# Osint Autopilot

End-to-end external OSINT engagement autopilot.

- Repository: https://github.com/elementalsouls/Claude-OSINT (2943 stars)
- Category: Documents
- License: MIT
- Last updated: 2026-10-20
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add elementalsouls/Claude-OSINT --skill osint-autopilot -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-OSINT --skill osint-autopilot -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-OSINT --skill osint-autopilot -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-OSINT --skill osint-autopilot -g -a gemini-cli -y`

## Description

End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain, engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generated findings, and a consolidated multi-tab .xlsx deliverable. Stops ONLY for Stage 6 (active exploitation) arming and out-of-scope sibling assets. Use whenever asked to "run OSINT / recon / attack-surface" on a target, do NOT deliver a thin passive first pass.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# OSINT Autopilot

Purpose: eliminate the "thin first pass, then user pushes for more" failure. When the user says *run OSINT/recon on `<domain>`* (authorized), execute the whole pipeline to completion and hand back the consolidated workbook, no stopping to ask except the two hard gates below.

Read the companion `osint-methodology` skill for the framework; this skill is the executable runbook. Feedback memory `osint-full-pipeline-default` governs the default.

## Hard gates (the ONLY reasons to stop and ask)

1. **Authorization**, if not already asserted, ask the one scope question, then proceed. (Here it's typically already signed.)
2. **Stage 6 (active exploitation)**, BOLA/IDOR, credential replay, injection confirmation. Never run under autopilot; present the ranked target queue and wait for arming.
3. **Out-of-scope siblings**, a newly-discovered sibling domain/brand (e.g. `<company>.io` when scope was `.com`). Flag; don't scan until confirmed.

Everything in Stages 1, 5 runs without pausing for questions.

## Run sequence

Let `S = ~/.claude/skills/osint-autopilot/scripts`.

### 1. Deterministic recon (Stages 1, 3 + harvest + breach + ports)

```
bash $S/recon_pipeline.sh <domain>
```

Creates `~/Research/engagements/<domain>/` and populates evidence (DNS/WHOIS/RDAP/email-sec, subdomain union via subfinder+certspotter+crt.sh, dig-resolve, HTTP probe, identity fabric, /version disclosure, S3 takeover check, gau+wayback+JS harvest, HudsonRock breach, bounded public-IP port scan), hashes everything, and splits responsive hosts into `buckets/bucket-NN`.

Host notes baked in: uses `dig`/`curl` (ProjectDiscovery `dnsx`/`httpx` segfault on this M1, cgo m1cpu); nmap is time-capped at 10 min so it can't stall.

### 2. Multi-agent per-host fan-out (Stage 4 exposure)

Read `buckets/COUNT` and the `buckets/bucket-*` paths, then launch the workflow (`ffuf` must be on PATH, `go install github.com/ffuf/ffuf/v2@latest` if missing):

The rest: https://github.com/elementalsouls/Claude-OSINT/blob/HEAD/skills/osint-autopilot/SKILL.md