Agent skill

Greynoise

Classify IPs as scanners or targeted attackers — filter alert noise

Apache-2.0Auto-check passed

Install Greynoise

skills CLI

$ npx skills add taracodlabs/aiden --skill greynoise -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden greynoise --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/greynoise .claude/skills/greynoise && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "greynoise" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/greynoise into .claude/skills/greynoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "greynoise", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/taracodlabs/aiden/tree/main/skills/greynoise

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add taracodlabs/aiden --skill greynoise -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden greynoise --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/greynoise .agents/skills/greynoise && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "greynoise" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/greynoise into .agents/skills/greynoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "greynoise", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add taracodlabs/aiden --skill greynoise -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden greynoise --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/greynoise .cursor/skills/greynoise && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "greynoise" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/greynoise into .cursor/skills/greynoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "greynoise", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/taracodlabs/aiden.git --path skills/greynoise

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add taracodlabs/aiden --skill greynoise -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden greynoise --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/greynoise .gemini/skills/greynoise && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "greynoise" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/greynoise into .gemini/skills/greynoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "greynoise", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install taracodlabs/aiden greynoise

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add taracodlabs/aiden --skill greynoise -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/greynoise .github/skills/greynoise && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "greynoise" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/greynoise into .github/skills/greynoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "greynoise", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add taracodlabs/aiden --skill greynoise -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install taracodlabs/aiden greynoise --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/taracodlabs/aiden.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/greynoise .opencode/skills/greynoise && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "greynoise" agent skill from https://github.com/taracodlabs/aiden/tree/main/skills/greynoise into .opencode/skills/greynoise/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "greynoise", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: greynoise
GitHub stars: 851
Token cost: ~956 tokens
SKILL.md length: 263 words
Files: 3
Skills in repo: 63
Repo updated: Sep 13, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Classify IPs as scanners or targeted attackers — filter alert noise

SKILL.md covers When to Use, How to Use, Examples and Cautions, plus 1 more section
Runs TypeScript scripts from its folder; reaches api.greynoise.io; needs GREYNOISE_API_KEY

What it does

Greynoise is an agent skill from taracodlabs/aiden. Classify IPs as scanners or targeted attackers — filter alert noise

Its SKILL.md is about 960 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `index.ts` and `skill.json`).

The repository describes itself as: Aiden — an autonomous AI agent and work engine built solo. It can operate your browser, terminal, files, apps, APIs, skills and tools, remember context, recover from failures… The licence is Apache-2.0.

Example prompts

“/greynoise”

Requirements

Node.js
A credential in GREYNOISE_API_KEY

What it can do on your machine

Read from SKILL.md and the folder at commit 3704204. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships script files (TypeScript), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
- api.greynoise.io
Also links to:
- viz.greynoise.io
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- GREYNOISE_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Greynoise loads about 956 tokens when it runs. Until then it costs about 19 tokens; SKILL.md has 263 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~19
When it runs · the whole SKILL.md, loaded when a task matches: ~956

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from taracodlabs/aiden at commit 3704204, republished under its Apache-2.0 licence (© taracodlabs). 263 words, ~956 tokens.

Download SKILL.mdSave it as .claude/skills/greynoise/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.

name: greynoise
description: Classify IPs as scanners or targeted attackers — filter alert noise
category: security
version: 1.0.0
license: Apache-2.0
origin: aiden
tags: security, greynoise, scanner, threat-intel, ip, osint, soc, incident-response, noise-filtering
env_required: GREYNOISE_API_KEY

GreyNoise — Internet Scanner Intelligence

GreyNoise collects and analyses internet-wide scan traffic. It tells you whether an IP hitting your firewall is a known mass-scanner (benign research tool or malicious crawler) versus a targeted attacker — helping SOC teams filter out internet noise from real threats.

Community tier: The /v3/community/{ip} endpoint works with limited volume even without a key. Set GREYNOISE_API_KEY for higher rate limits.

When to Use

An IP triggers a firewall rule and you want to know if it is just background internet noise
SOC triage: is this alert a known scanner or a targeted attack?
Filter false positives from SIEM before escalating an alert
User asks "is this IP a scanner?", "is this noisy traffic?", "is IP X benign?"

How to Use

Check if an IP is a known internet scanner

powershell

$ip      = "71.6.135.131"
$headers = @{}
if ($env:GREYNOISE_API_KEY) { $headers['key'] = $env:GREYNOISE_API_KEY }

$result = Invoke-RestMethod -Uri "https://api.greynoise.io/v3/community/$ip" -Headers $headers
Write-Host "IP:             $($result.ip)"
Write-Host "Noise:          $($result.noise)"        # true = mass-scanner
Write-Host "RIOT:           $($result.riot)"         # true = trusted benign service
Write-Host "Classification: $($result.classification)"  # benign | malicious | unknown
Write-Host "Name:           $($result.name)"
Write-Host "Last seen:      $($result.last_seen)"
Write-Host "Link:           $($result.link)"
Write-Host "Message:        $($result.message)"

Triage a batch of IPs from a firewall log

powershell

$ips = @("1.1.1.1", "8.8.8.8", "71.6.135.131", "45.83.66.42")
$headers = @{}
if ($env:GREYNOISE_API_KEY) { $headers['key'] = $env:GREYNOISE_API_KEY }

foreach ($ip in $ips) {
    try {
        $r = Invoke-RestMethod -Uri "https://api.greynoise.io/v3/community/$ip" -Headers $headers
        $tag = if ($r.riot) { '[RIOT-trusted]' } elseif ($r.noise) { '[SCANNER]' } else { '[TARGETED?]' }
        Write-Host "$ip  $tag  $($r.classification)  $($r.name)"
    } catch {
        Write-Host "$ip  [ERROR]  $($_.Exception.Message)"
    }
    Start-Sleep -Milliseconds 200
}

Interpret the results

noise = true   → IP is a known mass-scanner (benign researchers, crawlers, etc.)
riot  = true   → IP belongs to a trusted service (Cloudflare, Google, AWS, etc.)
classification = "malicious"  → Known malicious scanner — block and investigate
classification = "benign"     → Probably safe background noise — may deprioritise
classification = "unknown"    → No data — treat with caution

Examples

"Is 71.6.135.131 an attacker?" → Returns classification: malicious, noise: true — known malicious scanner.

"This IP keeps hitting our web server — is it just background noise?" → noise: true means it is scanning the whole internet, not targeting you specifically.

"Is 8.8.8.8 a threat?" → riot: true — belongs to Google DNS, trusted RIOT (Rule It Out) list.

Cautions

Community endpoint returns limited data — GREYNOISE_API_KEY unlocks full context
noise: false and riot: false does not mean the IP is malicious — GreyNoise may simply have no data for it
Data reflects GreyNoise's scanner observations — gaps exist for low-volume IPs
Free community endpoint: ~50 lookups/day per source IP without a key

Requirements

No key required for low-volume community lookups
GREYNOISE_API_KEY — free community key at https://viz.greynoise.io/account

Files

SKILL.md and 2 other files in skills/greynoise of taracodlabs/aiden.

SKILL.md
index.ts
skill.json

Open the folder on GitHubat commit 3704204

Compare with similar skills

Greynoise next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Greynoise compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Greynoise this skilltaracodlabs/aiden	851	—	~956	Automated safety check: Pass	Apache-2.0	25 days ago
Implementing Mimecast Targeted Attack Protectionmukul975/Anthropic-Cybersecurity-Skills	34k	—	~1.8k	Automated safety check: Pass	Apache-2.0	1 mo ago
Ip As LogoNousResearch/hermes-agent	252k	—	~4.7k	Automated safety check: Pass	MIT	today
Detecting Kerberoasting Attacksmukul975/Anthropic-Cybersecurity-Skills	34k	—	~914	Automated safety check: Pass	Apache-2.0	1 mo ago
Filterzalando/skipper	3.3k	—	~527	Automated safety check: Pass	MIT	2 days ago
Creating Replay Vision ScannersPostHog/posthog	40k	—	~3.6k	Automated safety check: Pass	Custom licence	today

Similar skills

Implementing Mimecast Targeted Attack Protection
mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures Mimecast Targeted Threat Protection (TTP) modules -- URL Protect (click-time URL rewriting/analysis), Attachment Protect (sandbox detonation), Impersonation Protect…
34k GitHub stars~1.8k tokensUpdated 1 mo ago
Documents & OfficeAuto-check passed
Ip As Logo
NousResearch/hermes-agent
Design minimal cute IP mascot marks readable at 32px. An agent skill from NousResearch/hermes-agent.
252k GitHub stars~4.7k tokensUpdated today
Media & CreativeAuto-check passed
Detecting Kerberoasting Attacks
mukul975/Anthropic-Cybersecurity-Skills
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests (Event ID 4769) targeting service accounts with SPNs, which attackers request offline to crack service account passwords.
34k GitHub stars~914 tokensUpdated 1 mo ago
SecurityAuto-check passed
Filter
zalando/skipper
Create or modify code in the filters package and all its sub-folders
3.3k GitHub stars~527 tokensUpdated 2 days ago
DevOps & CloudAuto-check passed
Creating Replay Vision Scanners
PostHog/posthog
Official
Guides agents through creating and safely sizing a Replay Vision scanner: choosing the scanner type (monitor/classifier/scorer/summarizer), shaping the RecordingsQuery that selects sessions, and —…
40k GitHub stars~3.6k tokensUpdated today
Auto-check passed
Detecting Attacks On Scada Systems
mukul975/Anthropic-Cybersecurity-Skills
This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command…
34k GitHub stars~6.9k tokensUpdated 1 mo ago
Data & AnalyticsAuto-check passed

Questions about Greynoise

What does Greynoise do?

Classify IPs as scanners or targeted attackers — filter alert noise. Greynoise is an agent skill from taracodlabs/aiden.

How do I install Greynoise in Claude Code?

Run `npx skills add taracodlabs/aiden --skill greynoise -a claude-code`. Or copy the skill folder (skills/greynoise in taracodlabs/aiden) into .claude/skills/greynoise in your project. Claude Code loads it when a task matches its description.

How do I install Greynoise in Codex?

Run `npx skills add taracodlabs/aiden --skill greynoise -a codex`. Or copy the skill folder (skills/greynoise in taracodlabs/aiden) into .agents/skills/greynoise in your project. Codex loads it when a task matches its description.

Can I use Greynoise in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add taracodlabs/aiden --skill greynoise -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/greynoise, .gemini/skills/greynoise, .github/skills/greynoise and .opencode/skills/greynoise in your project.

What does Greynoise need to run?

Going by SKILL.md and its folder, Greynoise needs TypeScript for the scripts in its folder and credentials named GREYNOISE_API_KEY. Our summary lists: Node.js; A credential in GREYNOISE_API_KEY.

Does Greynoise access the network?

SKILL.md names 2 domains. In commands or code: api.greynoise.io; the agent is likely to contact it when it follows the instructions. As links in the text: viz.greynoise.io. This is read from the text; nothing was executed.

Is Greynoise safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Greynoise use?

Greynoise is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Greynoise use?

About 956 tokens (SKILL.md is roughly 3.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Greynoise?

Skills that share tags, products or a category with Greynoise: Implementing Mimecast Targeted Attack Protection (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Ip As Logo (NousResearch/hermes-agent, 252k stars), Detecting Kerberoasting Attacks (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Filter (zalando/skipper, 3.3k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Greynoise?

taracodlabs (a GitHub organization) maintains it in taracodlabs/aiden, which has 851 GitHub stars. The repository holds 63 skills in this directory. The repository was last updated on September 13, 2026.

Source: taracodlabs/aiden on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Greynoise

Facts

At a glance

What it does

Example prompts

Requirements

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

GreyNoise — Internet Scanner Intelligence

When to Use

How to Use

Check if an IP is a known internet scanner

Triage a batch of IPs from a firewall log

Interpret the results

Examples

Cautions

Requirements

Files

Compare with similar skills

Similar skills

More from taracodlabs/aiden

Questions about Greynoise