How do I install the Theharvester skill?

Run npx skillmds@latest add timsonner/theharvester in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Theharvester safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Theharvester?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Theharvester free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Theharvester?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Theharvester by timsonner — Agent Skill

Name: Theharvester
Author: timsonner

File contents

theHarvester

Purpose

Use this skill for passive OSINT gathering when the engagement needs external intelligence with minimal direct interaction.

Phase Fit

Primary: Discovery and Reconnaissance
Secondary: Threat Modeling and Test Planning

Use When

Need passive discovery of emails, hosts, or public-source metadata.
Need recon seeds for later validation.
Need low-impact external inventory enrichment.

Avoid When

Public-source collection would exceed the agreed privacy or scope boundary.
Results would be treated as confirmed inventory without validation.

Inputs

Approved domain or brand scope
Source selection and output requirements
Validation threshold for later phases

Procedure

Start with passive public sources only.
Separate raw OSINT leads from confirmed assets.
Use the results to guide DNS, web, or identity validation.
Record source provenance for reporting.
Preserve the exact source set for future comparison.

Command Syntax

Replace sample domains with approved in-scope targets.

# Collect from all configured passive sources
theHarvester -d contoso.com -b all -l 500

# Collect from Google
theHarvester -d contoso.com -b google -l 300

# Collect from Bing
theHarvester -d contoso.com -b bing -l 300

# Collect emails, hosts, and IPs, output to HTML and XML
theHarvester -d contoso.com -b all -l 500 -f contoso-harvest

# Use Shodan for IP enrichment
theHarvester -d contoso.com -b shodan -l 100

Evidence to Capture

Public-source leads relevant to the approved target
Exact source set and domain used
What still requires validation before later testing

Safety Boundaries

Keep collection passive and within approved brand or domain scope.
Treat all output as unverified until corroborated.

---name: theharvesterdescription: Use for passive OSINT collection during authorized pentests. Trigger on email, domain, subdomain, and public-source metadata gathering to seed recon without active target interaction.license: MIT---# theHarvester## PurposeUse this skill for passive OSINT gathering when the engagement needs external intelligence with minimal direct interaction.## Phase Fit- Primary: Discovery and Reconnaissance- Secondary: Threat Modeling and Test Planning## Use When- Need passive discovery of emails, hosts, or public-source metadata.- Need recon seeds for later validation.- Need low-impact external inventory enrichment.## Avoid When- Public-source collection would exceed the agreed privacy or scope boundary.- Results would be treated as confirmed inventory without validation.## Inputs- Approved domain or brand scope- Source selection and output requirements- Validation threshold for later phases## Procedure1. Start with passive public sources only.2. Separate raw OSINT leads from confirmed assets.3. Use the results to guide DNS, web, or identity validation.4. Record source provenance for reporting.5. Preserve the exact source set for future comparison.## Command SyntaxReplace sample domains with approved in-scope targets.```bash# Collect from all configured passive sourcestheHarvester -d contoso.com -b all -l 500# Collect from GoogletheHarvester -d contoso.com -b google -l 300# Collect from BingtheHarvester -d contoso.com -b bing -l 300# Collect emails, hosts, and IPs, output to HTML and XMLtheHarvester -d contoso.com -b all -l 500 -f contoso-harvest# Use Shodan for IP enrichmenttheHarvester -d contoso.com -b shodan -l 100```## Evidence to Capture- Public-source leads relevant to the approved target- Exact source set and domain used- What still requires validation before later testing## Safety Boundaries- Keep collection passive and within approved brand or domain scope.- Treat all output as unverified until corroborated.

Frequently asked questions

Theharvester