96 skills · sorted by relevance
Investigate photos, videos, public accounts, and records using OSINT, research based on public information. Connect sparse clues, test competing explanations, and report evidence, confidence, and unresolved questions about locations, events, identities, or infrastructure relationships.
Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.
Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.
Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.
Investigate organizations, domains, media locations, and cryptocurrency flows using open-source intelligence, or OSINT. The skill helps select relevant research tools, connect findings across sources, and preserve evidence with timestamps, screenshots, file hashes, and reproducible logs.
Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secret_scan.py and h1_reference.py helpers, run sync-skill-content.sh, run the smoke test. Use when asked to run, build, test, validate, or smoke-test claude-osint or its OSINT skills/scripts.
The English summary is being prepared. Showing the original description.
End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generated findings, and a consolidated multi-tab .xlsx deliverable. Stops ONLY for Stage 6 (active exploitation) arming and out-of-scope sibling assets. Use whenever asked to "run OSINT / recon / attack-surface" on a target — do NOT deliver a thin passive first pass.
The English summary is being prepared. Showing the original description.
Conduct deep OSINT research on individuals. Build full digital footprint, psychoprofile (MBTI/Big Five), career history, social graph with confidence scores. Recursive self-evaluation until completeness threshold is met. Includes internal intelligence (Telegram history, email, vault contacts) before going external. Use when: "osint", "досье", "research person", "find everything about", "пробей", "разведка", "due diligence", "background check", "digital footprint", "найди всё про", "собери информацию", "кто это", "профиль человека". NOT for: company/product research without a named person, competitive analysis, market research, content generation, or general web scraping tasks.
The English summary is being prepared. Showing the original description.
Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
The English summary is being prepared. Showing the original description.
Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
The English summary is being prepared. Showing the original description.
Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
The English summary is being prepared. Showing the original description.
Structured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology.
The English summary is being prepared. Showing the original description.
Research companies from the terminal using a domain name. Intelwatch combines financial data and technology stack detection into readable company profiles, with an optional AI due diligence mode for examining potential acquisition targets.
Plan and run authorized security tests that simulate deceptive emails, calls, text messages, and in-person approaches. Measure employee responses, compare results across test methods, and report gaps in security awareness training and access controls.
Guides research into companies, markets, and technologies using public sources. Helps organize people and organizations, map their relationships, compare changes over time, assess source reliability, and structure reports with supporting links and sentiment trends.
Plan authorized security tests involving phone calls, text messages, physical access, and USB devices. Helps develop scenarios from public information, document interactions, and assess how staff verification procedures and physical controls respond.
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → asset expansion → enrichment → exposure analysis → convergence → operator-armed active validation) with connector-resilience and stage-vs-gating discipline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation with per-person identity dossiers, detectability tagging, detection-aware probing, WAF/CDN bypass, vulnerability prioritization, phishing infrastructure planning, bug bounty submission, and client deliverable templates. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, or producing client deliverables.
The English summary is being prepared. Showing the original description.
Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments
The English summary is being prepared. Showing the original description.
红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi
The English summary is being prepared. Showing the original description.
Structured OSINT collection methodology. Planning, collection techniques, search operators, and documentation. Loaded by the osint-researcher agent.
The English summary is being prepared. Showing the original description.
Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.
The English summary is being prepared. Showing the original description.
Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.
The English summary is being prepared. Showing the original description.
OSINT kategorisi SKILL.md — Kullanıcı araştırması, sosyal medya, subdomain keşfi araçları kurma rehberi
The English summary is being prepared. Showing the original description.
Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.
The English summary is being prepared. Showing the original description.