on GitHub by 7onez, written as a Claude Code plugin that Grok Build installs. We install-checked it in Grok; we haven't run it in a live session or reviewed its code. When we installed it, Grok found 10 skills, 1 MCP server, 1 hook. No license stated in the repo, so check with the author before reusing its code. We checked commit a7ca9b763be8. It's one of 79 listings in the Security category on GrokStacks.
Stacks Weekly: every new Grok Build and Codex plugin, every Tuesday.
One short email for GrokStacks and CodexStacks readers, with each new plugin's install line and what it ships. Subscribe and get the free starter list: 20 Grok Build plugins worth installing first.
You'll get a confirmation email first. Unsubscribe anytime.
Cti Expert FAQ
How do I install Cti Expert in Grok Build?
Run grok plugin install 7onez/cti-expert --trust. We install-checked this command in Grok Build. Then start a new Grok session, or press r in /plugins, to load it.
Is Cti Expert an official Grok Build plugin?
No. Cti Expert is a community plugin on GitHub by 7onez, not in xAI's official Grok Build marketplace. We checked that it installs and what Grok loads from it, but haven't run it in a live Grok session or reviewed its code.
What does Cti Expert include?
According to what Grok loaded in our install check, Cti Expert includes 10 skills, 1 MCP server, 1 hook: cti-expert, cti-case, cti-check, cti-cluster, cti-pivot, cti-proxy….
Details
- Type
- Plugin
- Category
- Security
- Source
- Community Claude Code plugin, installs in Grok
- License
- No license stated
- Author
- 7onez
- Version
- 2.12.0
- Keywords
- claude-code, claude-code-skill, cti, cyber-threat-intelligence, digital-forensics, investigation, mcp-server, osint, osint-tool, reconnaissance, security, threat-intelligence
- Source repo
- https://github.com/7onez/cti-expert
- Checked commit
a7ca9b763be8- Homepage
- https://chongluadao.vn
- Checked by GrokStacks
- Install-checked in Grok Build on Oct 18, 2026; not run in a live session
Something wrong or missing? Submit or improve this listing. Marketplace listings also refresh automatically every night.
For maintainers: badge and embeds
Maintain Cti Expert? Add the badge; it links to this page.
Markdown
[](https://grokstacks.com/p/cti-expert/)HTML
<a href="https://grokstacks.com/p/cti-expert/"><img src="https://grokstacks.com/badge.svg" alt="Listed on GrokStacks" width="164" height="28"></a>Embed card (static HTML and inline CSS, no JavaScript). Preview:
<a href="https://grokstacks.com/p/cti-expert/" style="display:block;max-width:380px;box-sizing:border-box;padding:14px 16px;border:1px solid #2a2e3c;border-radius:12px;background:#0a0b0f;color:#e8eaf0;font:14px/1.45 -apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;text-decoration:none"><span style="display:block;font-size:16px;font-weight:700;color:#e8eaf0">Cti Expert</span><span style="display:block;margin:2px 0 8px;font-size:12px;color:#9aa0b1">Community plugin for Grok Build · 10 skills, 1 MCP server, 1 hook</span><span style="display:block;margin:0 0 10px;color:#c9cdd8">CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques…</span><span style="font-size:12px;font-weight:600;color:#7c9cff">View on GrokStacks →</span></a>Markdown summary
**[Cti Expert on GrokStacks](https://grokstacks.com/p/cti-expert/)**: Community plugin for Grok Build with 10 skills, 1 MCP server, 1 hook. Install: `grok plugin install 7onez/cti-expert --trust`More on badges, embeds and keeping your listing up to date: GrokStacks for plugin authors.
Also in Security
Aaron Marketing Skills
120 marketing skills as an AI marketing staff — plugin, portable skills, or an 8-bot team across 7 disciplines (narrative, SEO/GEO, social, email, paid, influencer, launch) on one contract, with 8 auditor gates: TALE · CORE-EEAT · CITE · ECHO · SEND · ROAS · STAR · RAMP.
Adrian
Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.
Agent Beacon
The cross-harness, self-improving memory layer for AI agents. Join our community: https://discord.com/invite/zdNChS2fBu
Agent Governance Toolkit
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
Agentguard
Security guard for AI agents — blocks malicious skills, prevents data leaks, protects secrets. 24 detection rules, runtime action evaluation, trust registry.
Android Reverse Engineering Skill
Claude Code skill to support Android app's reverse engineering