Cybersecurity Threat Intelligence Daily

The problem it addresses

Security signals are scattered across RSS feeds, CVE advisories, ransomware trackers, and media. Reading them manually takes time, and urgent vulnerabilities or APT activity can fall through the gaps. This skill turns source collection, analysis, and email delivery into a repeatable workflow.

How the skill works

• Initial setup: configure the wizard to use AgentMail or SMTP, provide sender credentials and recipients, then save the settings to config.json.
• Source management: uses 13+ built-in Chinese and English security media feeds, and supports adding, disabling, or deleting RSS sources without code changes.
• Collection and drafting: the script fetches RSS feeds and 0.zone ransomware activity for the target date, builds a structured context file, and the AI writes the executive summary, threat rating, high-priority alerts, CVE table, ransomware and APT notes, data-leak items, supply-chain items, policy updates, and defensive recommendations.
• Output and delivery: saves Markdown, converts it to an HTML report with navigation, CVE highlighting, and threat badges, then sends it using the configured mailbox.

Boundaries and cautions

• Restricted network access may cause some feeds to return zero items, so the report can only note limited data availability.
• If 0.zone is unreachable, ransomware intelligence may be incomplete.
• Incorrect SMTP or AgentMail credentials can block sending.
• It depends on upstream source accuracy and is best used for daily briefing support, not as a replacement for vulnerability scanning, EDR, or incident response.