Guide · Agent skill
How to use the External OSINT Reconnaissance agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The External OSINT Reconnaissance skill (conducting-external-reconnaissance-with-osint) gives an AI agent a structured passive recon playbook for mapping an organization's external attack surface from public sources, without touching the target's systems. It is written for penetration testers, red team operators and security students working within an authorized engagement. After this guide you will know what the skill does, how to install it, how to ask for it, and what it needs before you run it.
External OSINT Reconnaissancemukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Confirm authorization and scope. Get written authorization for reconnaissance against the target organization and define which domains are in scope.
- 2Install the skill. Download the ZIP from this page, unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install the prerequisites. Install Python 3 with the requests and shodan libraries if you plan to use scripts/agent.py, and install any external tools you intend to run.
- 4Prepare API keys. Obtain a Shodan API key for the script's Shodan queries, and optional keys for Censys, SecurityTrails, Hunter.io, VirusTotal and GitHub.
- 5Ask for a passive recon stage. Describe the target domain, the authorized scope and the stage you want, such as subdomain enumeration or DNS record analysis.
- 6Run the script if needed. Run agent.py with --domain, --org, your keys and --output to save results to a JSON file.
- 7Compile the target profile. Ask the agent to merge findings from every stage into one organized profile and list gaps to verify.
What the skill makes the agent do
An agent skill is a folder of instructions (a SKILL.md file, plus any supporting files) that Claude loads when a request matches the skill's purpose. This one covers the passive information-gathering phase of a pentest against a target organization's domain.
The skill walks the agent through five stages: domain and DNS enumeration, infrastructure and service discovery, email and personnel intelligence, credential and data leak analysis, and technology stack profiling. At each stage it names the open-source tools and search techniques to use and how to organize the findings into a target profile.
- Subdomains and DNS records, including MX, SPF, DKIM and DMARC checks
- Internet-facing services and cloud storage such as S3, Azure Blob and GCP storage
- Employee and email-format information for social engineering preparation
- Leaked credentials, paste sites, public code repositories and document metadata
- Technology stack profiling, including web fingerprinting and SSL/TLS analysis
How to install the External OSINT Reconnaissance skill
Download the ZIP from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. To scope it to one project, place it in that project's .claude/skills/ folder.
In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project only: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills, then upload
How to trigger the skill with natural requests
You do not need a special command. Describe the task in plain language that names the target domain and the recon goal. Mention that the engagement is authorized, because the skill is written for authorized assessments only.
Requests that match the skill's description work best. Examples include asking for passive subdomain discovery, a list of exposed cloud storage, email format identification, or a target profile built from public sources.
- 'We have written authorization to test example.com. Start the passive recon phase and list subdomains and DNS records.'
- 'Map the internet-facing services for example.com and check for exposed cloud storage buckets.'
- 'Identify the email format used by Example Corp and summarize the technology stack from public sources.'
Run the bundled script (optional)
The skill includes scripts/agent.py, which can query certificate transparency logs (crt.sh), public DNS over HTTPS (Google's DNS-over-HTTPS API) and Shodan. It can also search GitHub when given a token. The script needs Python 3 with the requests and shodan libraries, and a Shodan API key for its Shodan queries. Keys for Censys, SecurityTrails, Hunter.io, VirusTotal and GitHub are optional.
Its command-line options are shown in references/api-reference.md. The example below is taken from that file, with placeholders for your own keys.
- Writes results to the file given with --output
- Some workflow steps rely on external tools (Amass, subfinder, theHarvester, Recon-ng, SpiderFoot, wafw00f, whatweb, sslyze, testssl.sh, trufflehog, gitleaks, exiftool, cloud_enum) that you install separately
python agent.py --domain example.com --org "Example Corp" --shodan-key <key> --github-token <token> --output recon.jsonSafety and scope notes
The skill itself prohibits stalking, harassment or surveillance of individuals. Collecting employee data, email addresses and leaked credentials without written authorization can be illegal, and the skill notes privacy laws such as GDPR and CCPA. Confirm your scope before you run any step.
The script runs locally and uses the network to query third-party services such as crt.sh, DNS over HTTPS and Shodan. Review the script before running it, and keep your API keys out of shared logs and files.
- Use only against organizations that have authorized the reconnaissance in writing
- Use a dedicated research workstation; the skill mentions a VPN or Tor for anonymized queries when needed
- Use disposable accounts for services that require registration during research
- Treat results containing personal data as sensitive and handle them under your engagement rules
Tips for getting useful output
Ask the agent to work stage by stage and to record where each finding came from. Findings from several sources, such as amass, subfinder and crt.sh, are easier to trust when they agree. Ask for the final output as a target profile so the results are organized by category.
The skill is a playbook, not a replacement for the tools it names. Run the tools yourself when you need exact control, and use the agent to plan, interpret and consolidate.
- Give the root domain and, if known, the organization name, so the agent can search for related assets
- Ask the agent to consolidate and deduplicate subdomains and map them to IP addresses and hosting providers
- Ask for a list of open questions or gaps at the end of each stage
What people use it for
- Scoping the external attack surface of a company before a red team engagement begins
- Listing subdomains, DNS records and certificate transparency results for a pentest's passive phase
- Identifying the email format and key technical roles for a social engineering assessment within authorized scope
- Checking an organization's public code repositories and documents for exposed secrets or metadata
- Teaching students how external footprinting and OSINT workflows are structured
Frequently asked questions
Is the External OSINT Reconnaissance skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. The source does not list prices for the services it references, and some of them, such as Shodan, use API keys that the script requires for its Shodan queries.
What do I need to run the script?
You need Python 3 with the requests and shodan libraries, and a Shodan API key for the script's Shodan queries. Optional keys for Censys, SecurityTrails, Hunter.io, VirusTotal and GitHub add more sources.
How do I install an agent skill like this one?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Does the skill scan the target's systems?
The skill is designed for passive reconnaissance that does not touch target systems. It relies on public sources such as DNS records, certificate transparency logs and search results. Active tools are not part of its passive playbook.
Can I use this skill to research a private person?
No. The skill prohibits stalking, harassment and surveillance of individuals, and it is intended only for authorized assessments of organizations. Privacy laws such as GDPR and CCPA can apply to collected personal data.
How does it compare to running Amass, theHarvester or SpiderFoot directly?
The skill does not replace those tools. It tells the agent which open-source tools and techniques to use at each step and how to organize the findings. You still need to install and run the tools themselves.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits penetration testers, red team operators and security students who are preparing the passive phase of an authorized engagement and want a structured, repeatable playbook. It is a poor fit for general company research, for investigating individuals, or for any organization that has not authorized reconnaissance in writing.
Download the skill