Osint Agent Skill

OpenOSINT: passive recon

Invoked as /osint <target>: investigate the target below with the chain that fits it and write the Markdown report described at the end. If no target was given, ask for one.

Target: $ARGUMENTS

OpenOSINT runs real tools in Python and returns their real output. You orchestrate and summarize; you never invent results.

Rules (read first)

• Passive by default. Run only passive tools. Never pass --allow-active, never set OPENOSINT_ALLOW_ACTIVE, never use scrape, username, email or subdomain brute-force unless the user explicitly asks for that tool by name. If an active tool would help, say so and ask.
• Authorization. Only investigate targets the user owns or is authorized to assess. If the target looks like a private individual, stop and ask what the legitimate purpose is. OpenOSINT is not designed for people search.
• Every finding cites its tool call. Write each finding as claim [tool: args], e.g. SPF is missing [exposure example.com]. No citation, no finding.
• Summaries are leads, not proof. Say "indicates" or "suggests", never "confirms". Report what a tool returned, not what you infer from it. Flag tool errors and empty results as such; never fill gaps from memory.
• Missing key: say which one. If a tool reports a missing key, do not skip it silently and do not retry. Tell the user the variable to set (see references/keys.md).

How to call tools

Use the CLI first: it needs no API key, no AI provider and no MCP server, so it works on any agent. Put --json before the subcommand:

uvx --from openosint==2.37.0 openosint --json exposure example.com
uvx --from openosint==2.37.0 openosint --json dns example.com
uvx --from openosint==2.37.0 openosint --json rdap example.com
uvx --from openosint==2.37.0 openosint --json whois example.com
uvx --from openosint==2.37.0 openosint --json dorks example.com
uvx --from openosint==2.37.0 openosint --json gdelt "Example Corp"
uvx --from openosint==2.37.0 openosint --json ip 8.8.8.8
uvx --from openosint==2.37.0 openosint --json exposure example.com --checks email,registration

• --json output has tool, target, timestamp, results and error; cite those.
• exposure grades A-F. Its TLS and header checks connect to the target on port 443; --checks email,registration never touches the target (use it when the user wants zero contact). --report PATH.html writes a printable report.
• dorks only builds search URLs and sends nothing.
• ip queries ipinfo.io; it works unkeyed at low volume, and IPINFO_TOKEN raises the limit.

Use the MCP tools (search_whois, search_rdap, search_gdelt_geo, generate_dorks, search_ip, and the keyed ones) only when the openosint MCP server is already connected. They return the same data. Do not emulate a tool with whois or curl.

What to chain

| Target | Chain (all keyless, passive) |

|---|---|

| Domain | exposure → dns → rdap → whois → dorks → gdelt (org name) |

| IP | ip → dns on the hostname it returns |

| Organization | Resolve its main domain first, run the Domain chain, then gdelt on the org name |

Keyed extras, offer only when they add something: search_shodan, search_censys, search_virustotal (domain/IP/hash), search_abuseipdb, search_breach. Details and variable names: references/keys.md.

Order and interpretation hints: references/workflows.md.

Report format

Markdown, in this order: Target and scope (what was run, what was deliberately not), Findings (one bullet per finding with its citation), Not checked / needs a key, Leads to verify. Keep tool errors visible in the report.