AgentFlocks · Jieatgit · Sep 20, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026
diff --git a/.flocks/mcp_list.json.example b/.flocks/mcp_list.json.example
@@ -66,6 +66,7 @@
   "servers": [
     {
       "id": "threatbook_mcp",
+      "group": "威胁情报",
       "name": "ThreatBook MCP",
       "description": "ThreatBook threat intelligence MCP service for IOC lookups, threat analysis, and security investigation workflows.",
       "category": "threat_intelligence",
@@ -101,6 +102,7 @@
     },
     {
       "id": "nsfocus_mcp",
+      "group": "威胁情报",
       "name": "NSFOCUS MCP",
       "description": "NSFOCUS threat analysis MCP service for security capability access, intelligence queries, and analyst-assisted investigation workflows.",
       "category": "threat_intelligence",
@@ -136,6 +138,7 @@
     },
     {
       "id": "qianxin_mcp",
+      "group": "威胁情报",
       "name": "QiAnXin MCP",
       "description": "QiAnXin threat intelligence MCP service for intelligence lookups, threat analysis, and security operations support.",
       "category": "threat_intelligence",
@@ -171,6 +174,7 @@
     },
     {
       "id": "panther",
+      "group": "SIEM 与日志分析",
       "name": "Panther SIEM",
       "description": "Panther SIEM platform integration for writing detection rules with natural language, querying logs, and managing alerts.",
       "category": "siem",
@@ -208,6 +212,7 @@
     },
     {
       "id": "secops",
+      "group": "安全运营",
       "name": "SecOps Toolbox",
       "description": "All-in-one security testing toolkit integrating multiple open-source security tools for penetration testing, vulnerability scanning, and threat hunting.",
       "category": "secops_platform",
@@ -233,6 +238,7 @@
     },
     {
       "id": "tenzir",
+      "group": "数据处理",
       "name": "Tenzir",
       "description": "Tenzir security data pipeline engine integration with TQL queries, OCSF integration, and automated parser generation.",
       "category": "data_pipeline",
@@ -263,6 +269,7 @@
     },
     {
       "id": "cybersec_watchdog",
+      "group": "合规",
       "name": "CyberSec Watchdog",
       "description": "Comprehensive Linux server security audit with 89 CIS benchmark controls and NIST 800-53 / PCI-DSS compliance checks.",
       "category": "compliance",
@@ -289,6 +296,7 @@
     },
     {
       "id": "npm_audit",
+      "group": "代码安全",
       "name": "NPM Security Audit",
       "description": "NPM package dependency security audit using the remote npm registry for real-time security checks.",
       "category": "code_security",
@@ -316,6 +324,7 @@
     },
     {
       "id": "gridinsoft",
+      "group": "威胁情报",
       "name": "GridinSoft Inspector",
       "description": "Domain and URL security analysis for verifying website and link safety.",
       "category": "threat_intelligence",
@@ -342,6 +351,7 @@
     },
     {
       "id": "chimera_csl",
+      "group": "合规",
       "name": "Chimera CSL (Z3 Verification)",
       "description": "Deterministic AI security policy engine using Z3 formal verification to write and enforce machine-verifiable AI constraints.",
       "category": "compliance",
@@ -367,6 +377,7 @@
     },
     {
       "id": "aim_guard",
+      "group": "安全运营",
       "name": "AIM Guard",
       "description": "Security-oriented MCP server providing security guidelines and content analysis for AI agents.",
       "category": "secops_platform",

diff --git a/.flocks/plugins/agents/asset-survey/agent.yaml b/.flocks/plugins/agents/asset-survey/agent.yaml
@@ -1,4 +1,5 @@
 name: asset-survey
+group: 威胁情报
 name_cn: 互联网资产测绘智能体
 description: >-
   Internet asset survey and reconnaissance agent. Translates natural language queries into

diff --git a/.flocks/plugins/agents/device-inspector/agent.yaml b/.flocks/plugins/agents/device-inspector/agent.yaml
@@ -1,4 +1,5 @@
 name: device-inspector
+group: 平台集成
 name_cn: 设备巡检智能体
 description: >-
   Generic device inspection agent for connected security devices. Discovers enabled

diff --git a/.flocks/plugins/agents/host-forensics-fast/agent.yaml b/.flocks/plugins/agents/host-forensics-fast/agent.yaml
@@ -1,4 +1,5 @@
 name: host-forensics-fast
+group: 安全研判
 name_cn: 主机快速排查智能体
 description: >-
   Fast Linux host compromise triage subagent for first-pass investigation. Use when the user

diff --git a/.flocks/plugins/agents/host-forensics/agent.yaml b/.flocks/plugins/agents/host-forensics/agent.yaml
@@ -1,4 +1,5 @@
 name: host-forensics
+group: 安全研判
 name_cn: 主机取证智能体
 description: >-
   Linux host compromise detection and forensics subagent. Use when the user asks to inspect,

diff --git a/.flocks/plugins/agents/hrti_threat_intelligence/agent.yaml b/.flocks/plugins/agents/hrti_threat_intelligence/agent.yaml
@@ -1,4 +1,5 @@
 name: hrti-threat-intelligence
+group: 威胁情报
 name_cn: 热点威胁情报智能体
 description: >-
   Situational threat intelligence subagent for querying and analyzing trending cybersecurity events.

diff --git a/.flocks/plugins/agents/ndr-analyst/agent.yaml b/.flocks/plugins/agents/ndr-analyst/agent.yaml
@@ -1,4 +1,5 @@
 name: ndr-analyst
+group: 安全研判
 name_cn: NDR 分析智能体
 description: >-
   NDR network traffic analyst: analyzes flow logs and alerts, identifies attack techniques,

diff --git a/.flocks/plugins/agents/phishing-detector/agent.yaml b/.flocks/plugins/agents/phishing-detector/agent.yaml
@@ -1,4 +1,5 @@
 name: phishing-detector
+group: 安全研判
 name_cn: 钓鱼邮件检测智能体
 description: >
   Specialized agent for detecting and analyzing phishing emails, extracting IOCs, and assessing threat level.

diff --git a/.flocks/plugins/agents/ti-analyst/agent.yaml b/.flocks/plugins/agents/ti-analyst/agent.yaml
@@ -1,4 +1,5 @@
 name: ti-analyst
+group: 威胁情报
 name_cn: 威胁情报智能体
 description: >-
   Threat intelligence analyst subagent for IOC analysis, attribution, and threat actor research.

diff --git a/.flocks/plugins/agents/vul_threat_intelligence/agent.yaml b/.flocks/plugins/agents/vul_threat_intelligence/agent.yaml
@@ -1,4 +1,5 @@
 name: vul-threat-intelligence
+group: 威胁情报
 name_cn: 漏洞情报智能体
 description: >-
   Vulnerability threat intelligence subagent for querying and analyzing vulnerability data.

diff --git a/.flocks/plugins/skills/agent-builder/SKILL.md b/.flocks/plugins/skills/agent-builder/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: agent-builder
+group: 系统辅助
 category: system
 description: Create new sub-agents (subagents) by generating YAML config and prompt files in ~/.flocks/plugins/agents/. The created agent can be delegated to by Rex via delegate_task. Use when the user asks to create, add, or generate a new agent.
 ---

diff --git a/.flocks/plugins/skills/browser-use/SKILL.md b/.flocks/plugins/skills/browser-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: browser-use
+group: 系统辅助
 description: 统一处理浏览器使用任务，支持可见浏览器 CDP 直连、专用 headless CDP、agent-browser。Use when the user asks to browse websites, interact with pages, fill forms, capture screenshots, reuse an existing Chrome/Chromium/Edge login session, work with an already-open browser/sidebar browser, access login-only/internal/dynamic pages, or automate browser actions.
 ---
 

diff --git a/.flocks/plugins/skills/device-integration-guide/SKILL.md b/.flocks/plugins/skills/device-integration-guide/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: device-integration-guide
+group: 平台集成
 description: 指导 Flocks 新建、添加和接入安全设备。Use when the user asks to create, add, onboard, or connect a new security device.
 ---
 

diff --git a/.flocks/plugins/skills/ndr-alert-analysis/SKILL.md b/.flocks/plugins/skills/ndr-alert-analysis/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: ndr-alert-analysis
+group: 安全研判
 description: 用于 NDR（网络检测与响应）告警的自动化研判分析，按照标准流程进行情报查询、资产关联、漏洞分析、payload 解析和综合研判。
 ---
 

diff --git a/.flocks/plugins/skills/onboarding/SKILL.md b/.flocks/plugins/skills/onboarding/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: onboarding
+group: 系统辅助
 category: system
 description: Guide new users through the complete Flocks setup process via conversation — covering ThreatBook MCP/API, security tool APIs, IM channels, and scenario demos. Also runs system health inspection for returning users. Trigger when the user sends "请启动新手引导流程", "start onboarding", or any similar request to begin setup/configuration.
 ---

diff --git a/.flocks/plugins/skills/onesec-use/SKILL.md b/.flocks/plugins/skills/onesec-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: onesec-use
+group: 平台集成
 description: 用于处理 OneSEC/OneDNS 终端安全平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 OneSEC、微步 EDR等相关操纵需求时，必须先加载本 skill。本 skill 是 OneSEC 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `onesec_*` tool。
 ---
 

diff --git a/.flocks/plugins/skills/onesig-use/SKILL.md b/.flocks/plugins/skills/onesig-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: onesig-use
+group: 平台集成
 description: 用于处理 OneSIG（安全互联网网关 / Secure Internet Gateway）相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 OneSIG、SIG、微步互联网网关等相关操作时，必须先加载本 skill。本 skill 是 OneSIG 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `onesig_*` tool。
 ---
 

diff --git a/.flocks/plugins/skills/qingteng-use/SKILL.md b/.flocks/plugins/skills/qingteng-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: qingteng-use
+group: 平台集成
 description: 用于处理青藤云安全平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到青藤、青藤云安全、青藤主机安全的相关操作时，必须先加载本 skill。本 skill 是 青藤 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `qingteng_*` tool。
 ---
 

diff --git a/.flocks/plugins/skills/sangfor-edr-use/SKILL.md b/.flocks/plugins/skills/sangfor-edr-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: sangfor-edr-use
+group: 平台集成
 description: 深信服 EDR 登录态管理、首页仪表盘、威胁资产分析、资产清点和高级威胁 API 采集。用户提到深信服 EDR、EDR、资产清点、高级威胁或 sangfor EDR 时必须先加载本 skill。
 ---
 

diff --git a/.flocks/plugins/skills/sangfor-xdr-use/SKILL.md b/.flocks/plugins/skills/sangfor-xdr-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: sangfor-xdr-use
+group: 平台集成
 description: 用于处理深信服 XDR（扩展检测与响应）相关任务，支持通过 API 或者结合浏览器操作。只要用户提到 深信服 XDR、XDR、sangfor XDR 等需求时，必须先加载本 skill。本 skill 是 XDR 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `sangfor_xdr_*` tool 或使用 browser-use skill。
 ---
 

diff --git a/.flocks/plugins/skills/skill-builder/SKILL.md b/.flocks/plugins/skills/skill-builder/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: skill-builder
+group: 系统辅助
 category: system
 description: Create or improve skill. Use when the user asks to create, add, generate, update, refactor, package, or test a skill, convert a repeated workflow into a reusable skill, write a `SKILL.md`, or add `references/`, `scripts/` for a skill.
 ---

diff --git a/.flocks/plugins/skills/skyeye-sensor-use/SKILL.md b/.flocks/plugins/skills/skyeye-sensor-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: skyeye-sensor-use
+group: 平台集成
 description: 使用天眼 SkyEye Sensor 传感器侧精简 CLI 查询告警列表和告警统计。适用于用户提到"SkyEye Sensor""天眼流量传感器告警"场景。
 ---
 

diff --git a/.flocks/plugins/skills/skyeye-use/SKILL.md b/.flocks/plugins/skills/skyeye-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: skyeye-use
+group: 平台集成
 description: 用于处理 SkyEye/天眼/网神分析平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 SkyEye、天眼、网神分析平台的相关操作时，必须先加载本 skill。本 skill 是 天眼 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `skyeye_*` tool。
 ---
 

diff --git a/.flocks/plugins/skills/tdp-use/SKILL.md b/.flocks/plugins/skills/tdp-use/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: tdp-use
+group: 平台集成
 description: 用于处理 TDP 威胁检测平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到需要 打开/操作/获取/浏览 TDP、微步 NDR等需求时，必须先加载本 skill。本 skill 是 TDP 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `tdp_*` tool。
 ---
 

diff --git a/.flocks/plugins/skills/tool-builder/SKILL.md b/.flocks/plugins/skills/tool-builder/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: tool-builder
+group: 系统辅助
 category: system
 description: Creates reusable Flocks tools and API integrations. Supports YAML-HTTP for REST APIs and Python for local utilities, with mandatory verification and smoke testing. All output under ~/.flocks/plugins/tools/. When to use: creating or adding a new Flocks tool, building local utilities such as base64 encode-decode, URL encode-decode, JSON formatting, parsing, hashing, text or file transformation, or integrating an external REST API as a reusable tool. Example requests: "Create a base64 encode/decode tool", "Build a URL encode/decode utility", "Add a JSON formatter tool", "Integrate a REST API as a Flocks tool".
 ---

diff --git a/.flocks/plugins/skills/web2cli/SKILL.md b/.flocks/plugins/skills/web2cli/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: web2cli
+group: 系统辅助
 description: 使用统一的 Web2CLI 流程捕获网站的 XHR/Fetch 请求，并生成可复用的 CLI、Markdown 文档。通过浏览器的 `cdp-direct` 模式复用用户 Chromium 系浏览器登录态与 CDP 能力。适用于复现登录后操作、沉淀接口调用样例，或基于页面操作生成自动化工具时。
 required: browser-use
 ---

diff --git a/.flocks/plugins/skills/webui-page-builder/SKILL.md b/.flocks/plugins/skills/webui-page-builder/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: webui-page-builder
+group: 系统辅助
 category: system
 description: Guide users to create, develop, hide, or delete WebUI page plugins that appear in the WebUI left navigation under Home, with live preview and no restart required. Also guide development of page-scoped backend APIs through the WebUI Page Backend API Runtime when built-in APIs are insufficient. Trigger when the user asks to create, remove, or delete a WebUI contract page, WebUI page, dashboard, navigation tab, integrate custom APIs for a page, or sends messages such as "create a WebUI contract page", "delete WebUI contract page", "remove WebUI page", "创建WebUI 契约页面", "删除WebUI 契约页面", "用户WebUI 契约页面", "WebUI 契约页面", "左侧导航页面", "首页下面的页面", "页面数据来源", "自定义 API", or wants help understanding how WebUI contract pages work in Flocks.
 ---

diff --git a/.flocks/plugins/skills/workflow-builder/SKILL.md b/.flocks/plugins/skills/workflow-builder/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: workflow-builder
+group: 系统辅助
 category: system
 description: 根据自然语言描述生成 flocks 内置工作流（workflow.md, workflow.json）。当用户提出创建/设计/生成/搭建工作流或任何多步骤流程（如告警调查、事件响应、SOP/Runbook 自动化）时使用本 skill。
 ---

diff --git a/.flocks/plugins/skills/workflow-config-guide/SKILL.md b/.flocks/plugins/skills/workflow-config-guide/SKILL.md
@@ -1,5 +1,6 @@
 ---
 name: workflow-config-guide
+group: 系统辅助
 category: system
 ui_hidden: true
 description: 配置现有 Flocks 工作流的发布、集成、触发器和发布配置模板；本 skill 只定义交互协议，具体配置问题必须来自工作流目录内的 guide.md

diff --git a/.flocks/plugins/tools/api/fofa/_provider.yaml b/.flocks/plugins/tools/api/fofa/_provider.yaml
@@ -1,4 +1,5 @@
 name: fofa
+group: 网络测绘
 description: FOFA network space mapping engine - search for internet assets, devices, and services
 description_cn: FOFA 网络空间测绘服务，用于检索互联网资产、设备与暴露服务。
 auth:

diff --git a/.flocks/plugins/tools/api/fofa/host.yaml b/.flocks/plugins/tools/api/fofa/host.yaml
@@ -1,4 +1,5 @@
 name: fofa_host
+group: 网络测绘
 description: >
   Get detailed host information from FOFA including ports, services, banners, and certificates.
   Use when investigating a specific IP address for open ports and running services.

diff --git a/.flocks/plugins/tools/api/fofa/info.yaml b/.flocks/plugins/tools/api/fofa/info.yaml
@@ -1,4 +1,5 @@
 name: fofa_info
+group: 网络测绘
 description: >
   Get FOFA account information including user stats, VIP level, and API usage quota.
   Use to check account status and available API credits.

diff --git a/.flocks/plugins/tools/api/fofa/search.yaml b/.flocks/plugins/tools/api/fofa/search.yaml
@@ -1,4 +1,5 @@
 name: fofa_search
+group: 网络测绘
 description: >
   Search FOFA network space for assets matching query syntax.
   Use for asset discovery, attack surface enumeration, and vulnerability assessment.

diff --git a/.flocks/plugins/tools/api/fofa/stats.yaml b/.flocks/plugins/tools/api/fofa/stats.yaml
@@ -1,4 +1,5 @@
 name: fofa_stats
+group: 网络测绘
 description: >
   Get statistical aggregation of FOFA search results - count by protocol, port, country, etc.
   Use for attack surface analysis and understanding asset distribution.

diff --git a/.flocks/plugins/tools/api/greynoise/_provider.yaml b/.flocks/plugins/tools/api/greynoise/_provider.yaml
@@ -1,4 +1,5 @@
 name: greynoise
+group: 威胁情报
 description: GreyNoise Threat Intelligence - Internet-wide scan and attack traffic analysis
 auth:
   secret: greynoise_api_key

diff --git a/.flocks/plugins/tools/api/greynoise/community_ip_query.yaml b/.flocks/plugins/tools/api/greynoise/community_ip_query.yaml
@@ -1,4 +1,5 @@
 name: greynoise_community_ip_query
+group: 威胁情报
 description: >
   FREE GreyNoise Community API - Query IP threat intelligence for basic classification.
   Returns whether the IP is malicious/benign, RIOT status, and last seen date.

diff --git a/.flocks/plugins/tools/api/greynoise/cve_lookup.yaml b/.flocks/plugins/tools/api/greynoise/cve_lookup.yaml
@@ -1,4 +1,5 @@
 name: greynoise_cve_lookup
+group: 威胁情报
 description: >
   Query GreyNoise CVE database to find IPs associated with a specific CVE.
   Returns IPs that have been observed exploiting or targeting this vulnerability.

diff --git a/.flocks/plugins/tools/api/greynoise/gnql_query.yaml b/.flocks/plugins/tools/api/greynoise/gnql_query.yaml
@@ -1,4 +1,5 @@
 name: greynoise_gnql_query
+group: 威胁情报
 description: >
   GreyNoise Query Language (GNQL) search. Use to search the GreyNoise NOISE dataset
   for IPs matching criteria like classification:malicious, tags:Mirai, cve:CVE-2021-xxx,

diff --git a/.flocks/plugins/tools/api/greynoise/gnql_stats.yaml b/.flocks/plugins/tools/api/greynoise/gnql_stats.yaml
@@ -1,4 +1,5 @@
 name: greynoise_gnql_stats
+group: 威胁情报
 description: >
   GreyNoise Query Language (GNQL) statistics. Returns aggregate counts
   grouped by specified field (country, port, tag, classification, etc.).

diff --git a/.flocks/plugins/tools/api/greynoise/greynoise_enterprise_ip_query.yaml b/.flocks/plugins/tools/api/greynoise/greynoise_enterprise_ip_query.yaml
@@ -1,4 +1,5 @@
 name: greynoise_enterprise_ip_query
+group: 威胁情报
 description: >
   Query GreyNoise threat intelligence for an IP address to determine if it's
   associated with malicious scanning or attack activity. Returns classification

diff --git a/.flocks/plugins/tools/api/greynoise/ip_timeline.yaml b/.flocks/plugins/tools/api/greynoise/ip_timeline.yaml
@@ -1,4 +1,5 @@
 name: greynoise_ip_timeline
+group: 威胁情报
 description: >
   Get IP activity timeline showing when an IP was observed by GreyNoise sensors.
   Returns timestamps of scanning activity. Useful for understanding attack timing.

diff --git a/.flocks/plugins/tools/api/greynoise/tags.yaml b/.flocks/plugins/tools/api/greynoise/tags.yaml
@@ -1,4 +1,5 @@
 name: greynoise_tags
+group: 威胁情报
 description: >
   List all available GreyNoise tags. Tags categorize threat actors, malware families,
   attack techniques, and scanner types. Useful for understanding what threats GreyNoise

diff --git a/.flocks/plugins/tools/api/threatbook-cn/_provider.yaml b/.flocks/plugins/tools/api/threatbook-cn/_provider.yaml
@@ -1,4 +1,5 @@
 name: threatbook-cn
+group: 威胁情报
 description: ThreatBook Threat Intelligence Platform
 description_cn: 微步在线威胁情报平台，提供文件样本分析与URL扫描能力
 auth:

diff --git a/.flocks/plugins/tools/api/threatbook-cn/threatbook_cn_file_upload.yaml b/.flocks/plugins/tools/api/threatbook-cn/threatbook_cn_file_upload.yaml
@@ -1,4 +1,5 @@
 name: threatbook_cn_file_upload
+group: 威胁情报
 description: >
   Submit a file to ThreatBook sandbox for malware analysis.
   Supports PE, Office documents, PDF, HTML, Script, MSI, SWF, JAR, LNK, ELF,

diff --git a/.flocks/plugins/tools/api/threatbook-cn/threatbook_cn_url_scan.yaml b/.flocks/plugins/tools/api/threatbook-cn/threatbook_cn_url_scan.yaml
@@ -1,4 +1,5 @@
 name: threatbook_cn_url_scan
+group: 威胁情报
 description: >
   Submit a URL to ThreatBook for scanning by 11 URL scanning engines and URL/domain blacklists.
   Also analyzes files downloaded from the URL. Use when analyzing suspicious URLs from emails, 

diff --git a/.flocks/plugins/tools/api/threatbook-io/_provider.yaml b/.flocks/plugins/tools/api/threatbook-io/_provider.yaml
@@ -1,4 +1,5 @@
 name: threatbook-io
+group: 威胁情报
 description: ThreatBook IO Threat Intelligence Platform - Global edition providing IP, domain, URL, file hash intelligence
 description_cn: ThreatBook IO 威胁情报平台（全球版），提供 IP、域名、URL、文件哈希等威胁情报查询能力
 auth:

diff --git a/.flocks/plugins/tools/api/threatbook-io/threatbook_io_domain_query.yaml b/.flocks/plugins/tools/api/threatbook-io/threatbook_io_domain_query.yaml
@@ -1,4 +1,5 @@
 name: threatbook_io_domain_query
+group: 威胁情报
 description: >
   Query domain threat intelligence including verdict, WHOIS, DNS records,
   SSL certificates, and associated malware samples. Use when analyzing

diff --git a/.flocks/plugins/tools/api/threatbook-io/threatbook_io_file_query.yaml b/.flocks/plugins/tools/api/threatbook-io/threatbook_io_file_query.yaml
@@ -1,4 +1,5 @@
 name: threatbook_io_file_query
+group: 威胁情报
 description: >
   Query file hash threat intelligence including static/dynamic analysis reports,
   malware detection results, behavioral signatures, network behavior, and

diff --git a/.flocks/plugins/tools/api/threatbook-io/threatbook_io_file_upload.yaml b/.flocks/plugins/tools/api/threatbook-io/threatbook_io_file_upload.yaml
@@ -1,4 +1,5 @@
 name: threatbook_io_file_upload
+group: 威胁情报
 description: >
   Upload a file to ThreatBook sandbox for malware analysis. Supports PE, Office,
   PDF, HTML, scripts, and archive formats up to 100MB. Use when analyzing