Offensive OSINT — Arsenal Router
Companion: osint-methodology — pipeline stages, triage rules, severity rubric. Load it alongside this router at the start of every session.
Scope gate: Authorized targets only. When scope is unclear, ask once before proceeding.
BEHAVIORAL CONTRACT
When triggered: Any external recon, bug bounty, ASM engagement, or general "where do I start" offensive OSINT request.
Execute:
- Load
osint-methodology — identify the pipeline stage and scope.
- Match the current task to a sub-skill using the sub-skill map below.
- Load that sub-skill and begin execution immediately.
- Propose the next concrete action without waiting to be asked.
- When one sub-skill's work completes, chain to the next relevant sub-skill autonomously — follow the pipeline priority order from
osint-methodology §7.1.
Output: Delegation to the appropriate sub-skill(s). This router produces no findings itself.
Gating rules: Authorized targets only. When scope is unclear, ask once before proceeding. Hard rules (below) are always-on across all sub-skills.
Chain to: Autonomously chain through sub-skills following osint-methodology §7.1 priority order: breaches → GitHub recon → misconfig sweep → cloud buckets → ports → email OSINT → web tech → Wayback → DNS/email security → certs/TLS → ASN/reverse DNS → typosquats.
Sub-skill map
Load the sub-skill that matches the current task. Each is self-contained and under 500 lines.
| Task |
Sub-skill to load |
| Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists |
recon-asset-discovery |
| Web surface: Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring |
web-surface |
| IdP fingerprinting, Entra/Okta/ADFS/SAML, M365 deep enum, LinkedIn employee enum |
identity-fabric |
| Secret regexes, dork corpus, GitHub code-search dorks, read-only validators |
secrets-and-dorks |
| Post-credential: JWT triage, AWS IAM enum, GitHub scope enum, Slack workspace enum |
post-discovery |
| Cloud-native fingerprints, K8s/container, CI/CD exposure, infra OSINT |
cloud-and-infra |
| Username/email/phone, breach data, HudsonRock, Slack/Discord/Telegram, package registries |
people-breach-intel |
| Scoring rubrics, attack-path hints, severity matrix, AI-assisted OSINT, archiving |
analysis-and-reporting |
| Report generation: bug-bounty submission, client deliverable, vulnerability report |
report-template |
Session start checklist
- Load
osint-methodology — identify the pipeline stage and scope.
- Load the sub-skill matching the current task from the map above.
- Propose the next concrete action without waiting to be asked.
Hard rules (always-on, all sub-skills)
- Never report a bypass without demonstrated impact.
- Run read-only validators (
secrets-and-dorks) before escalating any credential finding.
post-discovery is gated — confirm read-only validation passes first.- No destructive probes. No active scanning outside explicit written scope.
Structured Outrider run contract
Follow the shared run-contract instructions in ../_shared/run-contract.md.
- Contract skill identifier:
offensive-osint.
- Consume
skill_request version 1 and produce skill_result version 1 when participating in an Outrider run.
- Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.
- Discoveries are observations and do not expand scope or approval.
- Do not claim final finding validation; use
finding_candidate only when a human-reviewed candidate should be handed off.
- Do not directly edit
manifest.json, scope.yaml, run.jsonl, evidence.jsonl, or approvals.jsonl.
- Use policy-gated MCP with the explicit
run_dir; the Python control layer and MCP boundary must reevaluate current controls.
- Router role: this skill may select another shipped skill while retaining the same
run_id and request context.
- Router role: do not invent unknown skill names, bypass contract validation, or aggregate unsupported narrative into a validated finding.
1---2name: offensive-osint3description: Router for the Offensive OSINT arsenal. Dispatches to focused sub-skills by task type. Covers the full external red-team surface: asset discovery, web enumeration, identity/SSO, secrets/dorks, post-credential workflows, cloud/infra, people/breach intel, and analysis/reporting. Companion to osint-methodology. Use for any authorized external recon, bug bounty, or ASM engagement.4---56# Offensive OSINT — Arsenal Router78> Companion: `osint-methodology` — pipeline stages, triage rules, severity rubric. Load it alongside this router at the start of every session.910**Scope gate:** Authorized targets only. When scope is unclear, ask once before proceeding.1112---1314## BEHAVIORAL CONTRACT1516**When triggered:** Any external recon, bug bounty, ASM engagement, or general "where do I start" offensive OSINT request.1718**Execute:**19201. Load `osint-methodology` — identify the pipeline stage and scope.212. Match the current task to a sub-skill using the sub-skill map below.223. Load that sub-skill and begin execution immediately.234. Propose the next concrete action without waiting to be asked.245. When one sub-skill's work completes, chain to the next relevant sub-skill autonomously — follow the pipeline priority order from `osint-methodology` §7.1.2526**Output:** Delegation to the appropriate sub-skill(s). This router produces no findings itself.2728**Gating rules:** Authorized targets only. When scope is unclear, ask once before proceeding. Hard rules (below) are always-on across all sub-skills.2930**Chain to:** Autonomously chain through sub-skills following `osint-methodology` §7.1 priority order: breaches → GitHub recon → misconfig sweep → cloud buckets → ports → email OSINT → web tech → Wayback → DNS/email security → certs/TLS → ASN/reverse DNS → typosquats.3132---3334## Sub-skill map3536Load the sub-skill that matches the current task. Each is self-contained and under 500 lines.3738| Task | Sub-skill to load |39| ----------------------------------------------------------------------------------------- | ------------------------ |40| Subdomains, ASN/BGP, DNS, CT, WHOIS/RDAP, wordlists | `recon-asset-discovery` |41| Web surface: Swagger/GraphQL paths, curl probes, Wayback, Postman, endpoint scoring | `web-surface` |42| IdP fingerprinting, Entra/Okta/ADFS/SAML, M365 deep enum, LinkedIn employee enum | `identity-fabric` |43| Secret regexes, dork corpus, GitHub code-search dorks, read-only validators | `secrets-and-dorks` |44| Post-credential: JWT triage, AWS IAM enum, GitHub scope enum, Slack workspace enum | `post-discovery` |45| Cloud-native fingerprints, K8s/container, CI/CD exposure, infra OSINT | `cloud-and-infra` |46| Username/email/phone, breach data, HudsonRock, Slack/Discord/Telegram, package registries | `people-breach-intel` |47| Scoring rubrics, attack-path hints, severity matrix, AI-assisted OSINT, archiving | `analysis-and-reporting` |48| Report generation: bug-bounty submission, client deliverable, vulnerability report | `report-template` |4950---5152## Session start checklist53541. Load `osint-methodology` — identify the pipeline stage and scope.552. Load the sub-skill matching the current task from the map above.563. Propose the next concrete action without waiting to be asked.5758---5960## Hard rules (always-on, all sub-skills)6162- Never report a bypass without demonstrated impact.63- Run read-only validators (`secrets-and-dorks`) before escalating any credential finding.64- `post-discovery` is gated — confirm read-only validation passes first.65- No destructive probes. No active scanning outside explicit written scope.6667## Structured Outrider run contract6869Follow the shared run-contract instructions in `../_shared/run-contract.md`.7071- Contract skill identifier: `offensive-osint`.72- Consume `skill_request` version 1 and produce `skill_result` version 1 when participating in an Outrider run.73- Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.74- Discoveries are observations and do not expand scope or approval.75- Do not claim final finding validation; use `finding_candidate` only when a human-reviewed candidate should be handed off.76- Do not directly edit `manifest.json`, `scope.yaml`, `run.jsonl`, `evidence.jsonl`, or `approvals.jsonl`.77- Use policy-gated MCP with the explicit `run_dir`; the Python control layer and MCP boundary must reevaluate current controls.78- Router role: this skill may select another shipped skill while retaining the same `run_id` and request context.79- Router role: do not invent unknown skill names, bypass contract validation, or aggregate unsupported narrative into a validated finding.
Ap6pack