Exposure Agent Skill
Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers). Use when the user asks for an exposure check, security posture, email-spoofing or DMARC/SPF check, or "how exposed is this domain". No API key needed.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/OpenOSINT/OpenOSINT --skill exposureThe instruction itself
1 sections, as written by the authorOpenOSINT: exposure report
Domain: $ARGUMENTS (ask for one if empty). Only run this on domains the user owns or is authorized to assess.
uvx --from openosint==2.37.0 openosint --json exposure DOMAIN
- The TLS and header checks connect to the domain on port 443. If the user wants no contact with the target, run
exposure DOMAIN --checks email,registrationinstead (DNS and registry only; the result is not graded). - Optional:
--report PATH.htmlwrites a printable report;--lookalikesadds a DNS-only search for lookalike domains (not part of the grade). - Do not pass
--allow-active.
Report the grade, then each check's findings, each cited as claim [exposure DOMAIN, <check>]. The grade is a point-in-time summary, not a compliance result or a vulnerability scan. Findings are leads to verify, not proof. If the command fails or a check is skipped, say so; do not estimate a grade.
How to use it
Take openosint/exposure from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.
The instructions reference uvx.
Without those the skill loads but fails at the first command.