implementing-threat-intelligence-platform
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is designed to interact with reputable external threat intelligence providers.
- Evidence: Fetches indicators of compromise (IOCs) from well-known OSINT services: URLhaus and Feodo Tracker (managed by abuse.ch).
- Evidence: Queries the VirusTotal v3 API for IP address enrichment.
- [DATA_EXFILTRATION]: The script performs network operations to communicate with external APIs and a user-specified MISP instance.
- Evidence: Uses the
requestslibrary to fetch JSON data fromhttps://urlhaus-api.abuse.chandhttps://feodotracker.abuse.ch. - Evidence: Uses the
PyMISPlibrary to synchronize data with a user-supplied MISP URL. - [COMMAND_EXECUTION]: The instructions and scripts utilize standard environment setup and execution patterns.
- Evidence: Recommends installing standard security-related Python packages:
pymisp,requests, andstix2. - Evidence: Uses
argparseto handle configuration such as URLs and API keys provided by the user via command-line arguments.
Audit Metadata