Agent skill

Pivot On Ioc

Explore GTI relationships for an IOC to discover related entities.

Apache-2.0Auto-check passedSecurity

Install Pivot On Ioc

skills CLI

$ npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks pivot-on-ioc --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/pivot-on-ioc .claude/skills/pivot-on-ioc && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "pivot-on-ioc" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc into .claude/skills/pivot-on-ioc/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pivot-on-ioc", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks pivot-on-ioc --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/pivot-on-ioc .agents/skills/pivot-on-ioc && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "pivot-on-ioc" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc into .agents/skills/pivot-on-ioc/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pivot-on-ioc", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks pivot-on-ioc --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/pivot-on-ioc .cursor/skills/pivot-on-ioc && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "pivot-on-ioc" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc into .cursor/skills/pivot-on-ioc/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pivot-on-ioc", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/dandye/ai-runbooks.git --path skills/pivot-on-ioc

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks pivot-on-ioc --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/pivot-on-ioc .gemini/skills/pivot-on-ioc && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "pivot-on-ioc" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc into .gemini/skills/pivot-on-ioc/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pivot-on-ioc", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install dandye/ai-runbooks pivot-on-ioc

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/pivot-on-ioc .github/skills/pivot-on-ioc && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "pivot-on-ioc" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc into .github/skills/pivot-on-ioc/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pivot-on-ioc", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install dandye/ai-runbooks pivot-on-ioc --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/dandye/ai-runbooks.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/pivot-on-ioc .opencode/skills/pivot-on-ioc && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "pivot-on-ioc" agent skill from https://github.com/dandye/ai-runbooks/tree/main/skills/pivot-on-ioc into .opencode/skills/pivot-on-ioc/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pivot-on-ioc", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: pivot-on-ioc
GitHub stars: 127
Token cost: ~690 tokens
SKILL.md length: 178 words
Files: 1
Skills in repo: 27
Repo updated: Aug 14, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Explore GTI relationships for an IOC to discover related entities.

Works in 2 steps: Select GTI Tool → Query Each Relationship
Expand investigation by finding connected domains
SKILL.md covers Inputs, Available Relationships by IOC…, Workflow and Required Outputs, plus 1 more section
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Pivot On Ioc is an agent skill from dandye/ai-runbooks. Explore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.

Its SKILL.md is about 690 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security. It works with Model Context Protocol. The licence is Apache-2.0.

When your agent uses it

Expand investigation by finding connected domains

Example prompts

“/pivot-on-ioc”

Workflow steps

2 steps, taken from the step headings in SKILL.md.

Select GTI Tool
Query Each Relationship

What it can do on your machine

Read from SKILL.md and the folder at commit 72a6863. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Pivot On Ioc loads about 690 tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 178 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~53
When it runs · the whole SKILL.md, loaded when a task matches: ~690

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from dandye/ai-runbooks at commit 72a6863, republished under its Apache-2.0 licence (© dandye). 178 words, ~690 tokens.

Download SKILL.mdSave it as .claude/skills/pivot-on-ioc/SKILL.md (or your agent's skills folder).

name: pivot-on-ioc
description: Explore GTI relationships for an IOC to discover related entities. Use to expand investigation by finding connected domains, IPs, files, or threat actors. Takes an IOC and relationship types to query.
type: Skill
required_roles.gti: GTI Enterprise+
personas: tier2-analyst, tier3-analyst, threat-hunter
generated.by: human:mlutx
generated.at: 2026-01-13T16:30:44-06:00

Pivot on IOC Skill

Explore relationships connected to an IOC within Google Threat Intelligence (GTI) to discover related entities for investigation expansion.

Inputs

IOC_VALUE - The indicator value to pivot from
IOC_TYPE - The type: "IP Address", "Domain", "File Hash", "URL", or "Collection"
RELATIONSHIP_NAMES - List of relationships to query (see table below)

Available Relationships by IOC Type

IOC Type	Common Relationships
IP Address	`communicating_files`, `downloaded_files`, `referrer_files`, `resolutions`
Domain	`resolutions`, `communicating_files`, `downloaded_files`, `subdomains`, `siblings`
File Hash	`contacted_domains`, `contacted_ips`, `contacted_urls`, `dropped_files`, `embedded_domains`
URL	`communicating_files`, `downloaded_files`, `last_serving_ip_address`
Collection	`malware_families`, `attack_techniques`, `threat_actors`, `indicators`

Workflow

Step 1: Select GTI Tool

Based on IOC_TYPE:

IOC Type	Tool
IP Address	`gti-mcp.get_entities_related_to_an_ip_address`
Domain	`gti-mcp.get_entities_related_to_a_domain`
File Hash	`gti-mcp.get_entities_related_to_a_file`
URL	`gti-mcp.get_entities_related_to_an_url`
Collection	`gti-mcp.get_entities_related_to_a_collection`

Step 2: Query Each Relationship

For each relationship in RELATIONSHIP_NAMES:

[selected_tool](
    identifier=IOC_VALUE,
    relationship_name=relationship
)

Store results keyed by relationship name.

Required Outputs

After completing this skill, you MUST report these outputs:

Output	Description
`RELATED_ENTITIES`	Dictionary of entities found per relationship
`EXPANDED_IOCS`	Flattened list of all discovered IOCs (IPs, domains, hashes)
`THREAT_CONTEXT`	Threat actor/campaign context if found during pivoting
`PIVOT_STATUS`	Success/failure status of the pivoting

Example Usage

File Hash Investigation:

IOC_VALUE: "abcdef123456..."
IOC_TYPE: "File Hash"
RELATIONSHIP_NAMES: ["contacted_domains", "contacted_ips", "dropped_files"]

Domain Investigation:

IOC_VALUE: "suspicious-domain.com"
IOC_TYPE: "Domain"
RELATIONSHIP_NAMES: ["resolutions", "communicating_files", "subdomains"]

Files

Just SKILL.md in skills/pivot-on-ioc of dandye/ai-runbooks.

Open the folder on GitHubat commit 72a6863

Compare with similar skills

Pivot On Ioc next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Pivot On Ioc compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Pivot On Ioc this skilldandye/ai-runbooks	127	—	~690	Automated safety check: Pass	Apache-2.0	1 mo ago
Kubernetes Network Security Auditkubeshark/kubeshark	12k	—	~7.3k	Automated safety check: Notes	Apache-2.0	yesterday
Upgrade Notesgetknit/knit	133	—	~1.2k	Automated safety check: Pass	GPL-3.0	yesterday
Ecs Operation Reviewaws/tools-for-devops-agent	103	—	~4.8k	Automated safety check: Pass	Apache-2.0	yesterday
Security GuidejnMetaCode/shellward	140	—	~644	Automated safety check: Warn	Apache-2.0	12 days ago
Oma Securityfirst-fluke/oh-my-agent	1.3k	—	~3.9k	Automated safety check: Pass	MIT	yesterday

Similar skills

Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
12k GitHub stars~7.3k tokensUpdated yesterday
SecurityAuto-check: notes
Upgrade Notes
getknit/knit
Read the vendor's breaking changes, deprecations, migration notes and CVEs for every version between the one pinned now and the one being moved to, through the whatsnew MCP server's upgradenotes tool.
133 GitHub stars~1.2k tokensUpdated yesterday
SecurityAuto-check passed
Ecs Operation Review
aws/tools-for-devops-agent
Official
Performs a comprehensive Amazon ECS operations review across the 6 review pillars (Resiliency & HA, Observability, Security, Operations, Performance, Additional Analysis) using read-only AWS APIs…
103 GitHub stars~4.8k tokensUpdated yesterday
SecurityAuto-check passed
Security Guide
jnMetaCode/shellward
OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation
140 GitHub stars~644 tokensUpdated 12 days ago
SecurityAuto-check: warnings
Oma Security
first-fluke/oh-my-agent
Scan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates.
1.3k GitHub stars~3.9k tokensUpdated yesterday
SecurityAuto-check passed
Azure Compliance
microsoft/GitHub-Copilot-for-Azure
Official
Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
255 GitHub starsUsed in 2 repos~997 tokens
SecurityAuto-check passed

Questions about Pivot On Ioc

What does Pivot On Ioc do?

Explore GTI relationships for an IOC to discover related entities. Pivot On Ioc is an agent skill from dandye/ai-runbooks. Explore GTI relationships for an IOC to discover related entities.

When should I use Pivot On Ioc?

Pivot On Ioc fits situations like: expand investigation by finding connected domains.

How do I install Pivot On Ioc in Claude Code?

Run `npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a claude-code`. Or copy the skill folder (skills/pivot-on-ioc in dandye/ai-runbooks) into .claude/skills/pivot-on-ioc in your project. Claude Code loads it when a task matches its description.

How do I install Pivot On Ioc in Codex?

Run `npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a codex`. Or copy the skill folder (skills/pivot-on-ioc in dandye/ai-runbooks) into .agents/skills/pivot-on-ioc in your project. Codex loads it when a task matches its description.

Can I use Pivot On Ioc in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add dandye/ai-runbooks --skill pivot-on-ioc -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/pivot-on-ioc, .gemini/skills/pivot-on-ioc, .github/skills/pivot-on-ioc and .opencode/skills/pivot-on-ioc in your project.

What does Pivot On Ioc need to run?

SKILL.md names no scripts, command-line tools or credentials: Pivot On Ioc is instructions for the agent only.

Does Pivot On Ioc access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Pivot On Ioc safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Pivot On Ioc use?

Pivot On Ioc is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Pivot On Ioc use?

About 690 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Pivot On Ioc?

Skills that share tags, products or a category with Pivot On Ioc: Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Upgrade Notes (getknit/knit, 133 stars), Ecs Operation Review (aws/tools-for-devops-agent, 103 stars) and Security Guide (jnMetaCode/shellward, 140 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Pivot On Ioc?

dandye (a GitHub user) maintains it in dandye/ai-runbooks, which has 127 GitHub stars. The repository holds 27 skills in this directory. The repository was last updated on August 14, 2026.

Source: dandye/ai-runbooks on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Pivot On Ioc

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Pivot on IOC Skill

Inputs

Available Relationships by IOC Type

Workflow

Step 1: Select GTI Tool

Step 2: Query Each Relationship

Required Outputs

Example Usage

Files

Compare with similar skills

Similar skills

More from dandye/ai-runbooks

Related

Questions about Pivot On Ioc