Run: claude-osint

claude-osint is not an app, it's a Claude skills package. Its product is two SKILL.md files (skills/offensive-osint/, skills/osint-methodology/) plus two runnable Python helpers under skills/offensive-osint/scripts/. There is no GUI, server, or TUI. "Running it" means: the SKILL.md frontmatter parses and is complete (that's what Claude loads), and the helper scripts work.

The driver is .claude/skills/run-claude-osint/smoke.sh, it does all of that in one shot. All paths below are relative to the repo root.

Prerequisites

Python 3 with PyYAML (already present on this container). If import yaml fails:

pip install pyyaml    # or: apt-get install -y python3-yaml

The helpers are stdlib-only otherwise. h1_reference.py needs outbound HTTPS to hackerone.com. No build step, no npm install, nothing to compile.

Run (agent path), the driver

From the repo root:

.claude/skills/run-claude-osint/smoke.sh           # full smoke (exits 0 on pass)
.claude/skills/run-claude-osint/smoke.sh --no-net  # skip the HackerOne live check

It runs six checks and prints a ==> PASS / ==> FAIL line (exit 0 / 1):

1. py_compile both helpers.
2. secret_scan.py detects AWS key + JWT from stdin (the CI canaries).
3. secret_scan.py recursively scans skills/ and emits JSONL (~11 findings, example tokens in the SKILL.md docs).
4. Every skills/*/SKILL.md has valid YAML frontmatter with name/description/version/triggers and ≥5 triggers.
5. sync-skill-content.sh --check exits 0.
6. h1_reference.py fetches one live disclosed report (non-fatal if offline).

Run individual pieces

Verified this session:

# Secret scanner, stdin
printf 'AKIAIOSFODNN7EXAMPLE\n' | python3 skills/offensive-osint/scripts/secret_scan.py
# -> {"pattern": "AWS_ACCESS_KEY", "severity": "critical", ...}