Every command in this file is a CHAT command. Typing it into the terminal will not run it. The terminal version is in 04-cli-dispatcher.md.
Why use it: this is the surface that cti-expert is designed around — the agent routes itself by target type and runs the tool chain itself.
What it produces: case in intel_engine/cases/<CASE-ID>/, a domain table shown in chat, and an export file per 06.
Exactly 8 commands are registered
scripts/register.sh symlinks 8 files in commands/ into ~/.claude/commands/. These are the only 8 commands that run from a cold prompt in any project:
| Command | What it does | Op T2 equivalent | Tool T1 equivalent |
|---|---|---|---|
/cti <target> [--deep|--quick|--passive] |
entry point — routing by target type | (full chain) | (full chain) |
/cti-recall <seed> |
seen before? always runs first | recall |
domain_verdict, which_cases |
/cti-case <CASE-ID> <seed> [seed...] |
full deterministic pipeline | pipeline open |
(none — CLI only) |
/cti-pivot <url|domain|ip> [--passive] |
collect ONE target | pivot-extract |
pivot_extract |
/cti-cluster <domain|CASE-ID> |
expand & correlate | kb, cert-overlap |
kb_cluster, cert_overlap |
/cti-check <indicator> |
false-positive control | reference check |
reference_check, reference_add |
/cti-report <CASE-ID> [--graph|--pdf] |
render graph + PDF/DOCX | graph, report |
render_diagram, render_report |
/cti-status |
backend tier / MCP / credit | backend.py status |
api_usage |
Every other /lệnh you see in SKILL.md §3 (/case, /sweep, /query, /username, /flow, /brief...) is a convention read from that file, not a registered command. Once the skill has loaded them they are explicit instructions for the agent; typing them at a cold prompt does nothing. When in doubt: use /cti and describe the goal in plain Vietnamese/English.
Read the marker before trusting that a command ran
SKILL.md §3 attaches a marker to each command. This is the mechanism against "the agent claims it called a tool":
| Marker | Meaning | What may be said |
|---|---|---|
| has T2: / T1: | has a real CLI op or MCP tool behind it | call it, then report the result it returns |
| [model] | has no code, and does not need any — it describes how to work (e.g. summarization, checklist, re-reading the KB) | just do it; not may it say the tool was run |
| [unimplemented] | tradecraft is documented, nothing executable exists yet | say so plainly, then do it manually following the linked technique |
A command with no marker and no T1/T2 line → treat it as [unimplemented].
AEAD lifecycle
Four phases, and the order has a reason:
/cti-recall scam-site.example # 1. Acquire — đã gặp seed này chưa?
/cti-pivot https://scam-site.example # 2. Acquire — thu thập một target
/cti-check favicon:123456789 # 3. Enrich — chỉ dấu này là link thật hay noise dùng chung?
/cti-cluster scam-site.example # 4. Enrich — mở rộng sang domain anh em
# 5. Assess — ICD-203, đơn vị phán xét là CLUSTER
/cti-report CASE-0001 --graph --pdf # 6. Deliver
/cti-recall running first is mandatory in the repo's tradecraft, not a suggestion. If the seed already belongs to an old case, re-collecting both wastes credits and creates a skewed duplicate in the KB.
/cti-check before clustering too. A default Wix favicon or a Cloudflare nameserver will "link" thousands of unrelated domains. Merge wrongly and you name innocent people; split wrongly and you lose the case. See RULE 5 in 09 to understand why this logic is protected by tests.
Three flags of /cti
--quick— recall + a single collection pass, no cluster expansion.--deep— parallel sub-agent fan-out: you (the orchestrator) run the first pass, then each identifier discovered is assigned to a sub-agent running/cti <seed> --quick.--passive— without touching the live target; work only on the Wayback/urlscan snapshot.--deep --passivepropagation: every sub-agent runs--quick --passive.
Use --passive when the operator must not know they are being observed. This is a tradecraft decision, not a speed optimization.
Guided flow & template (convention, not a registration command)
After the skill has loaded:
/flow person·/flow domain·/flow email·/flow quick→experience/guided-flows/*.md/template run due-diligence·security-audit·background-check→experience/case-templates/*.md
--yolo
Append to any command to drop all interactive confirmation prompts; the agent decides on its own. It does not disable the hook actionguard.py — the hook runs at the Claude Code harness layer, outside the reach of this flag (see 07).
When something looks off
/cti-status # tier backend, case store, số MCP tool, số dư credit
/mcp # server `intel` có kết nối không
/hooks # 3 mục — chỉ khi cài theo đường plugin
/cost # chi phí model (KHÔNG gồm credit API bên thứ ba)