Intel skills
Intel/osint [target]Intel
What it is. The master intelligence-gathering skill: deep, multi-source open-source intelligence on any company, person, market, or technology, producing an executive-grade brief with confidence ratings and source attribution. It is the raw-intel foundation the other intel skills consume.
What it does. Auto-detects the target mode (company / person / market / technology), then runs a deterministic entity resolver (scripts/resolve_entity.py, Tavily with Brave fallback plus a Haiku tool-use extraction) to expand aliases and handles, fans out mode-specific parallel research streams over WebSearch and Firecrawl, grades every finding Confirmed / Deduced / Hypothesized against a persistent case file, and cross-references the CRM and datastore. It writes brief.md, research-notes.md, and a dark self-contained report.html, then appends a /brain-audit footer.
How to use it. Reach for it for comprehensive recon on one named target; use /competitor-intel for a head-to-head against a vendor, /market-brief for a sector or region, and /ceo-intel for global geopolitics.
/osint Acme Corp
"dig into Jane Doe, background check before the meeting"Customize. Variables mode, depth (standard / deep / maximum), focus, and context. Depth escalates to Agent Browser and DataStore cross-referencing. Per-mode stream catalogues live in references/streams-{company,person,market,technology}.md; domain filtering in reference/search-domains.md; evidence grading in reference/forensic-evidence-grading.md. Optional per-exec overrides via scripts/resolve_customization.py (see config/skill-custom/README.md).
/osint-advanced [target]Intel 🔒
What it is. A specialized-database complement to /osint: it queries sanctions and compliance lists, corporate registries, breach databases, threat-actor platforms, infrastructure scanners, and face/username search that general web search does not reach.
What it does. Runs in a forked context on the Sonnet model, selecting streams by mode from a fixed matrix (sanctions/compliance is MANDATORY in company and person mode). Each tool query follows a fallback chain: WebFetch to the API endpoint, then scripts/firecrawl.py scrape, then a site: WebSearch. It writes brief.md, raw tool-responses.md, and a report.html carrying a sanctions status banner (CLEAR / MATCH / PARTIAL) and a tool access log.
How to use it. Use it after /osint has run and a specific dimension still needs depth (compliance screening, breach exposure, infrastructure recon); for the first broad pass on any target, use /osint.
/osint-advanced Acme Corp
/osint-advanced jane.doe@example.comCustomize. disable-model-invocation: true keeps it explicit-only; model: sonnet is set in frontmatter. Variables mode, streams (all or a comma list), and depth (quick / full). Tool registry and validation status in reference/osint-advanced-toolkit.md; per-tool patterns in references/tool-integration-guide.md and references/streams-deep-osint.md.
/competitor-intel [company]Intel
What it is. Deep competitive analysis of a named vendor against 31C/ODUN.ONE: product-gap comparison, geographic overlap, honest strengths, exploitable weaknesses, a win strategy, and recommended actions.
What it does. Runs in a forked context on the Sonnet model. It reads the existing DPI vendor landscape and 31C positioning, then runs three web passes: a filtered industry-source search, a broad company search (blocklist only), and a Firecrawl website crawl over the vendor's product and pricing pages. Every material claim is evidence-graded Confirmed / Deduced / Hypothesized against an append-only persistent case file, and the brief closes with a /brain-audit footer.
How to use it. Use it for a head-to-head against a named competitor; if the target is a person or a broad company profile use /osint, and for market sizing use /market-brief. For a bare "vs" with no named second party, disambiguate first.
/competitor-intel ExampleTelco
"how does ExampleTelco compare to us on encrypted traffic"Customize. model: sonnet and depth (quick / deep) are the main knobs. Baseline competitive data in reference/dpi-market-intelligence.md; domain filtering in reference/search-domains.md; the case-file template at reference/templates/intel-case-file.md; evidence grading in reference/forensic-evidence-grading.md.
/market-brief [topic]Intel
What it is. A fast market or regional intelligence brief on a sector or geography: market sizing, competitive landscape, regulatory environment, entry timing, and 31C positioning framed through the sovereign/DPI+ lens.
What it does. Runs in a forked context on the Sonnet model. It reads DPI market and geopolitical reference data plus 31C strategy, then searches the web with topic-group domain filtering. When the topic falls inside the Polymarket coverage whitelist (AI, big tech, elections, geopolitics, crypto, macro, sports, corporate events) it appends a "Markets Are Pricing" section from scripts/polymarket.py, and it closes with a /brain-audit footer.
How to use it. Use it for a sector, region, or TAM question; for a specific named company use /osint or /competitor-intel, and for global geopolitics use /ceo-intel.
/market-brief GCC telco DPI market
"sector overview and TAM for sovereign 5G security"Customize. Variables depth (surface / detailed) and purpose. Reference data in reference/dpi-market-intelligence.md and reference/geopolitical-landscape.md; domain filtering in reference/search-domains.md; Polymarket whitelist and disambiguation rules in reference/polymarket-coverage.md. Polymarket output is internal-only and never quotable externally.
/ceo-intel [focus]Intel
What it is. A confidential CEO-eyes-only world intelligence brief covering geopolitics, cybersecurity, markets, and priority-region developments, each section framed through 31C's lens with direct business implications and action items.
What it does. Runs in a forked context on the Sonnet model. Phase 1 fans out parallel WebSearch streams (geopolitics, cybersecurity, priority regions, markets/DPI) with domain filtering, runs scripts/perplexity-research.py, fetches World Monitor feeds, and batch-scrapes top articles via Firecrawl. Phase 2 writes a single-page HTML brief with a threat-level bar, metrics strip, and per-section 31C-relevance callouts; Phase 3 renders a PDF via scripts/html-to-pdf.py and appends a /brain-audit footer.
How to use it. Use it for internal world/geopolitical situational awareness with action items; for the public-safe version use /intel-briefing-newsletter, and for a specific company or person use /osint.
/ceo-intel
"give me a geopolitical brief on GCC defense"Customize. The focus variable narrows to a topic or region. The HTML design system (fonts, colors, layout) is specified inline. Reference data in reference/dpi-market-intelligence.md; domain filtering in reference/search-domains.md; the conditional Polymarket section uses scripts/polymarket.py per reference/polymarket-coverage.md. This brief is never shared externally.
/intel-briefing-newsletter [focus]Intel
What it is. The public-facing, branded 31C Intelligence Briefing newsletter: curated live world intel carrying zero confidential information, safe for Tribe distribution and external sharing.
What it does. Runs in a forked context on the Sonnet model. It fans out the same parallel research streams as /ceo-intel (WebSearch with domain filtering, Perplexity, World Monitor, Firecrawl), synthesizes the fixed section set (Hero, Indicators, Sea State, Cyber Front, Navigation Chart, Market Depth, The Heading, Signal Watch, Recommended Reading), then runs a mandatory confidentiality scrub against context/people.md and context/pipeline.md. It builds an input.json, optionally generates editorial images via the flux-image generator, and renders HTML + PDF through scripts/generate-newsletter-html.py.
How to use it. Use it when the output is meant to be published or shared; for the internal-only version that names partners and deals and adds action items, use /ceo-intel.
/intel-briefing-newsletter
"publish an intel briefing on GCC cybersecurity"Customize. Variables focus and issue_number. Content structure, design system, and confidentiality rules in reference/newsletter-guide.md; voice in reference/misha-voice.md; domain filtering in reference/search-domains.md. Optional /editorial-review structural pass before finalizing.
/yt-pulse [query]Intel
What it is. A domain-agnostic YouTube intelligence scanner: it searches YouTube for any topic, clusters the hot themes creators are discussing, deep-analyzes the top video by transcript, scores 31C relevance, and delivers a brief in MD, HTML, and PDF.
What it does. Runs in a forked context on the Sonnet model, firing a mandatory VPN pre-flight gate first (datacenter IPs get blocked). Phase 1 runs .claude/skills/yt-pulse/scripts/pulse.py using YouTube's server-side date filter; it clusters titles into 3-5 topics, selects the top-ranked video by an engagement formula, and pulls the transcript via the Playwright pw.py youtube command (with a WebSearch/WebFetch fallback when the IP is blocked). Phase 5 generates the three-format brief and renders the PDF via scripts/html-to-pdf.py.
How to use it. Use it for YouTube content discovery and analysis in any domain; for non-YouTube target research use /osint, and for an X/Twitter account scan use /x-pulse.
/yt-pulse deep packet inspection
"what's trending on YouTube about AI agents"Customize. Variables timeframe (24h / 72h / 7d / 30d) and depth (quick / full). Per-channel cap (default --per-channel-cap 3, pass 0 for uncapped), browser-cookie sourcing (default Brave ClaudeCode profile via yt-dlp), and residential-proxy fallback are in references/configuration.md. Output templates in references/output-template.md. VPN gate governed by .claude/rules/vpn-preflight.md.
/x-pulse [--window 24h|72h|7d] [--bucket <name>]Intel
What it is. An account-centric X.com (Twitter) intelligence scanner: it pulls recent posts from a curated, categorised account list (peer CEOs, DPI competitors, sovereign-tech thinkers, AI-policy figures, personal interest) and produces an MD/HTML/PDF brief with top-3 highlights, per-category breakdown, and 31C relevance plus actions.
What it does. Runs in a forked context on the Sonnet model. Scraping is server-side via Apify (no browser, no VPN gate). It runs .claude/skills/x-pulse/scripts/pulse.py --dry-run first to show the plan and estimated cost, waits for confirmation, then fetches and applies a two-stage filter: a mechanical engagement filter (top 50% per category by likes + 2*retweets + 3*replies) followed by Claude judgement to pick the top 3 highlights. It renders the brief and PDF using the same design tokens as /yt-pulse.
How to use it. Use it to monitor specific X accounts; for topic-based YouTube discovery use /yt-pulse.
/x-pulse --window 72h --bucket peer_ceos
"what's on X from the DPI vendors this week"Customize. Options --window, --bucket, --max-per-account (default 30, max 100), and --dry-run. The account list is config/x-pulse-accounts.yaml. Requires APIFY_TOKEN in .env (the skill halts with sign-up instructions if it is missing and never edits .env for you). Quoted tweet text is preserved verbatim and exempt from the humanisation rule.
/notebooklm [status|create|add|query|audio|research|report|describe|download] [args]Intel
What it is. A CLI wrapper for Google NotebookLM: create topic notebooks, add sources (URLs, text, files), query with grounded citations, generate audio overviews (AI podcasts), run research discovery, and produce briefing reports. CEO-only, not synced to exec workspaces.
What it does. Runs on the Sonnet model, driving the notebooklm-mcp-cli (nlm) tool via a portable invocation pattern. Every mode is preceded by a Phase 0 auth check (nlm login --check); if auth is expired the skill stops and directs the user to log in manually. Phase 1 dispatches to one of nine modes; per-mode CLI commands, polling rules, and output templates live in references/mode-catalog.md. Long-running modes (audio, report) poll at 15-second intervals up to five minutes.
How to use it. Use it for NotebookLM-specific notebook work and AI audio overviews; for general target research use /osint, for atomic notes use /zk, and for topic-based YouTube podcasts use /yt-pulse.
/notebooklm create "Middle East DPI Market"
"create a NotebookLM audio overview from these sources"Customize. Nine subcommand modes (status, create, add, query, audio, research, report, describe, download). Filenames follow YYYY-MM-DD-<slug>.<ext>. Uses undocumented Google APIs and may break without notice; it never auto-logs-in, never auto-upgrades the CLI, and never uses the MCP server. Auth is per-user via nlm login.
/docparse [file-path or directory] [question]Intel
What it is. A document parser with visual citations: it parses PDF, DOCX, PPTX, and XLSX with spatial bounding boxes via LiteParse and answers a question by tracing every cited fact to its exact location on the source page.
What it does. Runs on the Sonnet model via scripts/docparse.py (cache-aware). Phase 0 runs a prerequisite check and, for documents over 50 pages, asks for a page range. Phase 1 parses to a JSON file; Phase 2 answers a question by extracting 5-15 character-for-character verbatim quotes as citations keyed to inline [N] markers, which the script's box engine maps to page coordinates. Phase 3 optionally renders a 31C-branded self-contained HTML report plus PDF.
How to use it. Use it when you need spatially-grounded citations or to show where a document says something; for plain text extraction use datastore-extract.py, for email use /email-intel, and for web pages use /playwright.
/docparse datastore/reports/acme-q3.pdf "What was Q3 revenue?"
"parse this PDF and show me where it says the pricing"Customize. Flags --pages (required for 100+ page documents), --dpi (default 150), and --report / --no-pdf. Never parses over 100 pages without an explicit --pages restriction. Integration patterns for calling it from other skills are in references/integration.md.
/deep-research-advance "<question>" [--critical] [--audio] [--depth N] [--domains a.com,b.com]Intel
What it is. Advanced one-shot deep research on a public-web topic: a headless script offloads token-heavy acquisition (Perplexity) and reasoning/verification (Kimi), then Claude audits the findings, writes a cited report, and proposes an Odin distillate for approval.
What it does. Runs in a forked context. It states its data-boundary guardrail first, asks 2-3 scoping questions if the topic is underspecified, then runs scripts/deep-research-advance.py, which returns an intermediate.json of angles, sources, corpus, and Kimi's claim analysis. Phase 3 conditionally fires an adversarial audit governor (when sources exceed 12 or --critical is set) that tries to refute each supported claim from the corpus alone. Phase 4 synthesizes a report (executive summary, findings by angle, claims table, contradictions, source list) and appends a /brain-audit footer.
How to use it. Use it for deep, fact-checked reports on public-web topics; it refuses private or internal topics because the question and corpus leave to third-party clouds. For quick lookups use /osint or WebSearch, and for Odin-brain recall use /odin.
/deep-research-advance "state of sovereign DPI regulation in the GCC" --critical
"advanced deep research with verification on 5G security standards"Customize. Flags --depth N (Perplexity angles, default 4, max 8), --critical (force the audit governor), --recency {hour|day|week|month|year}, --domains (allow-list), and the skill-level --audio (gated NotebookLM push, handled in Phase 5, not passed to the script). Persistence is double-gated: the Odin distillate and any NotebookLM audio each require explicit CEO approval. Never runs on private data or injects business context into cloud prompts.