Research system internals and adversary tradecraft to ground a threat hunt in real system behavior and realistic abuse patterns. Use this skill at the start of hunt planning, when you are given a high-level hunt topic but lack a clear understanding of how the system normally operates or how adversaries are known to abuse it.
Install
npx skills add OTRF/ThreatHunter-Playbook --skill hunt-research-system-and-tradecraftnpx skills add OTRF/ThreatHunter-Playbook --skill hunt-research-system-and-tradecraft -a claude-code -gnpx skills add OTRF/ThreatHunter-Playbook --skill hunt-research-system-and-tradecraft -a codex -ggemini skills install https://github.com/OTRF/ThreatHunter-Playbook.git --path .github/skills/hunt-research-system-and-tradecraftgh skill install OTRF/ThreatHunter-Playbook hunt-research-system-and-tradecraftgit clone --depth 1 https://github.com/OTRF/ThreatHunter-Playbook /tmp/OTRF__ThreatHunter-Playbook
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/OTRF__ThreatHunter-Playbook/.github/skills/hunt-research-system-and-tradecraft ~/.claude/skills/hunt-research-system-and-tradecraft # Claude Code
cp -R /tmp/OTRF__ThreatHunter-Playbook/.github/skills/hunt-research-system-and-tradecraft ~/.agents/skills/hunt-research-system-and-tradecraft # Codex, Cursor, Gemini CLI, Copilot, OpenCode