OSINT-Only Operator Skill Catalog
This catalog is passive. No packets reach the target. Sandbox network
policy must restrict outbound to known-OSINT endpoints only (Shodan,
Censys, Hunter, GitHub API, crt.sh, Wayback, etc.).
Playbooks
Inline technique reference — not separately loadable skills. The entries below
are summarized here for direct use; there is no separate SKILL.md to open for
each. Do NOT call the skill loader on them — apply the technique with your tools
using this summary and the Workflow in this file.
| Technique |
Use for |
| domain-pivots |
Whois history, reverse-IP, related-domain enumeration |
| ct-logs |
crt.sh / Censys cert search for subdomain enumeration |
| shodan-fingerprint |
Shodan host search; service / banner / ssl.cn pivots |
| censys-pivots |
Censys cert/host/services pivots |
| github-code-search |
GitHub code search for org's leaked secrets / config |
| wayback-archives |
Wayback Machine API; retired endpoints, deleted docs |
| breach-data |
HIBP / DeHashed (RoE-permitted only); credential reuse paths |
| employee-profiling |
LinkedIn search (Sales Nav / manual), email-format inference |
| asn-bgp |
ASN ownership, BGP table snapshots, RIR records |
| maltego |
Maltego CLI graph projection; transform chain |
| cryptocurrency |
Chain analysis (Etherscan / Mempool.space / Arkham) for crypto-adjacent targets |
| geospatial |
Image geolocation, EXIF mining, satellite/streetview cross-reference |
Workflow
- Seed: from the engagement target (domain, company name, brand).
- Domain layer: whois, reverse-IP, CT logs → enumerate every
subdomain and adjacent domain.
- Service layer: Shodan + Censys against discovered IPs → service
inventory (NO probing; just consume cached scan data).
- Code layer: GitHub code search for the target's org name, domain
names, internal package names, AWS account IDs.
- People layer: employees via LinkedIn; email format inference;
HaveIBeenPwned for credential reuse.
- Infrastructure layer: BGP + ASN ownership; Wayback retired
endpoints; SSL/TLS cert history.
- Synthesis: project the graph into Neo4j as a pre-engagement map;
hand off to the Recon agent for active confirmation only if RoE
permits.
Network policy
[osint-operator container] → outbound to: shodan.io, api.censys.io,
api.hunter.io, api.github.com,
crt.sh, archive.org, hibp/api/v3,
maltego.com, etherscan.io, ...
NO outbound to the engagement target.
The sandbox-net policy for OSINT engagements pins this allowlist. Any
attempted egress to the actual target IP/domain triggers a SafeCommand
refusal.
Why split from Recon
Recon is active by default — port scans, version probing, directory
brute-forcing. Bug-bounty programs and pre-engagement scoping work
explicitly forbid touching production. OSINT-only enforces the
no-touch contract structurally rather than relying on the agent prompt
to remember.
1---2name: osint3description: OSINT-Only Operator Skill Catalog4---56# OSINT-Only Operator Skill Catalog78This catalog is **passive**. No packets reach the target. Sandbox network9policy must restrict outbound to known-OSINT endpoints only (Shodan,10Censys, Hunter, GitHub API, crt.sh, Wayback, etc.).1112## Playbooks1314> **Inline technique reference — not separately loadable skills.** The entries below15> are summarized here for direct use; there is no separate `SKILL.md` to open for16> each. Do NOT call the skill loader on them — apply the technique with your tools17> using this summary and the Workflow in this file.181920| Technique | Use for |21|---|---|22| **domain-pivots** | Whois history, reverse-IP, related-domain enumeration |23| **ct-logs** | crt.sh / Censys cert search for subdomain enumeration |24| **shodan-fingerprint** | Shodan host search; service / banner / ssl.cn pivots |25| **censys-pivots** | Censys cert/host/services pivots |26| **github-code-search** | GitHub code search for org's leaked secrets / config |27| **wayback-archives** | Wayback Machine API; retired endpoints, deleted docs |28| **breach-data** | HIBP / DeHashed (RoE-permitted only); credential reuse paths |29| **employee-profiling** | LinkedIn search (Sales Nav / manual), email-format inference |30| **asn-bgp** | ASN ownership, BGP table snapshots, RIR records |31| **maltego** | Maltego CLI graph projection; transform chain |32| **cryptocurrency** | Chain analysis (Etherscan / Mempool.space / Arkham) for crypto-adjacent targets |33| **geospatial** | Image geolocation, EXIF mining, satellite/streetview cross-reference |3435## Workflow36371. **Seed**: from the engagement target (domain, company name, brand).382. **Domain layer**: whois, reverse-IP, CT logs → enumerate every39 subdomain and adjacent domain.403. **Service layer**: Shodan + Censys against discovered IPs → service41 inventory (NO probing; just consume cached scan data).424. **Code layer**: GitHub code search for the target's org name, domain43 names, internal package names, AWS account IDs.445. **People layer**: employees via LinkedIn; email format inference;45 HaveIBeenPwned for credential reuse.466. **Infrastructure layer**: BGP + ASN ownership; Wayback retired47 endpoints; SSL/TLS cert history.487. **Synthesis**: project the graph into Neo4j as a pre-engagement map;49 hand off to the Recon agent for active confirmation only if RoE50 permits.5152## Network policy5354```55[osint-operator container] → outbound to: shodan.io, api.censys.io,56 api.hunter.io, api.github.com,57 crt.sh, archive.org, hibp/api/v3,58 maltego.com, etherscan.io, ...59 NO outbound to the engagement target.60```6162The sandbox-net policy for OSINT engagements pins this allowlist. Any63attempted egress to the actual target IP/domain triggers a SafeCommand64refusal.6566## Why split from Recon6768Recon is active by default — port scans, version probing, directory69brute-forcing. Bug-bounty programs and pre-engagement scoping work70explicitly forbid touching production. OSINT-only enforces the71no-touch contract structurally rather than relying on the agent prompt72to remember.
purpleailab