dym-cti-expert-cli-dispatcher

Skill: dym-cti-expert-cli-dispatcher — Dispatcher CLI: intel.py (TERMINAL ONLY)

Every command in this file is a SHELL command. Pasting it into Claude Code chat only produces text. The chat version is in 03-investigate-in-claude-code.md.

Why use it: run one specific tool, automate scripts, or work without an agent. What it produces: stdout (usually with --json), files in the case store, and exit codes for branching.

One entry point for 121 operations

cd ~/.claude/skills/cti-expert
python3 scripts/backend/intel.py list       # bản đồ đầy đủ, mỗi op một dòng mô tả
python3 scripts/backend/intel.py --help     # docstring + ví dụ

intel.py list prints the backend tier, then 121 operations. This number is counted directly from the table named DISPATCH (scripts/backend/intel.py:70), rather than from the documentation:

python3 -c "import sys; sys.path.insert(0,'scripts/backend'); import intel; print(len(intel.DISPATCH))"
# 121

The runner recommended in the docstring is uv run intel.py <op>, but the dispatcher uses only the standard library, so python3 works the same way.

`--dry-run` — inspect the actual command before spending credits

python3 scripts/backend/intel.py --dry-run pipeline open CASE-0001 seeds.txt

Prints the exact command to be run, including cd (cwd matters because the engine uses relative paths):

cd <repo>/intel_engine && <python> <repo>/intel_engine/tools/intel.py open CASE-0001 seeds.txt

Use it whenever you are unsure which script an operation maps to. The flag must appear before the operation name (-n is an alias).

Exit codes — read from `return` statements with literal values

rc	Meaning	Action
`0`	success (or the engine script's exit code passed through)	—
`2`	operation absent from `DISPATCH`	`intel.py list` to find the correct name
`3`	backend not found (Tier 3 / stateless)	set `$INTEL_HOME`, or run from a location containing `intel_engine`
`4`	backend resolved, but the component's script is missing	component not installed
`5`	cannot execute the interpreter (or `mcp --write` encounters an existing file without `--force`)	set `$INTEL_PY`
`130`	Ctrl-C	—

Do not assume 0/1. For operations outside these five cases, intel.py returns the engine script's unmodified returncode — that script's code, not the dispatcher's (scripts/backend/intel.py:495).

Quick check:

python3 scripts/backend/intel.py nosuchop; echo "rc=$?"   # rc=2

Local-only operations — no network, no keys, ready to run

This group is safe to try immediately after cloning:

# Hash này là file hash hay credential? Chặn trước khi bạn nộp lên sandbox công khai.
python3 scripts/backend/intel.py hash-id 5f4dcc3b5aa765d61d8327deb882cf99

Actual output:

1 hash(es): 0 safe to submit, 1 blocked
  ⛔ 5f4dcc3b5aa765d61d8327de… → AMBIGUOUS: could be a FILE hash or CREDENTIAL material —
     treat as credential until the source is known. Re-run with --context file|credential …
{"results": [...], "summary": {"total": 1, "submittable": 0, "blocked": 1}}

Other local-only operations:

python3 scripts/backend/intel.py sensitive-paths --help    # phân loại URL theo mẫu đường dẫn nhạy cảm
python3 scripts/backend/intel.py email-permute --help      # tên/handle → email CANDIDATES (giả thuyết)
python3 scripts/backend/intel.py noise <indicator>         # chỉ dấu này là hạ tầng dùng chung?
python3 scripts/backend/intel.py capabilities              # key nào có, thiếu thì mất gì
python3 scripts/backend/intel.py email-hygiene <domain>    # điểm 0-100 + hạng A-F

email-permute generates hypotheses, never findings — its own docstring says so. Reporting a permuted email address as fact is a tradecraft error, and the repository has a dedicated test against it.

Three commands that are not operations

python3 scripts/backend/intel.py list                  # bản đồ op
python3 scripts/backend/intel.py mcp                   # in khối .mcp.json (không ghi)
python3 scripts/backend/intel.py mcp --write [--force] # ghi ./.mcp.json
python3 scripts/backend/intel.py cases                 # liệt kê case trong store
python3 scripts/backend/intel.py cases <NAME>          # cây file của một case
python3 scripts/backend/intel.py cases --path [NAME]   # chỉ in đường dẫn (để script hoá)

Operations requiring `.venv` — NOT ACTUALLY RUN in this survey

Operation	Requires
`harness open/continue/status`	`claude-agent-sdk`
`graph`, `network`, `gantt`, `graphviz`, `mermaid`, `timeline`	`matplotlib` / `graphviz` + the executable `dot` / `mmdc`
`report` (PDF/DOCX through IntelReport)	`pandoc` + `xelatex`
`dashboard`	runs a loopback-only server

Without .venv , they exit nonzero with an import message; the standard-library layer above is unaffected.

Operations grouped by phase (excerpted from `DISPATCH`)

Whole-case pipeline: pipeline, harness, clusters, loop, frontier, reopen, scope
Collection: pivot-extract/webpivot, whois, reverse-whois, ct-monitor, wayback-ga, impersonate, search-pivot/query/dork-sweep, censys, jarm, intelx, docmeta, paths, capture, screenshot, serp, pssl, liveness, exhaust, subdomain, github-osint, username, phone, traffic
Correlation / KB: kb, recall, kb-stats, risk, reference, cert-overlap, cert-pivot, hypothesize, noise, operators, calibration, convergence, domains, victims, crossref, drift
KB ingestion: ingest, ingest-report, ingest-rwhois
Handoff: graph-build, graph, network, report, evidence-report, timeline, misp-export, misp
Outbound (gated): engage, engage-harvest, anyrun --submit, misp push/publish → see 07
Self-check: eval

intel.py list is the source of truth; the table above is only a guide.

About this skill

One entry point for 121 operations

--dry-run — inspect the actual command before spending credits

Exit codes — read from return statements with literal values