[hexablob]

Add an opt-in IsMalicious provider for CAPE's indicator-intelligence interface. It performs IP/domain/URL/hash lookups with the user's credential and returns positive malicious matches with evidence reasons, provider attribution, confidence and report links.

Unknown hashes and missing evidence remain unclassified. Confidence is not inferred from risk; contextual source rows are not counted as detections. Reviewed delistings produce no match, and authentication/rate-limit/network/JSON failures remain explicit non-success outcomes. Requests verify TLS, use encoded parameters and disable credential-bearing redirects.

Installation documentation explains the required local registry entry and config section rather than overwriting core files. This targets the community repository according to CAPE's contribution policy.

Validation:

• 11 synthetic unit tests passed against the current CAPEv2 threat-intelligence base.py retrieved from upstream.
• Black/isort formatting and the workflow's flake8 E9/F63/F7/F82 checks passed.
• No paid credentials or customer data are included.
• Full CAPE analysis/report rendering with a live credential remains a deployment validation, not claimed here.

[hexablob]

The Python package workflow for current HEAD 4c53d82d43bc is waiting for maintainer authorization (action_required). Could a maintainer approve this fork workflow so the repository checks can run?

The local validation and its runtime limits are recorded in the PR description. I am not treating the pending upstream workflow as a passing test.

[doomedraven]

There is nothing to approve

[hexablob]

There is nothing to approve

still i can't merge the PR

[doomedraven]

you only can merge to your own repos