Osint Autopilot
End-to-end external OSINT engagement autopilot.
Install
npx skills add elementalsouls/Claude-OSINT --skill osint-autopilot -g -a claude-code -y- Repository
- elementalsouls/Claude-OSINT2.9k
- Category
- Documents
- Updated
- 15d ago
- License
- MIT
- Context cost
- Lightabout 1,189 tokens
- Runs scripts
- Yes, review before use
What it does
End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain, engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generated findings, and a consolidated multi-tab .xlsx deliverable. Stops ONLY for Stage 6 (active exploitation) arming and out-of-scope sibling assets. Use whenever asked to "run OSINT / recon / attack-surface" on a target, do NOT deliver a thin passive first pass.
OSINT Autopilot
Purpose: eliminate the "thin first pass, then user pushes for more" failure. When the user says run OSINT/recon on <domain> (authorized), execute the whole pipeline to completion and hand back the consolidated workbook, no stopping to ask except the two hard gates below.
Read the companion osint-methodology skill for the framework; this skill is the executable runbook. Feedback memory osint-full-pipeline-default governs the default.
Hard gates (the ONLY reasons to stop and ask)
- Authorization, if not already asserted, ask the one scope question, then proceed. (Here it's typically already signed.)
- Stage 6 (active exploitation), BOLA/IDOR, credential replay, injection confirmation. Never run under autopilot; present the ranked target queue and wait for arming.
- Out-of-scope siblings, a newly-discovered sibling domain/brand (e.g.
<company>.iowhen scope was.com). Flag; don't scan until confirmed.
Everything in Stages 1, 5 runs without pausing for questions.
Run sequence
Let S = ~/.claude/skills/osint-autopilot/scripts.
1. Deterministic recon (Stages 1, 3 + harvest + breach + ports)
bash $S/recon_pipeline.sh <domain>
Creates ~/Research/engagements/<domain>/ and populates evidence (DNS/WHOIS/RDAP/email-sec, subdomain union via subfinder+certspotter+crt.sh, dig-resolve, HTTP probe, identity fabric, /version disclosure, S3 takeover check, gau+wayback+JS harvest, HudsonRock breach, bounded public-IP port scan), hashes everything, and splits responsive hosts into buckets/bucket-NN.
Host notes baked in: uses dig/curl (ProjectDiscovery dnsx/httpx segfault on this M1, cgo m1cpu); nmap is time-capped at 10 min so it can't stall.
2. Multi-agent per-host fan-out (Stage 4 exposure)
Read buckets/COUNT and the buckets/bucket-* paths, then launch the workflow (ffuf must be on PATH, go install github.com/ffuf/ffuf/v2@latest if missing):
