STIX/TAXII Intelligence Skill
STIX/TAXII threat intelligence format and sharing
npx skills add a5c-ai/babysitter --skill stix-taxii --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# STIX/TAXII Intelligence Skill ## Overview This skill provides STIX/TAXII threat intelligence format creation, querying, and sharing capabilities. ## Capabilities - Create STIX 2.1 bundles - Query TAXII servers - Generate threat reports - Create indicator relationships - Map to MITRE ATT&CK - Support OpenIOC format - Validate STIX syntax - Share intelligence feeds ## Target Processes - threat-intelligence-research.js - malware-analysis.js - security-advisory-writing.js ## Dependencies - stix2 library (Python) - taxii2-client - Python 3.x - TAXII server access (optional) ## Usage Context This skill is essential for: - Threat intelligence sharing - IOC standardization - Intelligence feed management - Threat report generation - Intelligence correlation ## Integration Notes - Supports STIX 2.0 and 2.1 - Can publish to TAXII servers - Integrates with MISP - Supports multiple IOC formats - Can generate human-readable reports
- Overview
- Capabilities
- Target Processes
- Dependencies
- Usage Context
- Integration Notes
What does the STIX/TAXII Intelligence Skill skill do?
STIX/TAXII threat intelligence format and sharing
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill stix-taxii --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.