Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
A threat intelligence analyst skill that monitors cybersecurity and cognitive security RSS feeds, scores items against a personalized interest profile, and delivers scheduled briefings. Covers CVEs, exploit drops, malware campaigns, and influence operations. Provides on-demand deep-dive analysis with MITRE ATT&CK and DISARM framework mappings.
Combines cyber and cognitive security monitoring with personalized relevance scoring in one place, replacing manual checks across 20+ feeds with a single briefing filtered to what actually matters to you.
When to use it
- Getting a scored morning briefing of overnight CVEs filtered to your skill level and interests
- Deep diving on a specific CVE to understand exploit mechanics and find public PoC code
- Tracking active influence operations mapped to DISARM framework techniques
- Receiving an immediate alert when a 0-day scores above 0.9 against your interest profile
- Getting study recommendations based on what appeared in today's threat feed
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: threat briefing
- 1Fetch RSS feeds from configured sources using web_fetch
- 2Parse entries and deduplicate against stored URL hashes in memory
- 3Score each new item 0.0-1.0 against the operator's stored interest profile
- 4Categorize items into CRITICAL ALERT, EXPLOIT DROP, MALWARE, INFLUENCE OP, and other types
- 5Format and deliver briefing with scored items, ATT&CK or DISARM technique tags, and a study recommendation
Formatted intelligence briefing with critical and high-relevance items ranked by score, technique mappings, and a personalized study suggestion based on the day's feed