daily-security-report - SKILL.md Agent Skill

name: daily-security-report description: > Generate Galahad's daily security briefing. Aggregates data from OpenCTI, RSS feeds, CISA KEV, and CVE sources into a structured report following the shared daily-reports contract.

Daily Security Report — Galahad

Produce a daily security briefing covering the threat landscape, active vulnerabilities, IOCs, and recommended actions. Output MUST conform to the shared daily-reports JSON contract.

Dependencies

Skill	Purpose
`security/opencti-intel`	CVEs, IOCs, threat actors, platform health, STIX data
`security/rss-analyzer`	Security news, narrative context, feed analysis
`security/cve-deep-dive`	Deep analysis of specific critical CVEs
`security/threat-briefing`	Threat actor profiles and campaign tracking
`shared/daily-reports`	Output contract — JSON schema and vault template

Data Source Priority

Query in this order. Higher priority sources override lower on conflicts.

Priority	Source	Skill/Method	Signal Quality
1	CISA KEV feed	`opencti-intel` → KEV connector	Highest — actively exploited
2	OpenCTI vulnerabilities	`opencti-intel` → `opencti-vulns.sh`	High — NVD/CVE normalized
3	ThreatFox + URLhaus	`opencti-intel` → indicators	High — active malware IOCs
4	Curated RSS feeds	`rss-analyzer` → `analyze-feed.py`	Medium — narrative context
5	OpenCTI reports	`opencti-intel` → reports query	Medium — depends on connectors
6	MITRE ATT&CK	`opencti-intel` → attack patterns	Reference — technique mapping

Report Sections

Generate exactly 8 sections in this order. Each section maps to one entry in the sections array of the JSON contract.

1. Executive Threat Summary

2–3 sentence threat landscape overview
State the threat level: CRITICAL | HIGH | MEDIUM | LOW | QUIET
Confidence assessment for the day's intelligence
Period covered (default: previous 24h, 0600 UTC to 0600 UTC)
This also populates the top-level summary field in the JSON contract
Priority: match to highest-priority finding in the report
Confidence: aggregate of section confidences

2. Critical Alerts

New CISA KEV additions (last 24h)
Critical CVEs: CVSS ≥ 9.0 published in period
Active exploit code released (check ThreatFox, ExploitDB references)
Zero-days in the wild
Format per item: CVE ID | Product | CVSS | Exploit Status | Recommendation
Priority: high if any items exist, low if empty
Confidence: high (direct platform data)
Data sources: ["CISA KEV", "NVD/CVE", "ThreatFox"]

3. Threat Actor Activity

New campaigns from OpenCTI reports
Attribution updates
TTPs observed (map to MITRE ATT&CK)
Geographic targeting patterns
If no actor data available, state explicitly: "No tracked threat actor activity in period."
Priority: high if nation-state or targeted campaigns, medium otherwise
Confidence: medium (attribution is inherently uncertain)
Data sources: ["OpenCTI Reports", "MITRE ATT&CK"]

4. Indicators of Compromise

New malware families (ThreatFox)
C2 infrastructure (URLhaus)
Top 10 most prevalent threats by IOC volume
Infrastructure clustering patterns
Priority: high if new C2 or malware families, medium for routine volume
Confidence: high (direct IOC data)
Data sources: ["ThreatFox", "URLhaus", "OpenCTI Indicators"]

5. Vulnerability Intelligence

High-severity CVEs: CVSS 7.0–8.9
Trending vulnerabilities (multiple sources reporting)
Patch availability status
Exploitability assessment (EPSS scores if available)
Priority: medium
Confidence: high (NVD data)
Data sources: ["NVD/CVE", "EPSS", "OpenCTI Vulnerabilities"]

6. RSS Threat Feed Highlights

Top 5 security news items by relevance
Categorize each: ransomware | supply-chain | cloud | insider-threat | nation-state | other
Ensure source diversity — no more than 2 items from the same feed
Include source URL for each item
Priority: medium
Confidence: medium (news reporting, not primary data)
Data sources: ["BleepingComputer", "KrebsOnSecurity", "The Hacker News", "The Record", ...]

7. Platform Health

OpenCTI connector status (any failed or stale?)
Entity growth delta (new entities ingested in period)
Data freshness check per connector
Keep clinical — health indicators only, no commentary
Priority: low unless connectors are failing
Confidence: high (direct platform metrics)
Data sources: ["OpenCTI Platform Stats"]

8. Recommended Actions

Tactical (immediate): Block IOCs, patch specific CVEs, investigate alerts
Strategic (short-term): Monitor campaigns, review exposure, update detection rules
Intelligence gaps: What data is missing or stale?
Priority: match to highest-priority recommendation
Confidence: derived from underlying section confidences
Data sources: aggregate from all sections

Confidence Scoring

Apply per section:

Level	Criteria
`high`	Direct platform data (CVEs, IOCs, connector status). Verified from authoritative sources.
`medium`	RSS analysis, unverified attribution, single-source corroboration. Reasonable but uncertain.
`low`	Single-source claims, speculation, stale data (>48h old). Flag explicitly.

Execution Workflow

1. Query OpenCTI: platform stats, recent vulns, indicators, reports
   └─ bash scripts from opencti-intel skill

2. Query RSS: fetch and analyze last 24h
   └─ python3 scripts from rss-analyzer skill

3. Cross-reference: deduplicate, correlate CVEs across sources

4. Assess: assign threat level, confidence per section

5. Build JSON: populate the shared daily-reports contract
   └─ knight: "sir-galahad"
   └─ run_id: "daily-YYYY-MM-DD"
   └─ report_type: "daily-briefing"

6. Render markdown: use templates/daily-briefing.md for vault output

7. Output both: JSON to stdout/file, markdown to vault path

Modes

Mode	Trigger	Behavior
Scheduled	Cron at 0600 UTC	Full report, publish to `reports.security.daily`
On-demand	"Give me today's briefing"	Full report, return immediately
Historical	"Briefing for YYYY-MM-DD"	Query historical data for specified date

Output

JSON: Conforms to shared/daily-reports contract schema
Markdown: Rendered via templates/daily-briefing.md for Obsidian vault
Highlights: 3–5 bullet points for Tim's morning briefing (populates highlights array)

What This Report Is NOT

Not a compliance checklist
Not a marketing summary of blog posts
Not a dump of every CVE published
Not a repeat of yesterday's report with new dates

Every line answers "so what?" or it doesn't belong.