Skip to content
Get packs

External OSINT Reconnaissance

Maps an organization's public internet footprint using passive OSINT for authorized pentests

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent follows a structured passive reconnaissance playbook against a target organization's domain: finding subdomains and DNS records, listing internet-facing services and cloud storage, gathering employee and email-format information, checking for leaked credentials and exposed documents, and profiling the technology stack. It explains which open-source tools and search techniques to use at each step and how to organize the findings into a target profile. A bundled Python script can also query certificate transparency logs, public DNS over HTTPS, and Shodan.

Great for

  • Penetration testers preparing the passive information-gathering phase of an authorized engagement
  • Red team operators scoping an organization's external attack surface before active testing
  • Security students learning how external footprinting and OSINT are structured

Skip it if

  • Investigating or monitoring private individuals, which the skill itself prohibits; it is risky and may breach privacy laws like GDPR or CCPA without a legitimate authorized scope
  • Organizations without written authorization for reconnaissance, since collecting employee data and leaked credentials without permission can be illegal
  • Non-security users wanting general company research, since the workflow is oriented to attack surface and social engineering preparation

Try asking

  • “Map the external attack surface of example-corp.com for our authorized pentest, starting with subdomains and certificate transparency logs”
  • “Build a list of likely employee email formats and key IT and security staff for an approved social engineering assessment”
  • “Check public code repositories and breach databases for exposed credentials tied to our client's domain”
  • “Profile the web technologies and TLS configuration exposed by the client's public websites”
Step-by-step guide: how to use External OSINT ReconnaissanceInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    conducting-external-reconnaissance-with-osint.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-external-reconnaissance-with-osint.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-external-reconnaissance-with-osint.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Confirm written scope and authorization before running any query, and keep a record of what was collected and why
  • Review scripts/agent.py before running it, since it sends queries to third-party services such as crt.sh, dns.google and Shodan using your API key
  • Ask the agent to stay passive and avoid active scanning or zone transfer attempts unless the engagement explicitly allows them

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.