New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Collecting Open Source Intelligence

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and…

Apache-2.0Auto-check passedSecurity

Install Collecting Open Source Intelligence

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills collecting-open-source-intelligence --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/collecting-open-source-intelligence .claude/skills/collecting-open-source-intelligence && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
collecting-open-source-intelligence
GitHub stars
34k
Token cost
~1.8k tokens
SKILL.md length
639 words
Files
4 (incl. scripts, references)
Skills in repo
637
Repo updated
First seen
Licence
Apache-2.0

At a glance

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and…

  • Works in 5 steps: Define Collection Requirements → Passive DNS and WHOIS Investigation → Shodan Infrastructure Mapping → …
  • Investigating external threat actor infrastructure
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 2 more sections
  • Runs Python scripts from its folder; calls curl, jq and python; reaches api.securitytrails.com and crt.sh

What it does

Collecting Open Source Intelligence is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or…

Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering OSINT. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Investigating external threat actor infrastructure
  • Performing pre-engagement reconnaissance for authorized red team assessments
  • Enriching CTI reports with publicly available adversary context

Example prompts

  • “Use the collecting-open-source-intelligence skill to collect and synthesizes open-source intelligence (OSINT) about threat actors, malicious…”
  • “/collecting-open-source-intelligence”

Requirements

  • Python 3
  • A credential in YOUR_KEY
  • A credential in YOUR_SHODAN_API_KEY

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Define Collection Requirements
  2. Passive DNS and WHOIS Investigation
  3. Shodan Infrastructure Mapping
  4. Maltego Graph Analysis
  5. Dark Web and Paste Site Monitoring

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • curl
    • jq
    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • api.securitytrails.com
    • crt.sh

    Also links to:

    • shodan.io
    • osintframework.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Collecting Open Source Intelligence loads about 1.8k tokens when it runs, and up to ~2.3k if it reads all its reference files. Until then it costs about 144 tokens; SKILL.md has 639 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~144
When it runs · the whole SKILL.md, loaded when a task matches
~1.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 639 words, ~1,759 tokens.

Download SKILL.mdSave it as .claude/skills/collecting-open-source-intelligence/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
collecting-open-source-intelligence
description
Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.
domain
cybersecurity
subdomain
threat-intelligence
tags
OSINT, Maltego, Shodan, Recon-ng, SpiderFoot, threat-intelligence, ATT&CK-T1591, NIST-CSF
version
1.0.0
author
mahipal
license
Apache-2.0
nist_csf
ID.RA-01, ID.RA-05, DE.CM-01, DE.AE-02
mitre_attack
T1593.001, T1589.002, T1596.002, T1590, T1596.001

Collecting Open-Source Intelligence

When to Use

Use this skill when:

  • Investigating external infrastructure associated with a phishing campaign targeting your organization
  • Enriching threat actor profiles with publicly observable indicators (WHOIS, ASN data, SSL certificates)
  • Conducting authorized attack surface discovery to understand your organization's external exposure

Do not use this skill for active scanning against targets without explicit written authorization — OSINT collection must remain passive (no packets sent to target systems) unless scope permits active recon.

Prerequisites

  • Maltego CE or commercial license for graph-based link analysis
  • Shodan API key (https://shodan.io) for internet-wide device/service discovery
  • OSINT Framework familiarity (https://osintframework.com) for tool selection
  • SpiderFoot HX or open-source SpiderFoot for automated OSINT correlation

Workflow

Step 1: Define Collection Requirements

Establish the intelligence requirement (IR) before collecting. Document:

  • Target: threat actor group, malicious domain, IP range, or organization
  • Priority Intelligence Requirements (PIRs): What specific questions need answering?
  • Legal authority: Passive OSINT is legal; active probing requires authorization
  • Data handling: TLP classification for collected intelligence
Step 2: Passive DNS and WHOIS Investigation
bash
# Passive DNS via SecurityTrails API
curl "https://api.securitytrails.com/v1/domain/evil-domain.com/dns/a" \
  -H "apikey: YOUR_KEY"

# WHOIS history via ARIN / RIPE
whois -h whois.arin.net evil-domain.com

# Certificate transparency logs (no API key required)
curl "https://crt.sh/?q=%.evil-domain.com&output=json" | jq '.[].name_value'

Certificate transparency logs reveal all subdomains for a target domain, often exposing staging, VPN, or internal infrastructure inadvertently made public.

Step 3: Shodan Infrastructure Mapping
python
import shodan

api = shodan.Shodan("YOUR_SHODAN_API_KEY")

# Search for specific C2 framework signatures (Cobalt Strike beacon)
results = api.search('product:"Cobalt Strike" port:443')
for r in results['matches']:
    print(r['ip_str'], r['port'], r['org'], r.get('ssl', {}).get('cert', {}).get('subject', ''))

# Find infrastructure associated with a known threat actor's ASN
results = api.search('asn:AS12345 http.title:"Redirector"')

Correlate Shodan results with passive DNS to build infrastructure clusters.

Step 4: Maltego Graph Analysis

In Maltego, use these built-in transforms for threat actor infrastructure mapping:

  1. Start with a known malicious domain (Entity: Domain)
  2. Run "To IP Address [DNS]" → identifies hosting IPs
  3. Run "To Shared Hosting" → identifies co-hosted domains (potentially same threat actor)
  4. Run "To DNS Name [Reverse DNS]" → identifies PTR records
  5. Run "To Whois" → identifies registrant email/organization
  6. Pivot on registrant email → "To Domains [Registrant Email]" → expands to all domains registered with same email

Maltego Maltego Cyber threat intelligence transforms (VirusTotal, Shodan, PassiveTotal, URLScan) extend graph coverage.

Step 5: Dark Web and Paste Site Monitoring

Use SpiderFoot HX or manual searches for:

  • Paste sites (Pastebin, Ghostbin): search for leaked credentials, IOCs, malware configs
  • Dark web forums: via Tor browser with appropriate operational security
  • GitHub/GitLab: search for exposed credentials or organization-specific strings
bash
# SpiderFoot CLI for automated OSINT
python sf.py -s evil-domain.com -m sfp_shodan,sfp_virustotal,sfp_passivetotal \
  -o TF -R result.json
Show full SKILL.md (301 more words)Show less

Key Concepts

TermDefinition
Passive OSINTIntelligence collection that does not send any packets to target systems — uses public databases, search engines, cached data
PIRPriority Intelligence Requirement — specific question the intelligence collection must answer, preventing unfocused data gathering
Certificate TransparencyPublic log of all SSL/TLS certificates issued by CAs, enabling discovery of subdomains via crt.sh
PivotingUsing one data point (IP, email, registrant name) to discover related infrastructure or accounts
ASNAutonomous System Number — block of IP addresses under a single routing policy; useful for clustering threat actor infrastructure
Co-hosted DomainsMultiple domains resolving to the same IP, potentially indicating shared attacker infrastructure

Tools & Systems

  • Maltego: Graph-based link analysis platform with 50+ data source transforms for IP, domain, email, and social media analysis
  • Shodan: Internet-wide scanner database with 1B+ indexed devices; supports banner, port, SSL certificate, and vulnerability searches
  • SpiderFoot: Automated OSINT tool with 200+ modules covering DNS, WHOIS, dark web, breach data, and social media
  • Recon-ng: Python-based OSINT framework with modular design for domain, email, and social media reconnaissance
  • crt.sh: Free certificate transparency search engine for subdomain and certificate discovery
  • OSINT Framework (osintframework.com): Curated directory of OSINT tools organized by intelligence category

Common Pitfalls

  • Leaving digital footprints: Visiting a threat actor's website or Shodan-queried IP can alert the adversary. Use Tor or VPN with a dedicated OSINT VM.
  • Confirmation bias in graph analysis: Maltego graphs can create false connections. Verify each pivot independently before treating as confirmed.
  • Outdated data: WHOIS privacy services and bulletproof hosting rotate frequently. Always check data timestamps — 6-month-old passive DNS may no longer be valid.
  • Attribution overconfidence: Infrastructure overlap does not guarantee same threat actor. False flag operations deliberately share indicators across groups.
  • Legal boundaries: Some OSINT tools perform active scans (port scanning, banner grabbing). Confirm tool behavior before use against external targets without authorization.

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/collecting-open-source-intelligence of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Collecting Open Source Intelligence next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Collecting Open Source Intelligence compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Collecting Open Source Intelligence this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.8kAutomated safety check: PassApache-2.0
Metabigor OSINT Reconj3ssie/metabigor1.9k—~2.4kAutomated safety check: PassMIT
Ctf Osintljagiello/ctf-skills3.4k2 repos~2.3kAutomated safety check: NotesMIT
ShadowBroker Intelligence ClientBigBodyCobain/Shadowbroker11k—~8.9kAutomated safety check: WarnAGPL-3.0
Awesome Osint Operatorshoyann/RZK-The-Hunter140—~4.8kAutomated safety check: PassCC-BY-SA-4.0
Run Claude Osintelementalsouls/Claude-OSINT2.8k—~1.2kAutomated safety check: PassMIT

Similar skills

  • Metabigor OSINT Recon

    j3ssie/metabigor

    Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.

    1.9k GitHub stars~2.4k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Ctf Osint

    ljagiello/ctf-skills

    Provides open source intelligence techniques for CTF challenges.

    3.4k GitHub starsUsed in 2 repos~2.3k tokens
    SecurityAuto-check: notes

  • ShadowBroker Intelligence Client

    BigBodyCobain/Shadowbroker

    Lets an agent query a ShadowBroker OSINT platform for tracked flights, ships, satellites and news, and place its findings on the map as intel pins.

    11k GitHub stars~8.9k tokensUpdated 2 days ago
    SecurityAuto-check: warnings

  • Awesome Osint Operator

    shoyann/RZK-The-Hunter

    Ethical, evidence-first OSINT planning, tool selection, verification, monitoring, reporting, and guarded official wanted/fugitive-person location intelligence using a structured catalog adapted from…

    140 GitHub stars~4.8k tokensUpdated 18 days ago
    SecurityAuto-check passed

  • Run Claude Osint

    elementalsouls/Claude-OSINT

    Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secretscan.py and h1reference.py helpers, run sync-skill-content.sh, run the smoke test.

    2.8k GitHub stars~1.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Osint

    smixs/osint-skill

    Conduct deep OSINT research on individuals. An agent skill from smixs/osint-skill.

    140 GitHub stars~5.5k tokensUpdated 7 mo ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 637 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Collecting Open Source Intelligence

What does Collecting Open Source Intelligence do?

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and…. Collecting Open Source Intelligence is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring.

When should I use Collecting Open Source Intelligence?

Collecting Open Source Intelligence fits situations like: investigating external threat actor infrastructure; performing pre-engagement reconnaissance for authorized red team assessments; enriching CTI reports with publicly available adversary context.

How do I install Collecting Open Source Intelligence in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence -a claude-code`. Or copy the skill folder (skills/collecting-open-source-intelligence in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/collecting-open-source-intelligence in your project. Claude Code loads it when a task matches its description.

How do I install Collecting Open Source Intelligence in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence -a codex`. Or copy the skill folder (skills/collecting-open-source-intelligence in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/collecting-open-source-intelligence in your project. Codex loads it when a task matches its description.

Can I use Collecting Open Source Intelligence in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill collecting-open-source-intelligence -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/collecting-open-source-intelligence, .gemini/skills/collecting-open-source-intelligence, .github/skills/collecting-open-source-intelligence and .opencode/skills/collecting-open-source-intelligence in your project.

What does Collecting Open Source Intelligence need to run?

Going by SKILL.md and its folder, Collecting Open Source Intelligence needs Python for the scripts in its folder and the command-line tools its instructions call (curl, jq and python). Our summary lists: Python 3; A credential in YOUR_KEY; A credential in YOUR_SHODAN_API_KEY.

Does Collecting Open Source Intelligence access the network?

SKILL.md names 4 domains. In commands or code: api.securitytrails.com and crt.sh; the agent is likely to contact these when it follows the instructions. As links in the text: shodan.io and osintframework.com. This is read from the text; nothing was executed.

Is Collecting Open Source Intelligence safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Collecting Open Source Intelligence use?

Collecting Open Source Intelligence is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Collecting Open Source Intelligence use?

About 1.8k tokens (SKILL.md is roughly 7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 513 tokens, read only when the agent opens those files.

What are the alternatives to Collecting Open Source Intelligence?

Skills that share tags, products or a category with Collecting Open Source Intelligence: Metabigor OSINT Recon (j3ssie/metabigor, 1.9k stars), Ctf Osint (ljagiello/ctf-skills, 3.4k stars), ShadowBroker Intelligence Client (BigBodyCobain/Shadowbroker, 11k stars) and Awesome Osint Operator (shoyann/RZK-The-Hunter, 140 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Collecting Open Source Intelligence?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,922 GitHub stars. The repository holds 637 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.