dym-cti-expert-install-and-register

Skill: dym-cti-expert-install-and-register — Install & register with Claude Code

Why use it: turn cti-expert from a git directory into a skill + 8 commands /cti* + an MCP server usable from any project. What it produces: a clone at ~/.claude/skills/cti-expert, command symlinks in ~/.claude/commands/, .mcp.json per-machine, and (optionally) .venv for the deep layer.

Step 1 — Clone into the right place

git clone https://github.com/7onez/cti-expert.git ~/.claude/skills/cti-expert
cd ~/.claude/skills/cti-expert

The location doesn't have to be ~/.claude/skills/ — all paths in the repo resolve relative to the directory containing SKILL.md (AGENTS.md §1). But register.sh by default symlinks into ~/.claude/skills/cti-expert, so cloning straight into it is the path of least friction.

Step 2 — Third-party OSINT tool installer

bash scripts/install.sh                # lõi: python deps + whois/dig/jq/exiftool + maigret/sherlock/holehe/...
bash scripts/install.sh --headless     # + Scrapling headless Chromium (~200 MB)
bash scripts/install.sh --go           # + subfinder/amass/gau/gitleaks/httpx (~150 MB)
bash scripts/install.sh --all          # + tất cả

These three flags are all the flags the script accepts — check with the block case $arg in at scripts/install.sh:47-51; any other arguments are silently ignored.

An easy-to-miss detail: the installer builds its venv at $HOME/.claude/skills/.venv (install.sh:34), i.e. outside the repo and shared across skills. This is not .venv the one the deep pipeline reads — that one is in Step 4.

Windows native: powershell -ExecutionPolicy Bypass -File scripts\install.ps1 with the flag -Headless / -Go / -All.

Step 3 — Choose ONE of the two registration methods

3a. `register.sh` — symlinks, no hooks

bash scripts/register.sh --dry-run     # xem trước, không đụng gì
bash scripts/register.sh               # thật

Does exactly 3 things (scripts/register.sh):

symlink repo → ~/.claude/skills/cti-expert
symlink each commands/*.md → ~/.claude/commands/ (8 files; if the real file already exists, yours wins, the script skips it)
write .mcp.json at the repo root via intel.py mcp --write

Since everything is a symlink, git pull updates the installed copy without rerunning. Uninstall: bash scripts/register.sh --uninstall (keeps .mcp.json, cases/, knowledge/).

Unknown flag → script exits 2 (register.sh:23-29).

3b. Plugin — skill + commands + MCP + safety hooks in a single unit

claude
/plugin marketplace add ~/.claude/skills/cti-expert
/plugin install cti-expert

The real difference: register.sh can't install hooks, yet the repo's two safety properties live there — leakguard.py blocks writing case data into tracked files, actionguard.py asks before outbound actions. See 07-safety-gates.md. If you plan to do real investigations, choose 3b.

After both methods: restart Claude Code (skills and commands load at startup).

Step 4 — `.venv` for the deep layer (recommended, not required)

cd ~/.claude/skills/cti-expert
uv venv && uv pip install -r requirements.txt

Without .venv the stdlib layer still runs fully: collector, KB, deterministic pipeline, all pure ops in 04. What's locked is:

Requires `.venv`	Because
`intel.py harness ...` (LLM orchestration)	`claude-agent-sdk`
MCP server `intel` (78 `@tool`)	`claude-agent-sdk` via `intel_engine/harness/mcp-server`
`graph` / `network` / `gantt` / `graphviz`	`matplotlib`, `graphviz` (+ binary `dot`)

intel.py auto-select interpreter in order $INTEL_PY → .venv/bin/python of repo → running interpreter (scripts/backend/intel.py:60-64).

Step 5 — Verify

python3 scripts/backend/backend.py status

Expected result when standing in the clone (real run, no .venv, no key):

Intel backend: Tier 2 (CLI) — $INTEL_HOME=<repo>/intel_engine (via in-repo (self-contained))
  available: CLI (harness/cli.py, tools/kb/*.py), KB (knowledge/), BinaryPivot (/binary)
  unlocks:   /kb  /recall  /binary

Machine-readable form: python3 scripts/backend/backend.py status --json → object with tier, tier_label, intel_home, method, trail[], capabilities{cli,kb_tools,mcp_present,mcp_executable,knowledge_dir,binary_pivot}.

backend.py accepts exactly 4 commands — status (default), check, env, path (backend.py:285). No other commands.

In Claude Code, continue checking: /cti-status (health check), /mcp (see server intel), /hooks (see 3 items — only if installed per 3b).

Pitfalls encountered

Command /cti* not recognized → register.sh not run yet or Claude Code not restarted.
.mcp.json could not write → run manually python3 scripts/backend/intel.py mcp --write; if file already exists, need --force, otherwise it exits 5 (intel.py:_cmd_mcp).
.mcp.json contains absolute paths → intentionally gitignored, generated per machine. Do not commit.
Windows run register.sh from Git Bash/WSL because it uses symlinks.