How to use the Offensive OSINT Methodology agent skill

What the skill makes the agent do

The skill covers domain recon, email harvesting, social media profiling, GitHub and code leak checks, Shodan and Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows.

It does not contain a tool that runs searches for you. The file itself holds links to existing OSINT websites and tools grouped by purpose (general OSINT, search engines, username and email, people search, phone numbers, social media, public records and company registries, sanctions, and breach data), plus a fixed workflow for how the agent should use them.

• Define the target scope: a domain, organization, person, crypto address, or geographic subject.
• Pick the categories that fit that scope, then work through them top-down, pivoting on each artifact found.
• Archive each key artifact with its URL, a timestamp, a PNG screenshot, and a SHA-256 hash.
• Log findings in JSONL with a run_id and tool versions so the work can be reproduced.
• Suggest next steps based on what each tool returns.

How to install the offensive-osint skill

Download the ZIP for the skill from the directory page. Then choose one of two install locations. For a personal install available in all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills. The skill's only file listed in the source is SKILL.md.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills → upload

How to trigger the skill with natural requests

You do not need a special command. The skill's description lists the situations it applies to: reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, and building an attack-surface map. Describe your goal in plain terms and name the target and its scope.

Good requests state who you are working for and what is authorized. For example, you might write that you are running an authorized penetration test against a named domain and want the agent to map its attack surface using the OSINT methodology. Including the scope helps the agent pick the right categories.

• Map the external attack surface of example-corp.com for an authorized bug bounty program, staying within the in-scope assets.
• Run OSINT recon on the company behind this domain for our red team engagement, and archive every finding with a hash.
• Trace the outgoing transactions from this crypto address for an investigation we are authorized to carry out.
• Geolocate this photo and list the sources you used to confirm the location.

Examples of what the agent works through

For a domain or organization, the agent typically starts with general OSINT resources, then moves to code leak and infrastructure categories, then to public company records and breach data where relevant. Each step builds on the previous one: a username or email found in one place becomes a pivot for the next search.

The source lists specific tools for each area, such as Hunter.io for finding email addresses for a domain, Sherlock for username searches across social networks, Holehe for checking whether an email is registered on platforms, and OpenCorporates for company records. Many of these services are paid, gated, or require their own accounts, so the agent may report that a tool is unavailable rather than return results.

What the skill needs

You need a web browser and internet access to use the linked tools. Some listed tools, including Shodan, Censys, Hunter.io, Apollo, and Kontur.Focus, need their own accounts, API keys, or paid plans. The skill does not provide these, so you must obtain them yourself if you want to use them.

The skill runs no scripts, but it does use the network, because the agent is directed to visit the linked services.

• A web browser and internet access
• Your own accounts, API keys, or paid plans for gated tools such as Shodan, Censys, Hunter.io, Apollo, and Kontur.Focus

Safety notes: scope, legality and privacy

Use this skill only with a clear legal scope or permission for the target. The source notes that active reconnaissance can be illegal or violate terms of service. Do not use it to profile or locate private individuals without authorization. The source specifically warns that people search, phone lookup, and face search tools can enable stalking or harassment.

Because the skill uses the network and points to live services, check the terms of each service before using it, and keep records of what you collected and why.

• Confirm written authorization or a defined scope before starting.
• Do not use people search, phone lookup, or face search tools against private individuals without authorization.
• Respect the terms of service of each linked website.
• Expect some listed services to change or disappear, since the file contains links only.

Tips for getting useful results

Name the scope precisely at the start. A clear target list (domain, organization, person, address, or image) lets the agent select categories rather than searching broadly. Ask for the archive and JSONL log up front so artifacts are saved as you go.

Expect to supply accounts for the paid or gated tools you want the agent to use, and tell the agent which ones you have access to.

• State the scope and authorization in the first message.
• Ask the agent to archive each artifact with URL, timestamp, screenshot, and SHA-256 hash.
• Ask for the findings in JSONL with a run_id so you can reproduce the run.
• Tell the agent which paid tools you already have accounts for.