mcpbeat Sign in

Offensive Osint Skill for Claude

by SnailSploit

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.

6k tokens
context cost
the whole folder, loaded on every use
1
files
instructions only
0
copies elsewhere
how many repositories repackaged it
2806
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository 
npx skills add https://github.com/SnailSploit/Claude-Red --skill offensive-osint

The instruction itself

39 sections, as written by the author

Offensive OSINT Methodology

Workflow

  • Define target scope (domain, org, person, crypto address, or geo subject)
  • Select applicable categories below based on scope
  • Work top-down within each category; pivot on discovered artifacts
  • Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256)
  • Log findings in JSONL with a run_id and tool versions for reproducibility
  • Suggest next steps based on what each tool returns

General OSINT

Search Engines

| Tool | Notes |

|------|-------|

| Carrot2 | Clusters results by topic |

| etools | Metasearch engine |

| Kagi | Privacy-first, non-personalized results |

| Brave Search | Independent index; Goggles for custom ranking |

| PDF Search | Search PDF files and view table of contents |

| Google Fact Check Explorer | Cross-site fact-check search |

Username & Email Investigation

| Tool | Purpose |

|------|---------|

| Sherlock | Username search across social networks |

| Maigret | Collect profiles by username from many sites |

| What's My Name | Username search across platforms |

| Holehe | Check if email is registered on platforms |

| Epieos | Email address pivots and metadata |

| OSINT Industries | Email/username/phone lookups |

| Hunter.io | Find email addresses for a domain |

| EmailRep | Email reputation and associated data |

| Emailable | Verify email existence |

| Mugetsu | X/Twitter username history |

| RocketReach / Apollo | Email enrichment and pattern guessing |

| PhoneInfoga | Phone number intelligence framework |

Browser extensions: GetProspect, SignalHire

People Search

Phone Number OSINT

Social Media

| Platform | Tool |

|----------|------|

| Instagram | Picuki — view profiles without account |

| X/Twitter | snscrape — preferred CLI scraper; use Twint only as fallback |

| Facebook | Graph Search, sowsearch.info, lookup-id.com, whopostedwhat.com |

| Facebook (research) | Meta Content Library — CrowdTangle successor (researcher-gated) |

| YouTube/Twitch | Social Blade — analytics |

| TikTok | Tokboard — trend and profile analytics |

| Reddit | Reveddit — removed content; RedTrack.social — user history |

| Bluesky | Firesky — real-time firehose; SkyView — follower graphs |

| Mastodon | FediSearch — cross-instance search; Fedifinder — find Twitter users on Mastodon |

| Faces | Search4Faces |

Public Records & Company Information

RU/CN Registries

Russia: Rusprofile, Kontur.Focus (freemium), zakupki.gov.ru (procurement), EGRUL/EGRIP (official, captcha-gated)

China: GSXT (National Enterprise Credit), Qichacha/Tianyancha (freemium), MIIT ICP/Beian (ICP filings)

Sanctions & Compliance

Breach & Leak Data

Infrastructure & Attack-Surface OSINT

ASN/BGP & Internet Measurement

Certificates & CT Monitoring

  • crt.sh — Search Certificate Transparency logs
  • Censys Certificates — CT and x509 attribute pivots
  • CertStream — Real-time CT feed via WebSocket
  • Rapid7 Open Data — Sonar DNS/HTTP/SSL datasets
  • Cert Spotter [Freemium] — CT monitoring and alerts
  • Favicon hash (mmh3): cluster infrastructure; pair with Shodan/Censys favicon search

Threat Intel & IOCs

Malware Analysis & Sandboxes

Cryptocurrency OSINT

Blockchain Explorers

| Chain | Explorer |

|-------|---------|

| Bitcoin | Blockchain.com, Blockchair |

| Ethereum | Etherscan |

| BNB Chain | BSCScan |

| Polygon PoS | PolygonScan |

| Solana | Solscan |

| Multi-chain | OKLink Freemium], [Cielo |

L2 Explorers: Arbiscan, Optimistic Etherscan, BaseScan, zkSync Era, L2Beat (risk/TVL comparison)

Transaction Tracking & Analytics

NFT & Exchange Intelligence

Bridge Monitoring

Media Intelligence

Reverse Image & Facial Search

Image Forensics

Video Analysis

Browser Extensions for Media

Geospatial Intelligence

Satellite Imagery & Mapping

Geolocation Tools

Street View: Google Street View, Apple Maps, Yandex Maps, Baidu Maps

Flight OSINT

Maritime OSINT

AI-Assisted OSINT

> Warning: Never paste PII, sensitive IOCs, or unique pivots into cloud LLMs. They log inputs and may use them for training. Use local models (Ollama, LM Studio) for sensitive analysis.

| Tool | Strength |

|------|---------|

| ChatGPT (paid) | Log parsing, dataset analysis, Code Interpreter for CSVs/JSON, GPT-4 Vision for image OCR |

| Claude (paid) | 200K token context for large document dumps and report synthesis |

| Gemini 1.5 Pro | 2M token context; Deep Research mode with citations |

| Perplexity Pro (paid) | Real-time web search + reasoning; multi-query synthesis |

Local/privacy-preserving: Ollama (Llama 3, Mistral), LM Studio, GPT4All

Commercial AI OSINT Platforms

Deepfake & Synthetic Media Detection

Archiving & Evidence Preservation

  • archive.today — One-page content archiver with screenshot
  • URLScan.io — On-demand webpage scan with resource map
  • ArchiveBox — Self-hosted archiving (HTML, PDF, screenshots, media)
  • Hunchly — Evidence capture for investigators (paid)
  • Wayback SavePageNow API v3 — On-demand archiving with job IDs
  • SingleFileZ — Browser extension for offline HTML archives
  • Kasm Workspaces — Containerized OSINT workspace/browser isolation

Evidence handling:

  • Capture: URL + timestamp + PNG screenshot + WARC/SingleFileZ archive
  • Hash all downloaded files (SHA-256) and record in case notes
  • Separate work profiles/containers per case; store evidence read-only
  • Use JSONL (NDJSON) logs with run_id and tool versions for reproducibility

Automation & Workflows

  • n8n — Self-hosted workflow automation (e.g., RSS → scrape → alert pipelines)
  • Huginn — Agent-based monitoring, scraping, alerting
  • Playwright — Headless browser automation with stealth plugins
  • Browsertrix Crawler — Archival crawling with WARC export
  • Prefect / Apache Airflow — Workflow orchestration for data pipelines

Regional Search Engines

Telegram & Messaging Intelligence

  • TGStat — Channel analytics and search
  • Telemetr — Channel growth, overlaps, forwards
  • Combot — Group analytics (partially paid)
  • TelegramDB Search Bot — Basic Telegram OSINT
  • Discord ID — Basic Discord account information
  • Sogou Weixin search — WeChat Official Accounts content search
  • View public Telegram channels: https://t.me/s/<channel>

Other skills for the same job

different authors, same section of the catalogue
React Email
by resend
×1

Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.

28k tokens
Agent Mail
by ComeOnOliver
×1

MCP Agent Mail - Mail-like coordination layer for multi-agent workflows. Identities, inbox/outbox, file reservations, contact policies, threaded messaging, pre-commit guard, Human Overseer, static exports, disaster recovery. Git+SQLite backed. Python/FastMCP.

9k tokens
Chat UI
by ComeOnOliver
×1

Chat UI building blocks for React/Next.js from ui.inference.sh. Components: container, messages, input, typing indicators, avatars. Capabilities: chat interfaces, message lists, input handling, streaming. Use for: building custom chat UIs, messaging interfaces, AI assistants. Triggers: chat ui, chat component, message list, chat input, shadcn chat, react chat, chat interface, messaging ui, conversation ui, chat building blocks

3k tokens
Chat UI
by ComeOnOliver
×1

\"Chat UI building blocks for React/Next.js from ui.inference.sh. Components: container, messages, input, typing indicators, avatars. Capabilities: chat interfaces, message lists, input handling, streaming. Use for: building custom chat UIs, messaging interfaces, AI assistants. Triggers: chat ui, chat component, message list, chat input, shadcn chat,\" react chat, chat interface, messaging ui, conversation ui, chat building blocks

3k tokens
Add Deltachat
by nanocoai

Add DeltaChat channel integration via @deltachat/stdio-rpc-server. Native adapter — no Chat SDK bridge. Email-based messaging with end-to-end encryption.

3k tokens
Add Resend
by nanocoai

Add Resend (email) channel integration via Chat SDK.

2k tokens
Build Zoom Bot
by anthropics
vendor

Build a Zoom meeting bot, recorder, or real-time media workflow. Use when joining meetings programmatically, processing live media or transcripts, or combining Meeting SDK, RTMS, and backend services.

312 tokens
Build Zoom Meeting SDK App
by anthropics
vendor

Reference skill for Zoom Meeting SDK. Use after routing to a meeting-embed workflow when implementing real Zoom meeting joins, platform-specific SDK behavior, auth and join flows, waiting room issues, or meeting bot patterns.

187k tokens

How to use it

Copy the folder

Take snailsploit/offensive-osint from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.