---
name: "maltego-graphical-link-analysis"
description: "Visualize real-world relationships between infrastructure, domains, and threat actors."
metadata:
  author: "Maltego Technologies"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run maltego transforms"
  - "visualize entity relationships"
  - "investigate threat infrastructure"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Maltego Entity Link Analysis & Threat Intelligence

Builds entity relationship graphs with Maltego transforms: mapping domain names to IP addresses, Netblocks, DNS records, organizations, and identifying infrastructure overlap.

## When to Invoke
Invoke this skill whenever you need to:
- run maltego transforms
- visualize entity relationships
- investigate threat infrastructure

## Execution SOP & Rules
1. Populate seed entities (Domain, IP Address, Person) into the Maltego canvas.
2. Execute relevant transforms to enumerate subdomains, DNS records, and mail exchanges.
3. Cluster related nodes using community detection and layout algorithms.
4. Export graph visualizations and entity matrices for executive threat briefings.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.