useosint/skills

**Open-source Intelligence, AI 에이전트에 의해 실행. **

Reconnaissance · Attribution · GEOINT · Breach checks · 불쾌

---

Cursor, Claude 및 다른 코딩 에이전트가 실제로 실행하는 28 가지 기술 open-source-intelligence investigation — 이메일에서 breach에 reused handle to real name, geolocate a photo from the pixels, 지도 a 회사의 자회사 — vibes 대신 소스로 작성합니다.

2개의 종류:

• **10 당신은 이름으로 실행 ** — 사람, 회사, 도메인에 대한 엔드 투 엔드 워크 사용자 이름, 이메일, 전화, 사진 또는 소셜 계정.
• **18 에이전트는 자체에 대한 도달 ** - 개인 기술 그 워크플로우(reverse image search, WHOIS, 인증서 투명성, breach lookups, 동기화, 등).

대상에 있습니다. 작업 흐름을 선택, 기술을 체인, 그리고 모든 클레임이 소스와 신뢰 수준을 가지고있는 보고서를 다시.

이 aren’t 속임수 시트. 모든 기술은 무역선을 분리하는 발견에서 리드 - 각 소스가 당신에게 속한 곳, 결과가 도구가 작동하는 방법의 artefacts, 그리고 뭔가를 호출하는 데 걸리는.

---

28 skills that let Cursor, Claude, and other coding agents actually run an open-source-intelligence investigation — pivot from an email to a breach to a reused handle to a real name, geolocate a photo from the pixels, map a company’s subsidiaries — and write it up with sources instead of vibes.

Two kinds:

• 10 you run by name — end-to-end workflows for a person, company, domain, username, email, phone, photo, or social account.
• 18 the agent reaches for on its own — the individual techniques those workflows lean on (reverse image search, WHOIS, certificate transparency, breach lookups, chronolocation, and so on).

You point it at a target. It picks the workflow, chains the techniques, and hands back a report where every claim has a source and a confidence level.

These aren’t cheat sheets. Every skill carries the tradecraft that separates a lead from a finding — where each source lies to you, which results are artefacts of how the tool works, and what it takes to call something confirmed. Each one ships with reference/ material too: the query cookbooks, per-country indicator guides, registry catalogues, and format tables you’d otherwise keep in a browser tab.

What a run looks like

> recon-a-domain-passively example.com

scope        passive only, no scanning
whois        NameCheap, created 2019-03-11, registrant behind privacy guard
dns          MX → Google Workspace · SPF lists sendgrid + mailgun
crt.sh       14 subdomains, incl. staging.example.com and vpn.example.com
shodan       vpn:443 Fortinet · staging exposes :8080 Jenkins (no auth)
wayback      2021 team page named 6 staff, since deleted

pivoted 3 staff → LinkedIn, flagged the open Jenkins, wrote report.md

Illustrative — a real run depends on the target and which tools you have keys for. The skills are the technique and the tooling; some tools (Shodan, HIBP, DeHashed) want their own API key, and free alternatives are called out inline.

Install

git clone https://github.com/useosint/osint-skills.git
cd osint-skills
./install.sh

install.sh symlinks all 28 skills into ~/.cursor/skills, so git pull keeps them current. Restart your agent afterward.

| Command | Installs to |