source-provenance

Most CTI reporting that reaches an analyst is derivative. An outlet rewrites another outlet, which summarised a vendor blog, which reported on the vendor's telemetry. Five outlets covering one vendor report look like five sources. They are one.

This skill resolves a URL to its originating source and returns the chain as data. It does not grade anything. Grading is /quality-of-information-check.

Composition. Invokes /lookup-liberty91 when a key is configured. Invoked by /quality-of-information-check, /claim-extraction (for the fetcher), /threat-actor-profiling, /campaign-tracking, /intelligence-writing and /cti-orchestrator.

The rule that matters

The chain comes from data, never from recollection. You may know that a story "was originally a Mandiant report". That knowledge does not go in the output. If the platform or the script did not resolve a hop, the hop is unresolved, and you say so.

Inputs

• One or more URLs (up to 50 per run).
• Optional: a Liberty91 event ID, in which case platform data is returned instead of resolving.

Pasted text with no URL cannot be resolved by this skill. Say so and hand it to /quality-of-information-check, which treats it as Tier 3.

Tiers

Every output carries provenance_basis at the top. Downstream skills carry it through unchanged.

Procedure

1. Try the platform

If LIBERTY91_API_KEY is set, ask /lookup-liberty91 for the event that contains this URL and read its provenance fields (primaries[], independent_primaries, chains[], most_recent_observation, superseded_by). If they are present, return them with provenance_basis: platform-resolved and stop.

If the key is absent, the URL is not an ingested article, or the response carries no provenance fields, continue to step 2. Do not label anything platform-resolved unless the fields were in the response.

2. Run the script

python3 skills/source-provenance/scripts/resolve_provenance.py resolve <url> [<url> ...]

Standard library only, no install. Options:

Two helper commands:

# Classify URLs against the source-types table. No network.
python3 skills/source-provenance/scripts/resolve_provenance.py classify <url> [<url> ...]

# Extract an article's body text to the local cache and print the file path.
python3 skills/source-provenance/scripts/resolve_provenance.py text <url>

Exit codes: 0 every input resolved, 2 at least one did not, 3 refused (over 50 URLs or over 2 hops), 1 error.

3. Read the result

For each URL the script returns:

fidelity is null on every resolved hop. Judging whether an outlet transmitted the primary faithfully is a model judgement and belongs to /quality-of-information-check.

primary_source.resolution is one of:

4. Present the chain

Lead with provenance_basis and the one-paragraph summary. Then the chain, then what was not resolved. Use this shape:

**Provenance basis:** script-resolved
**Assessed:** 2026-09-27

This GBHackers article traces to a document from Microsoft Threat Intelligence (vendor),
"Storm-3168: ...", published 2026-09-25. Its text indicates access by telemetry; no
confidence statement was found.

| Hop | Organisation | Type | Published | URL |
|---|---|---|---|---|
| 1 | GBHackers | press | 2026-09-26 | https://... |
| 2 (primary) | Microsoft Threat Intelligence | vendor | 2026-09-25 | https://... |

**Primary's stated access:** telemetry ("We observed ..." , paragraph 4)
**Primary's stated confidence:** not stated
**Other primaries linked:** none
**Not resolved:** date of the activity itself (recorded during claim extraction)

If any hop is unresolved, say so in plain words and do not guess. "This article names no source and links none" is a complete and useful answer.

5. Hand off

If the user wants to know how reliable the report is, or whether the outlet changed the primary's meaning, hand off to /quality-of-information-check. Do not judge fidelity or assign grades here.

What "resolved" does and does not mean

resolved means a document from an originating organisation was located and, in most cases, read. It does not mean every statement in the article comes from that document. Articles add quotes, background and the journalist's own framing. /claim-extraction separates those, and /quality-of-information-check compares each claim's wording against the primary.

Check these before relying on a resolved chain:

• date_check: not verified on the primary. The script could not compare publication dates, so the linked document may be background rather than the origin.
• More than one primary. A vendor's vulnerability advisory and a second vendor's exploitation report are both primaries, for different claims.
• access_evidence. Read the sentences. A vendor blog that quotes "CISA said it observed" has matched a telemetry phrase that describes someone else's access.

Rules for what was not established

Failure modes

Fetcher policy

Fixed. There are no flags to loosen it.

• User agent cti-skills-provenance/2.0 (+https://github.com/Liberty91LTD/cti-skills).
• robots.txt honoured.
• One request in flight per host, two seconds between requests to the same host, four hosts in flight.
• On 429 or 503: honour Retry-After, otherwise back off from 10 seconds, three attempts, then skip the host for the run.
• Local cache keyed by URL, revalidated with ETag and Last-Modified. Seven days for press, thirty for primaries. Never uploaded, never committed.
• 10 second connect timeout, 20 second read timeout, 5 MB size limit.
• Output contains extracted fields and anchor sentences only. Full text stays in the local cache.

References

• references/source-types.md: the classification table the script reads. Type, access profile and interest. No reliability column.
• references/attribution-phrases.md: the attribution, confidence, hedging and access patterns, with false-positive notes.
• references/outlet-behaviour.md: how common outlets cite, and what the script makes of each pattern.

Related skills

• /quality-of-information-check: grades the claims once the chain is known.
• /claim-extraction: splits the primary into typed, anchored claims.
• /lookup-liberty91: platform-resolved provenance across a whole deduplicated event.
• /source-assessment: the Admiralty scale reference. The evidence grade is a different instrument.