Customization
Before executing, check for user customizations at:
${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/OSINT/
If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.
- Output text notification:
Running the **WorkflowName** workflow in the **OSINT** skill to ACTION...
This is not optional. Execute this curl command immediately upon skill invocation.
OSINT Skill
Open Source Intelligence gathering for authorized investigations.
Workflow Routing
| Investigation Type |
Workflow |
Context |
| People lookup |
Workflows/PeopleLookup.md |
SOURCES.JSON |
| Company lookup |
Workflows/CompanyLookup.md |
SOURCES.JSON |
| Investment due diligence |
Workflows/CompanyDueDiligence.md |
SOURCES.JSON |
| Entity/threat intel |
Workflows/EntityLookup.md |
SOURCES.JSON |
| Domain/subdomain investigation |
Workflows/DomainLookup.md |
SOURCES.JSON |
| Organization/NGO/gov research |
Workflows/OrganizationLookup.md |
SOURCES.JSON |
| Discover new OSINT sources |
Workflows/DiscoverOSINTSources.md |
SOURCES.JSON |
Trigger Patterns
People OSINT:
- "do OSINT on [person]", "research [person]", "background check on [person]"
- "who is [person]", "find info about [person]", "investigate this person"
-> Route to
Workflows/PeopleLookup.md
Company OSINT:
- "do OSINT on [company]", "research [company]", "company intelligence"
- "what can you find about [company]", "investigate [company]"
-> Route to
Workflows/CompanyLookup.md
Investment Due Diligence:
- "due diligence on [company]", "vet [company]", "is [company] legitimate"
- "assess [company]", "should we work with [company]"
-> Route to
Workflows/CompanyDueDiligence.md
Entity/Threat Intel:
- "investigate [entity]", "threat intelligence on [entity]", "is this malicious"
- "research this threat actor", "analyze [entity]", "check this IP"
-> Route to
Workflows/EntityLookup.md
Domain/Subdomain Investigation:
- "investigate domain", "check domain", "subdomain enumeration"
- "domain recon on [domain]", "what subdomains does [domain] have"
- "DNS investigation", "certificate transparency for [domain]"
-> Route to
Workflows/DomainLookup.md
Organization/NGO/Government:
- "research organization", "investigate NGO", "research agency"
- "who is [organization]", "investigate [nonprofit]", "research [government agency]"
- "what do we know about [association]", "background on [institution]"
-> Route to
Workflows/OrganizationLookup.md
Authorization (REQUIRED)
Before ANY investigation, verify:
STOP if any checkbox is unchecked. See EthicalFramework.md for details.
Resource Index
| File |
Purpose |
SOURCES.JSON |
Master catalog of 279 OSINT sources across 8 categories |
SOURCES.md |
Human-readable source reference with descriptions and access info |
EthicalFramework.md |
Authorization, legal, ethical boundaries |
Methodology.md |
Collection methods, verification, reporting |
PeopleTools.md |
People search, social media, public records (legacy — use SOURCES.JSON) |
CompanyTools.md |
Business databases, DNS, tech profiling (legacy — use SOURCES.JSON) |
EntityTools.md |
Threat intel, scanning, malware analysis (legacy — use SOURCES.JSON) |
Integration
Automatic skill invocations:
- Research Skill - Parallel researcher agent deployment (REQUIRED)
- Recon Skill - Technical infrastructure reconnaissance
Agent fleet patterns:
- Quick lookup: 4-6 agents
- Standard investigation: 8-16 agents
- Comprehensive due diligence: 24-32 agents
Researcher types:
| Researcher |
Best For |
| PerplexityResearcher |
Current web data, social media, company updates |
| ClaudeResearcher |
Academic depth, professional backgrounds |
| GeminiResearcher |
Multi-perspective, cross-domain connections |
| GrokResearcher |
Contrarian analysis, fact-checking |
File Organization
Active investigations:
${AGENT_MEMORY_DIR}/WORK/$(jq -r '.work_dir' ${AGENT_MEMORY_DIR}/STATE/current-work.json)/YYYY-MM-DD-HHMMSS_osint-[target]/
Archived reports:
${AGENT_HISTORY_DIR}/research/YYYY-MM/[target]-osint/
Ethical Guardrails
ALLOWED: Public sources only - websites, social media, public records, search engines, archived content
PROHIBITED: Private data, unauthorized access, social engineering, purchasing breached data, ToS violations
See EthicalFramework.md for complete requirements.
Version: 3.0 (SOURCES.JSON Integration)
Last Updated: February 2026
1---2name: osint3description: Structured OSINT investigations — people lookup, company intel, investment due diligence, entity/threat intel, domain recon, organization research using public sources with ethical authorization framework. USE WHEN OSINT, due diligence, background check, research person, company intel, investigate, company lookup, domain lookup, entity lookup, organization lookup, threat intel, discover OSINT sources.4---56## Customization78**Before executing, check for user customizations at:**9`${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/OSINT/`1011If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.121314<!-- ## 🚨 MANDATORY: Voice Notification (REQUIRED BEFORE ANY ACTION)1516**You MUST send this notification BEFORE doing anything else when this skill is invoked.**17181. **Send voice notification**:19 ```bash20 curl -s -X POST http://localhost:8888/notify \21 -H "Content-Type: application/json" \22 -d '{"message": "Running the WORKFLOWNAME workflow in the OSINT skill to ACTION"}' \23 > /dev/null 2>&1 &24 ```25-->26272. **Output text notification**:28 ```29 Running the **WorkflowName** workflow in the **OSINT** skill to ACTION...30 ```3132**This is not optional. Execute this curl command immediately upon skill invocation.**3334# OSINT Skill3536Open Source Intelligence gathering for authorized investigations.3738---394041## Workflow Routing4243| Investigation Type | Workflow | Context |44|-------------------|----------|---------|45| People lookup | `Workflows/PeopleLookup.md` | `SOURCES.JSON` |46| Company lookup | `Workflows/CompanyLookup.md` | `SOURCES.JSON` |47| Investment due diligence | `Workflows/CompanyDueDiligence.md` | `SOURCES.JSON` |48| Entity/threat intel | `Workflows/EntityLookup.md` | `SOURCES.JSON` |49| Domain/subdomain investigation | `Workflows/DomainLookup.md` | `SOURCES.JSON` |50| Organization/NGO/gov research | `Workflows/OrganizationLookup.md` | `SOURCES.JSON` |51| Discover new OSINT sources | `Workflows/DiscoverOSINTSources.md` | `SOURCES.JSON` |5253---5455## Trigger Patterns5657**People OSINT:**58- "do OSINT on [person]", "research [person]", "background check on [person]"59- "who is [person]", "find info about [person]", "investigate this person"60-> Route to `Workflows/PeopleLookup.md`6162**Company OSINT:**63- "do OSINT on [company]", "research [company]", "company intelligence"64- "what can you find about [company]", "investigate [company]"65-> Route to `Workflows/CompanyLookup.md`6667**Investment Due Diligence:**68- "due diligence on [company]", "vet [company]", "is [company] legitimate"69- "assess [company]", "should we work with [company]"70-> Route to `Workflows/CompanyDueDiligence.md`7172**Entity/Threat Intel:**73- "investigate [entity]", "threat intelligence on [entity]", "is this malicious"74- "research this threat actor", "analyze [entity]", "check this IP"75-> Route to `Workflows/EntityLookup.md`7677**Domain/Subdomain Investigation:**78- "investigate domain", "check domain", "subdomain enumeration"79- "domain recon on [domain]", "what subdomains does [domain] have"80- "DNS investigation", "certificate transparency for [domain]"81-> Route to `Workflows/DomainLookup.md`8283**Organization/NGO/Government:**84- "research organization", "investigate NGO", "research agency"85- "who is [organization]", "investigate [nonprofit]", "research [government agency]"86- "what do we know about [association]", "background on [institution]"87-> Route to `Workflows/OrganizationLookup.md`8889---9091## Authorization (REQUIRED)9293**Before ANY investigation, verify:**94- [ ] Explicit authorization from client95- [ ] Clear scope definition96- [ ] Legal compliance confirmed97- [ ] Documentation in place9899**STOP if any checkbox is unchecked.** See `EthicalFramework.md` for details.100101---102103## Resource Index104105| File | Purpose |106|------|---------|107| `SOURCES.JSON` | Master catalog of 279 OSINT sources across 8 categories |108| `SOURCES.md` | Human-readable source reference with descriptions and access info |109| `EthicalFramework.md` | Authorization, legal, ethical boundaries |110| `Methodology.md` | Collection methods, verification, reporting |111| `PeopleTools.md` | People search, social media, public records (legacy — use SOURCES.JSON) |112| `CompanyTools.md` | Business databases, DNS, tech profiling (legacy — use SOURCES.JSON) |113| `EntityTools.md` | Threat intel, scanning, malware analysis (legacy — use SOURCES.JSON) |114115---116117## Integration118119**Automatic skill invocations:**120- **Research Skill** - Parallel researcher agent deployment (REQUIRED)121- **Recon Skill** - Technical infrastructure reconnaissance122123**Agent fleet patterns:**124- Quick lookup: 4-6 agents125- Standard investigation: 8-16 agents126- Comprehensive due diligence: 24-32 agents127128**Researcher types:**129| Researcher | Best For |130|------------|----------|131| PerplexityResearcher | Current web data, social media, company updates |132| ClaudeResearcher | Academic depth, professional backgrounds |133| GeminiResearcher | Multi-perspective, cross-domain connections |134| GrokResearcher | Contrarian analysis, fact-checking |135136---137138## File Organization139140**Active investigations:**141```142${AGENT_MEMORY_DIR}/WORK/$(jq -r '.work_dir' ${AGENT_MEMORY_DIR}/STATE/current-work.json)/YYYY-MM-DD-HHMMSS_osint-[target]/143```144145**Archived reports:**146```147${AGENT_HISTORY_DIR}/research/YYYY-MM/[target]-osint/148```149150---151152## Ethical Guardrails153154**ALLOWED:** Public sources only - websites, social media, public records, search engines, archived content155156**PROHIBITED:** Private data, unauthorized access, social engineering, purchasing breached data, ToS violations157158See `EthicalFramework.md` for complete requirements.159160---161162**Version:** 3.0 (SOURCES.JSON Integration)163**Last Updated:** February 2026
mj-deving