threat-actor-profiling

threat-actor-profiling is a Blue team & detection skill for AI agents, published by tsale in the awesome-dfir-skills repository on GitHub. Skillspace rates threat-actor-profiling F (45/100) and the safety scan rated it risky; the rating is based on static analysis only.

Risky. This skill has patterns associated with unsafe behaviour. Read the source carefully before running it.

Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map TTPs to MITRE ATT&CK for a specific group, or produce any intelligence deliverable about a threat actor. Also trigger when the user mentions threat actor names (e.g. APT29, Lazarus, FIN7), asks about victimology, modus operandi, or wants to structure threat intelligence around an adversary. This skill applies to both internal tracking profiles and incident-driven analytical deliverables.

Grade

F

Quality

45 / 100

Safety

Risky

GitHub stars

321

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.