---
title: "Skills"
slug: "polarity-mcp-skills"
updated: 2026-08-04T16:54:48Z
published: 2026-08-04T16:54:48Z
canonical: "knowledge.threatconnect.com/polarity-mcp-skills"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Skills

## 10 Skills for Polarity

*Analyst workflows for Claude, built on the Polarity integrations you already run.*

Your analysts already have the intel — it's just spread across 90+ integrations, checked one at a time.

**These 10 Skills turn that sprawl into a single conversation:**

1. Point Claude at a(n):
  1. Suspicious email
  2. CVE list
  3. Account
2. Receive:
  1. Enrichment
  2. Correlation
  3. A Scored Verdict

No new infrastructure — every skill runs on Polarity integrations already deployed.

**Each skill:**

1. Parses the entity
2. Enriches in parallel across Polarity
3. Correlates
4. Scores
5. Renders

#### **Download the Skills Package:**

[polarity-skills-pack.zip](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/polarity-skills-pack.zip)

## Skill Breakout

### Triage & response

| **Skill** | **What it does** | **.md File** | **Claude Skill** |
| --- | --- | --- | --- |
| **Phishing email triage** | Scores a reported email from sender, header, link, and attachment enrichment; drafts a quarantine note. | [phishing-email-triage.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/phishing-email-triage.md) | [phishing-email-triage.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/phishing-email-triage.skill) |
| **Vulnerability prioritization** | Ranks CVEs by real exposure — Spotlight, ORCA, internal scans — not just CVSS. | [vulnerability-prioritization.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/vulnerability-prioritization.md) | [vulnerability-prioritization.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/vulnerability-prioritization.skill) |
| **Identity compromise check** | Fans one account across Okta, Entra, HIBP, and EDR to answer the question “Is this person compromised?” | [identity-compromise-check.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/identity-compromise-check.md) | [identity-compromise-check.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/identity-compromise-check.skill) |
| **IOC bulk submission** | Confirms and pushes validated indicators to ThreatConnect/ MISP/OpenCTI/ThreatStream-style platforms in one batch | [ioc-bulk-submission.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/ioc-bulk-submission.md) | [ioc-bulk-submission.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/ioc-bulk-submission.skill) |

### Investigation & Intel

| **Skill** | **What it does** | **.md File** | **Claude Skill** |
| --- | --- | --- | --- |
| **Asset/Host investigation** | Builds one host timeline from EDR, logs, inventory, and exposure data — no console-hopping. | [asset-host-investigation.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/asset-host-investigation.md) | [asset-host-investigation.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/asset-host-investigation.skill) |
| **Infrastructure pivot** | Walks outward from a single bad IP or domain via WHOIS and passive DNS to map a campaign. | [infrastructure-pivot.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/infrastructure-pivot.md) | [infrastructure-pivot.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/infrastructure-pivot.skill) |
| **Threat actor dossier** | Consolidates attribution, TTPs, and recent news about a named actor into a single profile. | [threat-actor-dossier.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/threat-actor-dossier.md) | [threat-actor-dossier.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/threat-actor-dossier.skill) |
| **Dark web exposure check** | Periodic scan of a domain, exec, or brand against breach data, BRI sources, and lookalike domains. | [dark-web-exposure-check.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/dark-web-exposure-check.md) | [dark-web-exposure-check.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/dark-web-exposure-check.skill) |

### Reporting & Operations

| **Skill** | **What it does** | **.md File** | **Claude Skill** |
| --- | --- | --- | --- |
| **Shift handoff summary** | Rolls up a shift's tickets and verdicts into a handoff that the next analyst can act on. | [shift-handoff-summary.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/shift-handoff-summary.md) | [shift-handoff-summary.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/shift-handoff-summary.skill) |
| **Executive briefing generator** | Translates a triaged incident into plain-English framing that a CISO or board can read. | [executive-briefing-generator.md](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/executive-briefing-generator.md) | [executive-briefing-generator.skill](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/executive-briefing-generator.skill) |