← Back to Skills Marketplace
103
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install vision-one-threat-intel
Description
Query TrendAI Vision One threat intelligence. Use when: looking up IOCs (IP, domain, hash, URL, email), checking threat feeds, reading intelligence reports,...
Usage Guidance
This skill appears to do exactly what it claims: it runs local Python code that calls Trend Micro Vision One endpoints using the VISION_ONE_API_KEY. Before installing, verify you trust the skill source (homepage points to a GitHub repo but 'Source' is listed as unknown), and ensure the API key you supply has least-privilege: give only Threat Intelligence 'View' permissions for read-only use and add 'Configure' only if you need to use 'suspicious add'. Be aware 'suspicious add' is a write operation that can affect your org's block list — require human confirmation before running. The skill writes short-lived cache files to /tmp; if that is a concern, review or modify scripts/lib/cache.py. If you need higher assurance, review the referenced GitHub repo history and owner before use and rotate the API key if you suspect misuse.
Capability Analysis
Type: OpenClaw Skill
Name: vision-one-threat-intel
Version: 1.0.0
The skill bundle is a well-structured tool for interacting with the TrendAI Vision One Threat Intelligence API. It follows security best practices by using only Python standard libraries, implementing proper error handling and rate-limiting, and explicitly instructing the AI agent to seek user confirmation before performing write operations (e.g., adding an IOC to a blocklist in `v1ti.py`). No evidence of data exfiltration, obfuscation, or malicious intent was found.
Capability Tags
Capability Assessment
Purpose & Capability
Name/description map to the requested resources: only VISION_ONE_API_KEY (and optional VISION_ONE_REGION) and python3 are required, which are appropriate for calling Trend Micro Vision One APIs. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md and the CLI source limit actions to Vision One API calls (feedIndicators, feeds, suspiciousObjects) and local formatting/caching. The only write action is 'suspicious add', which the docs mark as requiring explicit user confirmation. The runtime instructions do not request or read unrelated files or env vars.
Install Mechanism
There is no install spec (instruction-only skill for copy-in use) and the code uses only Python stdlib. No external downloads, package installs, or archive extraction are performed by the skill bundle itself.
Credentials
Only VISION_ONE_API_KEY is required (primaryEnv). An optional VISION_ONE_REGION is documented. No other SECRET/TOKEN/PASSWORD env vars are requested. The key's requested permissions are consistent with read operations and an optional configure permission for suspicious add.
Persistence & Privilege
always:false (no forced global enable). The skill stores short-lived cache files under a TMP cache directory (os.environ TMPDIR or /tmp), which is reasonable for caching API responses. It does not modify other skills or system-wide agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install vision-one-threat-intel - After installation, invoke the skill by name or use
/vision-one-threat-intel - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: 6 workflow-oriented commands for threat intel — lookup, feed, report, suspicious list/add, hunt. Zero dependencies, STIX 2.1 parsing, auto IOC detection.
Metadata
Frequently Asked Questions
What is TrendAI Vision One Threat Intelligence?
Query TrendAI Vision One threat intelligence. Use when: looking up IOCs (IP, domain, hash, URL, email), checking threat feeds, reading intelligence reports,... It is an AI Agent Skill for Claude Code / OpenClaw, with 103 downloads so far.
How do I install TrendAI Vision One Threat Intelligence?
Run "/install vision-one-threat-intel" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is TrendAI Vision One Threat Intelligence free?
Yes, TrendAI Vision One Threat Intelligence is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does TrendAI Vision One Threat Intelligence support?
TrendAI Vision One Threat Intelligence is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created TrendAI Vision One Threat Intelligence?
It is built and maintained by andresark (@andresark); the current version is v1.0.0.
More Skills