Why use it: know in advance what you lose without a key instead of discovering it mid-case, and keep the two types of cost separate so you don't mix them up.
What it produces: an .env at the repo root, and the habit of running capabilities before every case.
It still runs without a key — that's by design
Run for real in a clean clone, no .env:
python3 scripts/backend/intel.py capabilities
WebPivot capability — mode: KEYLESS
[absent ] FOFA_KEY — FOFA [critical] (metered: costs credits) LOST: ... favicon hash or GA4 ID can be EXTRACTed but not REVERSEd, so the sibling domains sharing them never surface. An empty cluster in keyless mode is NOT evidence of a small operator. instead: crt.sh + Shodan CTL, anonymous urlscan, and the Censys/PublicWWW/Shodan query strings emitted for the analyst to paste into the web UI get one: https://en.fofa.info/ ...
Đọc kỹ dòng `LOST:` — nó chính là thứ báo cáo của bạn **phải khai** khi kết luận "không tìm thấy liên kết". Đây là chỗ khác biệt giữa "đã tìm và không có" với "không có công cụ để tìm".
## Đặt key
```bash
cd ~/.claude/skills/cti-expert
cp .env.example .env
$EDITOR .env
.env is located in repo root (same level as SKILL.md), already gitignored. The variables are in .env.example (23 keys + INTEL_HOME):
| Group | Variable |
|---|---|
| Internet-scan | SHODAN_API_KEY, CENSYS_API_KEY / CENSYS_ORG_ID / CENSYS_API_ID, FOFA_KEY + FOFA_EMAIL, QUAKE_API_KEY, ZOOMEYE_API_KEY, URLSCAN_API_KEY |
| DNS / cert / WHOIS | SECURITYTRAILS_API_KEY (+ _FALLBACK), WHOISXML_API_KEY, CERTSPOTTER_API_KEY, ZONECRUNCHER_API_KEY, DNSLYTICS_API_KEY |
| Leak / scam feed | HUDSONROCK_API_KEY, CHONGLUADAO_API_KEY, INTELX_API_KEY |
| On-chain | BLOCKCHAIR_API_KEY, SUBSCAN_API_KEY |
| Other | GITHUB_TOKEN, SERPAPI_KEY, BRIGHTDATA_SERP_KEY |
| Override the path | INTEL_HOME (only when you want to use a shared KB outside the repo) |
After filling in, rerun capabilities — the mode must change away from KEYLESS and the [absent] lines for the corresponding variables disappear.
The WhoisXML trap (already diagnosed in code)
Whois History and Reverse WHOIS are charged to the Domain Research Suitewallet, not the WHOIS API wallet. A key with WHOIS credits but DRS at 0 will return 200 for current WHOIS and 403 for the other two. whois_enrich._explain_403 says this outright — don't conclude the key is broken (CLAUDE.md, section Cost visibility).
Two cost ledgers, don't merge them
| Ledger | Who spends | Read via |
|---|---|---|
| Anthropic model cost | the agent's reasoning loop | /cost in Claude Code (interactive); the SDK harness logs total_cost_usd per phase |
| Third-party API credit | pivot_extract, whois_enrich, FOFA/urlscan/Shodan/IPinfo... — 0 Anthropic calls |
python3 scripts/backend/intel.py api-usage |
Written to intel_engine/MEMORY/api_usage.jsonl (change location with $API_USAGE_LOG). When reporting cost, state the two parts clearly — total_cost_usd does not include API credit.
Check the budget before spending
python3 scripts/backend/intel.py censys # có sub-lệnh keycheck/budget
python3 scripts/backend/intel.py api-usage # đã tiêu bao nhiêu, ở đâu
Censys free plan: each search in the UI deducts 5 of 100 monthly credits — so the CenQL query builder runs offline and only emit the query string + link, so that clicking is a conscious decision rather than a default.
Suggested order of operations
capabilities→ know where you're blind.- Only buy/fill in key for the blind spot that actually blocks the case at hand (read the column
[critical]/[high]). capabilitiesagain → confirm.- After the case:
api-usage→ know what was spent.