Skills & Tools

This cookbook demonstrates building a Claude-powered threat intelligence enrichment agent that autonomously investigates Indicators of Compromise (IOCs) by querying multiple threat intel sources, correlating findings, mapping to MITRE ATT&CK, and generating structured reports for SIEM/SOAR integration. The agent uses Claude's tool-use capabilities to decide which intelligence sources to query, chain tool calls based on discoveries, and convert free-text analysis into analyst-ready JSON reports. The architecture uses simulated threat intel backends that can be swapped with real APIs (VirusTotal, AbuseIPDB, Shodan, etc.) without changing orchestration logic.

OpenClaw v2026.4.5 is a major release introducing breaking config changes with migration support, new media generation tools (video, music, image), expanded provider integrations (Qwen, Fireworks AI, StepFun, Amazon Bedrock Mantle), multilingual control UI support, enhanced approval workflows for iOS and Matrix, experimental memory dreaming features with weighted recall, and improved prompt caching stability across multiple dimensions.

Claude Code v2.1.91 introduces MCP tool result persistence overrides supporting up to 500K characters, adds shell execution disabling options, enables multi-line prompts in deep links, and allows plugins to ship executables. The release includes critical fixes for transcript chain breaks, terminal key handling, plan mode persistence in remote sessions, and JSON schema validation, plus performance improvements and enhanced API guidance.

CrewAI v1.13.0 introduces significant architectural improvements including RuntimeState RootModel for unified serialization, enhanced event telemetry for skills and memory, and A2UI extension support. The release includes critical bug fixes for GPT-5.x model compatibility, RBAC permission alignment, and Windows lancedb compatibility. Performance optimizations reduce framework overhead through lazy event bus implementation and conditional tracing.