Metabigor OSINT Recon
j3ssie/metabigor
Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.
Perform OSINT and external reconnaissance for approved targets.
Install Osint Recon
$ npx skills add SpecterOps/skills --skill osint-recon -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install SpecterOps/skills osint-recon --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ops-reconnaissance/skills/osint-recon .claude/skills/osint-recon && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "osint-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-reconnaissance/skills/osint-recon into .claude/skills/osint-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osint-recon", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/SpecterOps/skills/tree/main/plugins/ops-reconnaissance/skills/osint-reconType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add SpecterOps/skills --skill osint-recon -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install SpecterOps/skills osint-recon --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/ops-reconnaissance/skills/osint-recon .agents/skills/osint-recon && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "osint-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-reconnaissance/skills/osint-recon into .agents/skills/osint-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osint-recon", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add SpecterOps/skills --skill osint-recon -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install SpecterOps/skills osint-recon --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/ops-reconnaissance/skills/osint-recon .cursor/skills/osint-recon && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "osint-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-reconnaissance/skills/osint-recon into .cursor/skills/osint-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osint-recon", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/SpecterOps/skills.git --path plugins/ops-reconnaissance/skills/osint-recon--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add SpecterOps/skills --skill osint-recon -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install SpecterOps/skills osint-recon --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/ops-reconnaissance/skills/osint-recon .gemini/skills/osint-recon && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "osint-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-reconnaissance/skills/osint-recon into .gemini/skills/osint-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osint-recon", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install SpecterOps/skills osint-reconInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add SpecterOps/skills --skill osint-recon -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/ops-reconnaissance/skills/osint-recon .github/skills/osint-recon && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "osint-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-reconnaissance/skills/osint-recon into .github/skills/osint-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osint-recon", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add SpecterOps/skills --skill osint-recon -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install SpecterOps/skills osint-recon --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/ops-reconnaissance/skills/osint-recon .opencode/skills/osint-recon && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "osint-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-reconnaissance/skills/osint-recon into .opencode/skills/osint-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "osint-recon", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
osint-recon- GitHub stars
- 704
- Token cost
- ~813 tokens
- SKILL.md length
- 199 words
- Files
- 4 (incl. assets)
- Skills in repo
- 38
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Perform OSINT and external reconnaissance for approved targets.
- Works in 2 steps: Passive Recon (All Depths) → Active Recon (Active/Full Depth)
- Subdomain discovery
- SKILL.md covers Input Parsing, Execution Policy, Workflow and Phase 1: Passive Recon (All…, plus 3 more sections
- Calls curl; reaches crt.sh
What it does
Osint Recon is an agent skill from SpecterOps/skills. Perform OSINT and external reconnaissance for approved targets. Use for subdomain discovery, infrastructure mapping, technology fingerprinting, and recon reporting with optional command execution.
Its SKILL.md is about 810 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including assets (for example `agents/openai.yaml`).
It sits in Security, covering OSINT. The repository describes itself as: A marketplace for LLM skills. The licence is Apache-2.0.
When your agent uses it
- Subdomain discovery
- Infrastructure mapping
- Technology fingerprinting
- Recon reporting with optional command execution
Example prompts
- “/osint-recon”
Workflow steps
2 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit e655f93. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
curl
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
crt.sh
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Osint Recon loads about 813 tokens when it runs. Until then it costs about 52 tokens; SKILL.md has 199 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from SpecterOps/skills at commit e655f93, republished under its Apache-2.0 licence (© SpecterOps). 199 words, ~813 tokens.
Download SKILL.mdSave it as
.claude/skills/osint-recon/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- osint-recon
- description
- Perform OSINT and external reconnaissance for approved targets. Use for subdomain discovery, infrastructure mapping, technology fingerprinting, and recon reporting with optional command execution.
- metadata.author
- GhostWorks
OSINT Recon
Run structured reconnaissance against user-provided authorized targets.
Input Parsing
Accept input as: TARGET [DEPTH] [MODE]
Depth:
passive(default)activefull
Mode:
plan: report plan + command set onlyexecute(default, preferred): run command batches and capture evidence
If mode is omitted, default to execute.
Examples:
$osint-recon example.com$osint-recon example.com active$osint-recon "Acme Corp" full execute$osint-recon 203.0.113.0/24 passive execute
Execution Policy
- Always generate recon plan first.
- In
executemode (default):- run command batches autonomously for routine in-scope actions,
- request approval only for OPSEC-dangerous actions,
- provide brief OPSEC warning for active/noisy actions.
- Capture exact commands and key outputs in the report.
Workflow
- Create output directory:
mkdir -p recon/<target-slug>/
- Run passive recon for all depths.
- Run active recon only for
activeorfulldepth; require approval only for OPSEC-dangerous steps. - Correlate findings and prioritize exploitable attack surface.
- Save report:
recon/<target-slug>/recon-report.md
Phase 1: Passive Recon (All Depths)
Suggested commands:
# Subdomains
subfinder -d <target> -silent -o recon/<target-slug>/subdomains.txt
# DNS records
dig +short <target> A
dig +short <target> MX
dig +short <target> TXT
dig +short <target> NS
# Certificate transparency
curl -s "https://crt.sh/?q=%25.<target>&output=json"
# WHOIS
whois <target>Investigate:
- ASN/IP ownership and provider footprint
- CDN/WAF presence
- exposed technologies and externally reachable services
- credential/leak indicators from public sources
Phase 2: Active Recon (Active/Full Depth)
Suggested commands:
# HTTP probing / tech fingerprinting
httpx -l recon/<target-slug>/subdomains.txt -title -status-code -tech-detect -o recon/<target-slug>/httpx.txt
# Quick TCP service scan
nmap -sC -sV --top-ports 1000 -oA recon/<target-slug>/nmap-quick <target>
# Full TCP scan (noisier)
nmap -sC -sV -p- -oA recon/<target-slug>/nmap-full <target>
# Directory discovery
ffuf -u https://<target>/FUZZ -w <wordlist> -mc 200,301,302,403
# Template-based checks
nuclei -l recon/<target-slug>/subdomains.txt -o recon/<target-slug>/nuclei.txtReporting Template
# OSINT Report ? <target>
## Depth: <passive|active|full>
## Mode: <plan|execute>
## Timestamp: <utc timestamp>
## Executive Summary
- High-level attack-surface summary.
## Findings
- Subdomains / hosts
- Infrastructure ownership and hosting
- Technology fingerprints
- Notable exposures
## Commands and Evidence
- exact command
- key output
- interpretation
## Prioritized Next Steps
1. next action
2. next actionQuality Rules
- Keep results target-specific and evidence-backed.
- Distinguish confirmed findings vs hypotheses.
- Prioritize exploitability over raw finding count.
© SpecterOps, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files (assets) in plugins/ops-reconnaissance/skills/osint-recon of SpecterOps/skills.
- SKILL.md
- agents/openai.yaml
- assets/icon.png
- assets/icon.svg
Open the folder on GitHubat commit e655f93
Compare with similar skills
Osint Recon next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Osint Recon this skillSpecterOps/skills | 704 | — | ~813 | Automated safety check: Pass | Apache-2.0 | |
| Metabigor OSINT Reconj3ssie/metabigor | 1.8k | — | ~2.4k | Automated safety check: Pass | MIT | |
| Ctf Osintljagiello/ctf-skills | 3.4k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| ShadowBroker Intelligence ClientBigBodyCobain/Shadowbroker | 11k | — | ~8.9k | Automated safety check: Warn | AGPL-3.0 | |
| Awesome Osint Operatorshoyann/RZK-The-Hunter | 141 | — | ~4.8k | Automated safety check: Pass | CC-BY-SA-4.0 | |
| Run Claude Osintelementalsouls/Claude-OSINT | 2.8k | — | ~1.2k | Automated safety check: Pass | MIT |
Similar skills
Ctf Osint
ljagiello/ctf-skills
Provides open source intelligence techniques for CTF challenges.
ShadowBroker Intelligence Client
BigBodyCobain/Shadowbroker
Lets an agent query a ShadowBroker OSINT platform for tracked flights, ships, satellites and news, and place its findings on the map as intel pins.
Awesome Osint Operator
shoyann/RZK-The-Hunter
Ethical, evidence-first OSINT planning, tool selection, verification, monitoring, reporting, and guarded official wanted/fugitive-person location intelligence using a structured catalog adapted from…
Run Claude Osint
elementalsouls/Claude-OSINT
Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secretscan.py and h1reference.py helpers, run sync-skill-content.sh, run the smoke test.
Osint
smixs/osint-skill
Conduct deep OSINT research on individuals. An agent skill from smixs/osint-skill.
More from SpecterOps/skills
All 38 skills in this repoCodex Activity Report
SpecterOps/skills
Generate a normalized UTC timeline and evidence-based narrative from Codex activity artifacts.
Com Proxy Triage
SpecterOps/skills
A skill your agent uses when the user wants to triage Windows COM proxy/hijack candidates by capturing HKCU\Software\Classes\CLSID\{...}\InProcServer32 NAME NOT FOUND lookups for a process, mapping…
Cwe Code Review
SpecterOps/skills
Perform CWE-grounded security code reviews and precise weakness mapping using a locally derived MITRE CWE corpus, relationship graphs, mapping notes, detection methods, mitigations, and schema…
Ghostwriter Oplog
SpecterOps/skills
A skill your agent uses for Ghostwriter operation log entries from Codex, including config guidance, quick notes, evidence-backed entries, and guided oplog capture through the Ghostwriter MCP tools.
Nmap Parse
SpecterOps/skills
Parse nmap scan output and generate actionable recon notes. An agent skill from SpecterOps/skills.
Proxychains Tunnel
SpecterOps/skills
Run in-scope network commands through a SOCKS5 tunnel with proxychains4, including tunnel readiness checks and evidence capture.
Related
Categories
Questions about Osint Recon
What does Osint Recon do?
Perform OSINT and external reconnaissance for approved targets. Osint Recon is an agent skill from SpecterOps/skills. Perform OSINT and external reconnaissance for approved targets.
When should I use Osint Recon?
Osint Recon fits situations like: subdomain discovery; infrastructure mapping; technology fingerprinting; recon reporting with optional command execution.
How do I install Osint Recon in Claude Code?
Run `npx skills add SpecterOps/skills --skill osint-recon -a claude-code`. Or copy the skill folder (plugins/ops-reconnaissance/skills/osint-recon in SpecterOps/skills) into .claude/skills/osint-recon in your project. Claude Code loads it when a task matches its description.
How do I install Osint Recon in Codex?
Run `npx skills add SpecterOps/skills --skill osint-recon -a codex`. Or copy the skill folder (plugins/ops-reconnaissance/skills/osint-recon in SpecterOps/skills) into .agents/skills/osint-recon in your project. Codex loads it when a task matches its description.
Can I use Osint Recon in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add SpecterOps/skills --skill osint-recon -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/osint-recon, .gemini/skills/osint-recon, .github/skills/osint-recon and .opencode/skills/osint-recon in your project.
What does Osint Recon need to run?
Going by SKILL.md and its folder, Osint Recon needs the command-line tools its instructions call (curl).
Does Osint Recon access the network?
SKILL.md names 1 domain. In commands or code: crt.sh; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Is Osint Recon safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Osint Recon use?
Osint Recon is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Osint Recon use?
About 813 tokens (SKILL.md is roughly 3.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Osint Recon?
Skills that share tags, products or a category with Osint Recon: Metabigor OSINT Recon (j3ssie/metabigor, 1.8k stars), Ctf Osint (ljagiello/ctf-skills, 3.4k stars), ShadowBroker Intelligence Client (BigBodyCobain/Shadowbroker, 11k stars) and Awesome Osint Operator (shoyann/RZK-The-Hunter, 141 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Osint Recon?
SpecterOps (a GitHub organization) maintains it in SpecterOps/skills, which has 704 GitHub stars. The repository holds 38 skills in this directory. The repository was last updated on September 23, 2026.
Source: SpecterOps/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.