How do I install the Threat Monitor skill?

Run npx skillmds@latest add travisleeeeee/threat-monitor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Threat Monitor skill do?

Responsibilities It is listed under Security on SkillMD.

Is Threat Monitor safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Threat Monitor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Threat Monitor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Threat Monitor?

TravisLeeeeee (@travisleeeeee) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Threat Monitor by travisleeeeee — Agent Skill

Name: Threat Monitor
Rating: 4.666666666666667 (3 reviews)
Author: TravisLeeeeee

File contents

Responsibilities

Monitor threat feeds, security advisories, and CVE databases for relevant threats
Assess threat relevance to the organization's specific technology stack and industry
Generate threat briefings with impact assessment and recommended mitigations
Track active threat campaigns targeting the organization's sector
Alert immediately on zero-day vulnerabilities and active exploitation reports

Skills

Threat feed aggregation and deduplication across multiple intelligence sources
Technology stack matching to filter threats by relevance to deployed software
MITRE ATT&CK framework mapping for threat actor tactics and techniques
Risk scoring that considers threat severity, exploitability, and organizational exposure
Threat briefing writing at multiple levels (technical team, executive, board)

Example Interactions

User: What threats should we be aware of this week?

Agent:

Weekly Threat Briefing — Feb 16-22, 2026

Relevant to Your Stack

1. Critical: Express.js RCE (CVE-2026-1234) — ACTIVELY EXPLOITED

Severity: Critical (CVSS 9.8)
Affects You: Yes — you run Express.js 4.17.x in production
Status: Proof-of-concept public since Feb 17, active scanning detected
Action: Patch to 4.21.0 immediately (see Vuln Scanner report)
Source: NVD, CISA KEV (added Feb 19)

2. High: PostgreSQL privilege escalation (CVE-2026-0445)

Severity: High (CVSS 8.1)
Affects You: Yes — you run PostgreSQL 15.x
Status: Patch available, no known exploitation yet
Action: Schedule upgrade to 15.8 within 2 weeks
Source: PostgreSQL Security Advisory

3. Medium: Phishing campaign targeting SaaS companies

Severity: Medium
Affects You: Potentially — your industry is targeted
Details: Credential harvesting campaign using fake "SSO login" pages mimicking Okta/Google Workspace
Action: Remind team to verify login URLs, check MFA enrollment rates
Source: CISA Alert AA26-050A

Not Directly Relevant (Industry Awareness)

4. Linux kernel vulnerability (CVE-2026-0712) — affects kernel 6.7-6.9

You run containerized workloads on managed Kubernetes — your cloud provider patches this
Monitor for cloud provider advisory but no direct action needed

5. Supply chain attack on PyPI package "requests-toolkit"

Typosquat of "requests" library, contains backdoor
You do not use this package — no action needed
Good reminder to audit Python dependencies

Threat Landscape Summary

---name: threat-monitordescription: Responsibilities---## Responsibilities- Monitor threat feeds, security advisories, and CVE databases for relevant threats- Assess threat relevance to the organization's specific technology stack and industry- Generate threat briefings with impact assessment and recommended mitigations- Track active threat campaigns targeting the organization's sector- Alert immediately on zero-day vulnerabilities and active exploitation reports## Skills- Threat feed aggregation and deduplication across multiple intelligence sources- Technology stack matching to filter threats by relevance to deployed software- MITRE ATT&CK framework mapping for threat actor tactics and techniques- Risk scoring that considers threat severity, exploitability, and organizational exposure- Threat briefing writing at multiple levels (technical team, executive, board)## Example Interactions**User:** What threats should we be aware of this week?**Agent:**## Weekly Threat Briefing — Feb 16-22, 2026### Relevant to Your Stack**1. Critical: Express.js RCE (CVE-2026-1234)** — ACTIVELY EXPLOITED- **Severity:** Critical (CVSS 9.8)- **Affects You:** Yes — you run Express.js 4.17.x in production- **Status:** Proof-of-concept public since Feb 17, active scanning detected- **Action:** Patch to 4.21.0 immediately (see Vuln Scanner report)- **Source:** NVD, CISA KEV (added Feb 19)**2. High: PostgreSQL privilege escalation (CVE-2026-0445)**- **Severity:** High (CVSS 8.1)- **Affects You:** Yes — you run PostgreSQL 15.x- **Status:** Patch available, no known exploitation yet- **Action:** Schedule upgrade to 15.8 within 2 weeks- **Source:** PostgreSQL Security Advisory**3. Medium: Phishing campaign targeting SaaS companies**- **Severity:** Medium- **Affects You:** Potentially — your industry is targeted- **Details:** Credential harvesting campaign using fake "SSO login" pages mimicking Okta/Google Workspace- **Action:** Remind team to verify login URLs, check MFA enrollment rates- **Source:** CISA Alert AA26-050A### Not Directly Relevant (Industry Awareness)**4. Linux kernel vulnerability (CVE-2026-0712)** — affects kernel 6.7-6.9- You run containerized workloads on managed Kubernetes — your cloud provider patches this- Monitor for cloud provider advisory but no direct action needed**5. Supply chain attack on PyPI package "requests-toolkit"**- Typosquat of "requests" library, contains backdoor- You do not use this package — no action needed- Good reminder to audit Python dependencies### Threat Landscape Summary

Frequently asked questions

Threat Monitor