UseOSINT/Skills

What it is

UseOSINT/Skills is an MIT-licensed skill pack for coding agents (Cursor, Claude, and others) that turns them into OSINT operators. The 28 skills split into two tiers: 10 named end-to-end workflows you invoke directly (for a person, company, domain, username, email, phone, photo, or social account) and 18 technique skills the agent chains on its own (reverse image search, WHOIS, certificate transparency, breach lookups, chronolocation, etc.). Each skill ships a reference/ folder — query cookbooks, per-country indicator guides, registry catalogues, format tables.

How it works

You point it at a target; it selects a workflow, fans out across techniques, and returns report.md where each claim carries a source and confidence level. The model is a pivot chain — one known fact becomes the next lookup until multiple independent sources corroborate. If you don't know where to start, the investigate-anything skill routes you to the right workflow.

flowchart TD
    Q{What you have} -->|name| find-anyone
    Q -->|company| x-ray-a-company
    Q -->|domain/IP| recon-a-domain-passively
    Q -->|username| hunt-a-handle
    Q -->|email| what-an-email-reveals
    Q -->|photo| where-was-this-taken
    Q -->|no idea| investigate-anything
    investigate-anything -.routes.-> Q
    find-anyone --> RPT[[write-the-intel-brief]]
    recon-a-domain-passively --> RPT

A workflow is not a single lookup: recon-a-domain-passively fans into who-owns-this-domain, find-hidden-subdomains, read-deleted-pages, secrets-in-git-history, then subdomains feed find-exposed-servers, and a discovered registrant can pivot into x-ray-a-company.

Preconditions

Some techniques need API keys — Shodan, HIBP, DeHashed are named; free alternatives are called out inline per skill. Workflows are passive by default and force you to state scope and authorization before running (details in ETHICS.md).

What to do

Note the actual clone path differs from the repo title URL:

git clone https://github.com/useosint/osint-skills.git
cd osint-skills
./install.sh

install.sh symlinks all 28 skills into ~/.cursor/skills, so git pull keeps them current — restart your agent afterward. For a single project, drop the skills/ folder into that repo's .cursor/skills/ instead of installing machine-wide.

Caveats

The README's sample run (Fortinet VPN + unauthenticated Jenkins on a staging subdomain) is explicitly illustrative — real output depends on the target and which tool keys you hold. The license disclaims warranty.