Skill: dym-cti-expert — workflow hub for cti-expert
When to use
- User types
/dym-cti-expert (no arguments → slug table) or /dym-cti-expert <slug>; or /dym routes here by domain.
- The hub only costs the description line; sub-workflow bodies are only read when invoked.
Steps
- Read ARGUMENTS →
<slug>. No slug → print the table below then stop, do not read any file.
| slug |
purpose |
install-and-register |
Install & register with Claude Code |
api-keys-and-capabilities |
API keys, keyless capabilities, and cost ledger |
investigate-in-claude-code |
Investigate with chat commands (ONLY in Claude Code) |
cli-dispatcher |
Dispatcher CLI: intel.py (ONLY in terminal) |
case-pipeline-and-kb |
Run a case: pipeline, cluster, KB |
reports-and-iocs |
Handover: HTML report, IOC/STIX bundle, DOCX, redacted version |
safety-gates |
Safety rails: what is BLOCKED, what ASKS, what is silent |
ci-monitoring |
Run cti-expert in the CI of your project |
contributor-develop-and-gate |
Contribution branch: modify cti-expert itself |
- Find the sub-file in order, take the FIRST file that exists then read EXACTLY ONE file:
(1)
../dym-cti-expert-<slug>/SKILL.md (next to hub — install via npx skills add rheinmir/dym);
(2) .overstack/doyourmagic/cti-expert/skills/dym-cti-expert-<slug>/SKILL.md (bundle in project);
(3) .claude/skills/dym-cti-expert-<slug>/SKILL.md.
Follow that file's Steps/Rules; do not read other sub-files; none of the 3 found → say so clearly, stop.
Rules
- Each sub-skill is self-contained; the hub does not stuff the whole bundle into context.
workflows.md next to the bundle is an index + verification table, not a command source.
