claude-osint skill
A set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
- 3,017 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Runs active external recon against real targets: subdomain enumeration, port scanning, secret hunting
- Executes network tools and scripts on the host
- Usable only with written authorization for the scope
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/claude-osintDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Runs active external recon against real targets: subdomain enumeration, port scanning, secret hunting
- Executes network tools and scripts on the host
- Usable only with written authorization for the scope
This is third-party code. Review the repository files before installing.
What it does
The set gives the agent methodology and techniques for external open-source recon on authorized assessments and bug bounty. The core is a pair of skills: a methodology that sets asset-graph discipline, a severity rubric and deliverable templates, and a tactical arsenal with probe paths, secret-hunting regexes, dorks and one-line commands. Organization-grade skills add legal-entity footprint mapping, email spoofability and SPF analysis, quantified risk scoring, continuous exposure monitoring, cloud and supply-chain review, and identity-provider recon. A separate autopilot skill runs the recon pipeline stage by stage and assembles a consolidated workbook, stopping only at hard gates. Active exploitation is never run under autopilot; it requires a separate confirmation. Some skills ship Python scripts for secret scanning and report building.
Who it is for. For offensive security specialists and bug bounty hunters running authorized external recon.
Good fit when
- You need a structured external recon methodology for an authorized assessment
- You need to map an organization's attack surface: domains, netblocks, email security, cloud
- You need to run the recon pipeline and get a consolidated findings workbook
Not a fit when
- You have no written authorization to recon and test the target
- The target or assets are out of the agreed scope
- You need active exploitation, which is outside recon and requires separate confirmation
Example request
Map the attack surface for example.com, scope is agreed, show findings and a consolidated workbookLimitations
The set is intended only for authorized recon, bug bounty and education; the user is responsible for legality and scope. The skills are markdown files, but the pipeline relies on external tools such as subfinder, dnsx, httpx, nmap, ffuf and gowitness; without them some stages are unavailable. The Python scripts need an interpreter and separate packages, for example openpyxl for the workbook. The author notes known issues on Apple M1 and offers workarounds via dig and curl. Auto-generated findings must be verified by hand before they go into a report.
How to disable. Remove the copied skill folders from ~/.claude/skills/ or delete the symlinks. In a claude.ai project remove the uploaded SKILL.md files from the project knowledge.
FAQ
Is this legal?
The set targets authorized recon, bug bounty and education. Recon and testing may only be run against targets you have written authorization for; responsibility lies with the user.
Do I have to install every skill?
No. Each folder is self-contained, so you can install only what you need, for example the core methodology and arsenal.
How is claude-osint different from scattered OSINT scripts?
It is a skill set with a method for external reconnaissance from open sources for authorized checks and bug bounty. The core is a methodology that sets discipline for working with the asset graph, plus a tactical arsenal and a deep attack surface analysis.
How do I install claude-osint?
Clone the repository with git clone https://github.com/elementalsouls/Claude-OSINT.git and connect the skills to your agent, steps are in the install block. It works in Claude Code, Cursor and Claude Desktop. Risk is high, use it only on permitted targets.
Discussion
No questions or reviews yet.
Related
SkillsA practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
A cyber threat intelligence and OSINT skill: structured investigations, domain and breach recon, analyst-grade reports
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
A Claude Code skill that finds vulnerabilities in one session: threat model, verified findings, CWE and CVSS report.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| claude-osint (this card) | no | 3,017 | ||
| geo-sleuth | no | 6,915 | a skill that finds where a photo without GPS was taken from terrain | |
| mcp-maigret | no | not required | 272 | an MCP server that runs the maigret OSINT tool in Docker |
README in short
The README describes a library of skills for the Claude skills system, where each skill is a SKILL.md with methodology for one part of the external recon problem. The core is a methodology plus a tactical arsenal, extended by organization-grade skills for footprint mapping, email security, risk scoring, exposure monitoring, cloud and identity-provider recon. Installation is by copying or symlinking into ~/.claude/skills/, with options to upload SKILL.md into claude.ai projects or attach via the API. By default structured SKILL.md outlines ship, and the full text is populated by the sync-skill-content.sh script. Code is MIT, content under a separate license.
README badge
Original SKILL.md
--- name: osint-autopilot description: End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain - engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generated findings, and a consolidated multi-tab .xlsx deliverable. Stops ONLY for Stage 6 (active exploitation) arming and out-of-scope sibling assets. version: 1.0 sources: asm_reference_impl, community triggers: - run OSINT - run recon - run the full recon pipeline - attack surface on - OSINT autopilot --- # OSINT Autopilot Purpose: eliminate the thin first pass, then user pushes for more failure. When the user says run OSINT/recon on a domain (authorized), execute the whole pipeline to completion and hand back the consolidated workbook, no stopping to ask except the two hard gates below. ## Hard gates (the ONLY reasons to stop and ask) 1. Authorization - if not already asserted, ask the one scope question, then proceed. 2. Stage 6 (active exploitation) - never run under autopilot; present the ranked target queue and wait for arming. 3. Out-of-scope siblings - flag a newly-discovered sibling domain; do not scan until confirmed.