Customization
Before executing, check for user customizations at:
~/.claude/PAI/USER/SKILLCUSTOMIZATIONS/OSINT/
If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.
- Output text notification:
Running the **WorkflowName** workflow in the **OSINT** skill to ACTION...
This is not optional. Execute this curl command immediately upon skill invocation.
OSINT Skill
Open Source Intelligence gathering for authorized investigations.
Workflow Routing
| Investigation Type |
Workflow |
Context |
| People lookup |
Workflows/PeopleLookup.md |
SOURCES.JSON |
| Company lookup |
Workflows/CompanyLookup.md |
SOURCES.JSON |
| Investment due diligence |
Workflows/CompanyDueDiligence.md |
SOURCES.JSON |
| Entity/threat intel |
Workflows/EntityLookup.md |
SOURCES.JSON |
| Domain/subdomain investigation |
Workflows/DomainLookup.md |
SOURCES.JSON |
| Organization/NGO/gov research |
Workflows/OrganizationLookup.md |
SOURCES.JSON |
| Discover new OSINT sources |
Workflows/DiscoverOSINTSources.md |
SOURCES.JSON |
Trigger Patterns
People OSINT:
- "do OSINT on [person]", "research [person]", "background check on [person]"
- "who is [person]", "find info about [person]", "investigate this person"
-> Route to
Workflows/PeopleLookup.md
Company OSINT:
- "do OSINT on [company]", "research [company]", "company intelligence"
- "what can you find about [company]", "investigate [company]"
-> Route to
Workflows/CompanyLookup.md
Investment Due Diligence:
- "due diligence on [company]", "vet [company]", "is [company] legitimate"
- "assess [company]", "should we work with [company]"
-> Route to
Workflows/CompanyDueDiligence.md
Entity/Threat Intel:
- "investigate [entity]", "threat intelligence on [entity]", "is this malicious"
- "research this threat actor", "analyze [entity]", "check this IP"
-> Route to
Workflows/EntityLookup.md
Domain/Subdomain Investigation:
- "investigate domain", "check domain", "subdomain enumeration"
- "domain recon on [domain]", "what subdomains does [domain] have"
- "DNS investigation", "certificate transparency for [domain]"
-> Route to
Workflows/DomainLookup.md
Organization/NGO/Government:
- "research organization", "investigate NGO", "research agency"
- "who is [organization]", "investigate [nonprofit]", "research [government agency]"
- "what do we know about [association]", "background on [institution]"
-> Route to
Workflows/OrganizationLookup.md
Authorization (REQUIRED)
Before ANY investigation, verify:
STOP if any checkbox is unchecked. See EthicalFramework.md for details.
Resource Index
| File |
Purpose |
SOURCES.JSON |
Master catalog of 279 OSINT sources across 8 categories |
SOURCES.md |
Human-readable source reference with descriptions and access info |
EthicalFramework.md |
Authorization, legal, ethical boundaries |
Methodology.md |
Collection methods, verification, reporting |
PeopleTools.md |
People search, social media, public records (legacy — use SOURCES.JSON) |
CompanyTools.md |
Business databases, DNS, tech profiling (legacy — use SOURCES.JSON) |
EntityTools.md |
Threat intel, scanning, malware analysis (legacy — use SOURCES.JSON) |
Integration
Automatic skill invocations:
- Research Skill - Parallel researcher agent deployment (REQUIRED)
- Recon Skill - Technical infrastructure reconnaissance
Agent fleet patterns:
- Quick lookup: 4-6 agents
- Standard investigation: 8-16 agents
- Comprehensive due diligence: 24-32 agents
Researcher types:
| Researcher |
Best For |
| PerplexityResearcher |
Current web data, social media, company updates |
| ClaudeResearcher |
Academic depth, professional backgrounds |
| GeminiResearcher |
Multi-perspective, cross-domain connections |
| GrokResearcher |
Contrarian analysis, fact-checking |
File Organization
Active investigations:
~/.claude/MEMORY/WORK/$(jq -r '.work_dir' ~/.claude/MEMORY/STATE/current-work.json)/YYYY-MM-DD-HHMMSS_osint-[target]/
Archived reports:
~/.claude/History/research/YYYY-MM/[target]-osint/
Ethical Guardrails
ALLOWED: Public sources only - websites, social media, public records, search engines, archived content
PROHIBITED: Private data, unauthorized access, social engineering, purchasing breached data, ToS violations
See EthicalFramework.md for complete requirements.
Version: 3.0 (SOURCES.JSON Integration)
Last Updated: February 2026
1---2name: osint3description: Structured OSINT investigations — people lookup, company intel, investment due diligence, entity/threat intel, domain recon, organization research using public sources with ethical authorization framework. USE WHEN OSINT, due diligence, background check, research person, company intel, investigate, company lookup, domain lookup, entity lookup, organization lookup, threat intel, discover OSINT sources.4---56## Customization78**Before executing, check for user customizations at:**9`~/.claude/PAI/USER/SKILLCUSTOMIZATIONS/OSINT/`1011If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.12132. **Output text notification**:14 ```15 Running the **WorkflowName** workflow in the **OSINT** skill to ACTION...16 ```1718**This is not optional. Execute this curl command immediately upon skill invocation.**1920# OSINT Skill2122Open Source Intelligence gathering for authorized investigations.2324---2526## Workflow Routing2728| Investigation Type | Workflow | Context |29|-------------------|----------|---------|30| People lookup | `Workflows/PeopleLookup.md` | `SOURCES.JSON` |31| Company lookup | `Workflows/CompanyLookup.md` | `SOURCES.JSON` |32| Investment due diligence | `Workflows/CompanyDueDiligence.md` | `SOURCES.JSON` |33| Entity/threat intel | `Workflows/EntityLookup.md` | `SOURCES.JSON` |34| Domain/subdomain investigation | `Workflows/DomainLookup.md` | `SOURCES.JSON` |35| Organization/NGO/gov research | `Workflows/OrganizationLookup.md` | `SOURCES.JSON` |36| Discover new OSINT sources | `Workflows/DiscoverOSINTSources.md` | `SOURCES.JSON` |3738---3940## Trigger Patterns4142**People OSINT:**43- "do OSINT on [person]", "research [person]", "background check on [person]"44- "who is [person]", "find info about [person]", "investigate this person"45-> Route to `Workflows/PeopleLookup.md`4647**Company OSINT:**48- "do OSINT on [company]", "research [company]", "company intelligence"49- "what can you find about [company]", "investigate [company]"50-> Route to `Workflows/CompanyLookup.md`5152**Investment Due Diligence:**53- "due diligence on [company]", "vet [company]", "is [company] legitimate"54- "assess [company]", "should we work with [company]"55-> Route to `Workflows/CompanyDueDiligence.md`5657**Entity/Threat Intel:**58- "investigate [entity]", "threat intelligence on [entity]", "is this malicious"59- "research this threat actor", "analyze [entity]", "check this IP"60-> Route to `Workflows/EntityLookup.md`6162**Domain/Subdomain Investigation:**63- "investigate domain", "check domain", "subdomain enumeration"64- "domain recon on [domain]", "what subdomains does [domain] have"65- "DNS investigation", "certificate transparency for [domain]"66-> Route to `Workflows/DomainLookup.md`6768**Organization/NGO/Government:**69- "research organization", "investigate NGO", "research agency"70- "who is [organization]", "investigate [nonprofit]", "research [government agency]"71- "what do we know about [association]", "background on [institution]"72-> Route to `Workflows/OrganizationLookup.md`7374---7576## Authorization (REQUIRED)7778**Before ANY investigation, verify:**79- [ ] Explicit authorization from client80- [ ] Clear scope definition81- [ ] Legal compliance confirmed82- [ ] Documentation in place8384**STOP if any checkbox is unchecked.** See `EthicalFramework.md` for details.8586---8788## Resource Index8990| File | Purpose |91|------|---------|92| `SOURCES.JSON` | Master catalog of 279 OSINT sources across 8 categories |93| `SOURCES.md` | Human-readable source reference with descriptions and access info |94| `EthicalFramework.md` | Authorization, legal, ethical boundaries |95| `Methodology.md` | Collection methods, verification, reporting |96| `PeopleTools.md` | People search, social media, public records (legacy — use SOURCES.JSON) |97| `CompanyTools.md` | Business databases, DNS, tech profiling (legacy — use SOURCES.JSON) |98| `EntityTools.md` | Threat intel, scanning, malware analysis (legacy — use SOURCES.JSON) |99100---101102## Integration103104**Automatic skill invocations:**105- **Research Skill** - Parallel researcher agent deployment (REQUIRED)106- **Recon Skill** - Technical infrastructure reconnaissance107108**Agent fleet patterns:**109- Quick lookup: 4-6 agents110- Standard investigation: 8-16 agents111- Comprehensive due diligence: 24-32 agents112113**Researcher types:**114| Researcher | Best For |115|------------|----------|116| PerplexityResearcher | Current web data, social media, company updates |117| ClaudeResearcher | Academic depth, professional backgrounds |118| GeminiResearcher | Multi-perspective, cross-domain connections |119| GrokResearcher | Contrarian analysis, fact-checking |120121---122123## File Organization124125**Active investigations:**126```127~/.claude/MEMORY/WORK/$(jq -r '.work_dir' ~/.claude/MEMORY/STATE/current-work.json)/YYYY-MM-DD-HHMMSS_osint-[target]/128```129130**Archived reports:**131```132~/.claude/History/research/YYYY-MM/[target]-osint/133```134135---136137## Ethical Guardrails138139**ALLOWED:** Public sources only - websites, social media, public records, search engines, archived content140141**PROHIBITED:** Private data, unauthorized access, social engineering, purchasing breached data, ToS violations142143See `EthicalFramework.md` for complete requirements.144145---146147**Version:** 3.0 (SOURCES.JSON Integration)148**Last Updated:** February 2026
kai-cli