How do I install the Recon Osint skill?

Run npx skillmds@latest add noorqureshi/recon-osint in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Recon Osint safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon Osint?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon Osint free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Recon Osint?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon Osint by noorqureshi — Agent Skill

Name: Recon Osint
Author: NoorQureshi

Recon Osint

Passive OSINT to expand attack surface without touching the target: dorks, code/secret leaks, Shodan/Censys, cloud assets, employees. Load at recon start, on "OSINT", "google/github dorks", "shodan", or gathering intel on an org. Signals: org name, root domain, "find leaks/exposed".

NoorQureshi Updated Sep 17, 2026

File contents

Passive OSINT

When it applies

Early recon, and anytime you want surface/intel without sending traffic to the target — safest, often highest-signal (leaked keys, forgotten hosts, exposed services).

Why it works

Organizations leak everywhere but their own site: search-engine indexes, public code, internet scan databases, cloud metadata, and employee footprints. Aggregating these finds assets and secrets the target doesn't know are exposed.

Method

Search dorks: Google (site: inurl: filetype: intitle: for panels, configs, docs) and GitHub dorks (org:target "api_key", "target.com" password) for code/secret leaks.
Code leaks: trufflehog github --org=<org>, gist/pastebin search — validate live keys (in scope).
Internet scan DBs: Shodan/Censys/FOFA by org/cert/favicon-hash to find exposed services, forgotten hosts, and origin IPs behind CDNs.
Cloud & DNS assets: CT logs, reverse-DNS, ASN ranges, bucket name guessing (→ cloud-s3-exposure).
People/tech: employees (LinkedIn) for username formats/phishing scope (if allowed), and job posts/stack sites for the tech stack.

Gotchas

Confirm everything you find is in program scope before active testing — OSINT surfaces out-of-scope acquisitions too.
Report leaked secrets by location, validate minimally, never exfiltrate.
Origin-IP discovery via Shodan/cert often bypasses the WAF later (→ payloads-waf-bypass).

Verify success

New in-scope assets, exposed services, or validated leaked secrets — feeding active recon and hunting.

References

Google Hacking DB; GitHub dorks lists; Shodan/Censys docs; trufflehog.

---name: recon-osintdescription: Passive OSINT to expand attack surface without touching the target: dorks, code/secret leaks, Shodan/Censys, cloud assets, employees. Load at recon start, on "OSINT", "google/github dorks", "shodan", or gathering intel on an org. Signals: org name, root domain, "find leaks/exposed".---# Passive OSINT## When it appliesEarly recon, and anytime you want surface/intel without sending traffic to the target — safest,often highest-signal (leaked keys, forgotten hosts, exposed services).## Why it worksOrganizations leak everywhere but their own site: search-engine indexes, public code, internetscan databases, cloud metadata, and employee footprints. Aggregating these finds assets andsecrets the target doesn't know are exposed.## Method1. **Search dorks**: Google (`site: inurl: filetype: intitle:` for panels, configs, docs) and GitHub dorks (`org:target "api_key"`, `"target.com" password`) for code/secret leaks.2. **Code leaks**: `trufflehog github --org=<org>`, gist/pastebin search — validate live keys (in scope).3. **Internet scan DBs**: Shodan/Censys/FOFA by org/cert/favicon-hash to find exposed services, forgotten hosts, and origin IPs behind CDNs.4. **Cloud & DNS assets**: CT logs, reverse-DNS, ASN ranges, bucket name guessing (→ `cloud-s3-exposure`).5. **People/tech**: employees (LinkedIn) for username formats/phishing scope (if allowed), and job posts/stack sites for the tech stack.## Gotchas- Confirm everything you find is in program scope before *active* testing — OSINT surfaces out-of-scope acquisitions too.- Report leaked secrets by location, validate minimally, never exfiltrate.- Origin-IP discovery via Shodan/cert often bypasses the WAF later (→ `payloads-waf-bypass`).## Verify successNew in-scope assets, exposed services, or validated leaked secrets — feeding active recon and hunting.## ReferencesGoogle Hacking DB; GitHub dorks lists; Shodan/Censys docs; trufflehog.

Frequently asked questions