offensive-osint
Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.
npx skills add SnailSploit/Claude-Red --skill offensive-osint --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
The skill instructs the agent to perform a comprehensive OSINT methodology for offensive security, red team intelligence gathering, and bug bounty reconnaissance. It guides defining a target scope (domain, org, person, crypto address, or geo subject), selecting applicable categories based on scope, working top-down within each category, and pivoting on artifacts discovered. It requires archiving every key artifact with URL, timestamp, a screenshot in PNG, and a hash in SHA-256, and logging findings in JSONL with a run_id and tool versions for reproducibility. It also suggests next steps based on tool outputs.
How it works
- Define target scope (domain, org, person, crypto address, or geo subject).
- Select applicable categories below based on scope.
- Work top-down within each category; pivot on discovered artifacts.
- Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256).
- Log findings in JSONL with a
run_idand tool versions for reproducibility. - Suggest next steps based on what each tool returns.
When to use it
Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.
What it can touch
- Tools: claude-code
- The workflow references multiple OSINT resources and platforms for domain, email, social, infrastructure, and crypto tracing, and requires archiving artifacts and logging findings in JSONL.
Caveats
- License: MIT
- Declared tools: claude-code
- Category: Security
# Offensive OSINT Methodology ## Workflow 1. Define target scope (domain, org, person, crypto address, or geo subject) 2. Select applicable categories below based on scope 3. Work top-down within each category; pivot on discovered artifacts 4. Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256) 5. Log findings in JSONL with a `run_id` and tool versions for reproducibili
What does the offensive-osint skill do?
Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.
How do I install it?
Run `npx skills add SnailSploit/Claude-Red --skill offensive-osint --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From SnailSploit/Claude-Red, a repository with 2,808 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.