8 克劳德技能 ·100+ 侦察能力 ·80 秘密正则表达模式 ·80+ 呆子 ·9 个只读凭证验证器 ·27 个攻击路径模板 ·~10,000 行结构化的贸易工具。可插入的 SKILL.md 文件，使克劳德成为授权红队和漏洞悬赏任务中的神模式外部侦察操作员。

由Sachin Sharma — 生成式AI安全研究团队开发。

赞助商

    

---

这是什么？

claude-osint 是克劳德技能系统的技能库。每个技能是一个结构化的SKILL.md文件，为克劳德提供专家级方法论，针对进攻侦察问题的一部分。

核心搭档——侦察骨干：

• osint-methodology - 如何思考。 战略 + 程序化。资产图纪律、严重度评分标准、时间预算、身份-结构映射、交付模板。
• offensive-osint - 该去拿什么。 战术武器库。探测路径、正则表达、载荷、计分规则、弯线妙语、工具网址。

六项组织级深度技能——核心对不具备的企业级攻击面推理：

claude-osint

8 Claude skills · 100+ recon capabilities · 80 secret-regex patterns · 80+ dorks · 9 read-only credential validators · 27 attack-path templates · ~10,000 lines of structured tradecraft. Drop-in SKILL.md files that turn Claude into a god-mode external recon operator for authorized red-team and bug-bounty engagements.

Built by Sachin Sharma — GenAI Security Research.

SPONSORED BY

    

---

What is this?

claude-osint is a library of skills for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for one part of the offensive recon problem.

The core pair — the recon backbone:

• osint-methodology - how to think. Strategic + procedural. Asset-graph discipline, severity rubric, time budgeting, identity-fabric mapping, deliverable templates.
• offensive-osint - what to reach for. Tactical arsenal. Probe paths, regexes, payloads, scoring rules, curl one-liners, tool URLs.

Six organization-grade depth skills — enterprise-scale attack-surface reasoning the core pair doesn’t carry:

• org-attack-surface - legal entity → owned footprint (GLEIF org-tree, org-first RIR “dark netblock” recall, ASN hyperscaler-scope guard). Discover-only.
• email-domain-security - composite spoofability verdict (envelope vs header-From; SPF -all alone ≠ spoof-proof) + SPF supply-chain analysis.
• exposure-risk-quantification - FAIR 0–100 + A–F risk score, $-denominated loss model, board one-pager, ownership/proof honesty caps.
• continuous-exposure-monitoring - re-scan/diff loop + CTI/ransomware chatter + finding-lifecycle FP discipline + durable alert outbox.
• cloud-saas-exposure - bucket ownership-gated severity + offline AWS account-ID decode + dependency-confusion confirmation + K8s/CI fingerprint.
• identity-provider-recon - tenant/federation mapping + pre-auth user-enumeration oracle + name×pattern login synthesis, with a hard enumeration boundary.

Drop them into your Claude environment and it behaves like a senior recon analyst: it knows the techniques, the tooling, the edge cases, and the escalation paths — and it stays in scope.