UseOSINT/Skills

What it claims

A set of 28 agent skills, 10 named workflows and 18 technique skills, that turns a coding agent (Cursor, Claude, others) into an OSINT investigator. It pivots from one known identifier to the next and outputs a report in which every claim carries a source and a confidence level. The repo says each skill encodes "tradecraft": where a source is unreliable, which results are artefacts of the tool, and what it takes to call something confirmed. It also claims nothing is reported as fact off a single weak match.

How it works

You pick a workflow by what you already hold. If you are unsure, investigate-anything routes you. Every workflow converges on write-the-intel-brief.

flowchart TD
    Q{What you hold} -->|name| P[find-anyone]
    Q -->|company| C[x-ray-a-company]
    Q -->|domain / IP| D[recon-a-domain-passively]
    Q -->|username| U[hunt-a-handle]
    Q -->|email| E[what-an-email-reveals]
    Q -->|phone| PH[whose-number-is-this]
    Q -->|photo / video| G[where-was-this-taken]
    Q -->|social profile| S[pattern-of-life-from-socials]
    Q -->|unknown| R([investigate-anything]) -.-> Q
    P & C & D & U & E & PH & G & S --> RPT[[write-the-intel-brief]]

Workflows fan out across technique skills rather than doing one lookup. For example, recon-a-domain-passively calls these in parallel:

• who-owns-this-domain
• find-hidden-subdomains (certificate transparency), which feeds find-exposed-servers
• read-deleted-pages (Wayback)
• secrets-in-git-history

A registrant found this way can pivot into x-ray-a-company. An email chain runs through what-leaked-about-you, then reused usernames, then cross-platform accounts and photos, then location, ending in a "corroborated identity."

How to use it

git clone https://github.com/useosint/osint-skills.git
cd osint-skills
./install.sh

• install.sh symlinks all 28 skills into ~/.cursor/skills, so git pull keeps them current. Restart the agent afterward.
• To install for a single project instead, copy the skills/ folder into that repo's .cursor/skills/.
• The clone URL (useosint/osint-skills) differs from the catalogued URL (UseOSINT/Skills). Check which one resolves.
• The install path targets Cursor. The page gives no install step for other agents.
• Some tools need your own API keys: Shodan, HIBP and DeHashed. The page says free alternatives are noted inline in the skills.
• Contribution convention: one folder, one SKILL.md, passive-first, and every technique backed by a real tool and source (see CONTRIBUTING.md).

Limits

• Sample output is illustrative only. The README's sample run is labelled illustrative. Real results depend on the target and on which API keys you have.
• No accuracy evidence. The page gives no evaluation of accuracy or false-positive rates. The confidence levels and "confirmed" thresholds are design claims.
• Licence. MIT, "no warranty. What you do with it is on you."
• Scope and legality. Every workflow requires you to state scope and authorization before acting, and is passive by default. The page says logging into others' accounts, using leaked passwords, scanning hosts you don't own, stalking and doxxing are out of scope and illegal in most places. Details are in ETHICS.md.
• Breach lookups need legal review. Breach-data lookups and person-locating workflows are included, so check your jurisdiction and policy before deploying this inside an organisation.