Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
Claude-OSINT provides a set of specialized skills designed for authorized red-team operations and security research. It transforms the LLM into an operator capable of executing multi-stage reconnaissance pipelines, from initial discovery to secret scanning.
The system helps security researchers automate the tedious aspects of external reconnaissance, ensuring that methodology is applied consistently across authorized domains while managing engagement folders and data collection.
WHO IT'S FOR
Bug bounty hunters
automate external reconnaissance for authorized targets
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
I’m using
Claude Code — direct copy of all eight skills
Installs: Complete eight-skill claude-osint bundle. · Claude Code
Before you start
Claude Code
Git
In a terminal, clone the repository, enter it, populate the full skill content, and copy all eight skill directories into Claude Code's local skills directory.
# Install all 8 skills (one-time, after clone)
git clone https://github.com/elementalsouls/Claude-OSINT.git
cd Claude-OSINT
chmod +x ./scripts/sync-skill-content.sh
./scripts/sync-skill-content.sh
mkdir -p ~/.claude/skills
cp -r skills/* ~/.claude/skills/
ls ~/.claude/skills/
Installs: Complete eight-skill claude-osint bundle, symlinked so the installed directories can stay aligned with the clone. · Claude Code
Before you start
Claude Code
Git
A shell environment supporting symbolic links and the documented shell loop
In a terminal, clone to the documented location, symlink every skill directory into Claude Code's skills directory, then populate the full skill content.
git clone https://github.com/elementalsouls/Claude-OSINT.git ~/.local/share/Claude-OSINT
mkdir -p ~/.claude/skills
# Symlink every skill directory (add/remove names to taste)
for s in ~/.local/share/Claude-OSINT/skills/*/; do
ln -sf "$s" ~/.claude/skills/"$(basename "$s")"
done
cd ~/.local/share/Claude-OSINT
./scripts/sync-skill-content.sh # one-time
Installs: Concrete three-skill selection: the osint-methodology and offensive-osint core pair plus email-domain-security. · Claude.ai
Before you start
Claude.ai Pro, Team, or Enterprise
A local copy of the three specified SKILL.md files
Platform: Claude.ai web interface
Open Claude.ai and create or open a Project. Choose Add knowledge → Files, upload skills/osint-methodology/SKILL.md, skills/offensive-osint/SKILL.md, and skills/email-domain-security/SKILL.md, then save.
Installs: Concrete three-skill selection: the osint-methodology and offensive-osint core pair plus cloud-saas-exposure. · Claude.ai
Before you start
Claude.ai Pro, Team, or Enterprise
A local copy of the three specified SKILL.md files
Platform: Claude.ai web interface
Open Claude.ai and create or open a Project. Choose Add knowledge → Files, upload skills/osint-methodology/SKILL.md, skills/offensive-osint/SKILL.md, and skills/cloud-saas-exposure/SKILL.md, then save.
Installs: Concrete three-skill selection: the osint-methodology and offensive-osint core pair plus exposure-risk-quantification. · Claude.ai
Before you start
Claude.ai Pro, Team, or Enterprise
A local copy of the three specified SKILL.md files
Platform: Claude.ai web interface
Open Claude.ai and create or open a Project. Choose Add knowledge → Files, upload skills/osint-methodology/SKILL.md, skills/offensive-osint/SKILL.md, and skills/exposure-risk-quantification/SKILL.md, then save.
Installs: Core recon pair only: osint-methodology and offensive-osint. · Claude API
Before you start
Anthropic SDK
Claude API access
A local repository copy containing the two referenced SKILL.md files
Run from: Repository root
Use this complete Python example as application code, not as a command entered in a Claude session. It reads the core pair from their repository-relative paths and attaches them to the API system prompt.
from anthropic import Anthropic
client = Anthropic()
with open("skills/osint-methodology/SKILL.md") as f:
methodology = f.read()
with open("skills/offensive-osint/SKILL.md") as f:
arsenal = f.read()
system_prompt = f"""You are an OSINT recon assistant for authorized red-team engagements.
You have access to the skills below and should reference them whenever relevant:
=== SKILL: osint-methodology ===
{methodology}
=== SKILL: offensive-osint ===
{arsenal}
"""
response = client.messages.create(
model="claude-sonnet-4-6",
max_tokens=4096,
system=system_prompt,
messages=[{"role": "user", "content": "Plan a 4-hour external recon on acme.com (in-scope BB)"}]
)
print(response.content[0].text)
Raw DMARC TXT record, or an explicit statement that no record exists
Use the email-domain-security skill to assess the raw SPF and DMARC TXT records below. Give the composite spoofability verdict, severity, attack vector, and confidence, and explain whether the visible header From is protected. Do not send email or perform SMTP checks. Domain: <authorized-domain>. SPF TXT: <raw-SPF-record>. DMARC TXT: <raw-DMARC-record-or-no-record>.
An AKIA, ASIA, or AROA access-key ID already lawfully held
Use the cloud-saas-exposure skill to decode the AWS account ID from this AKIA, ASIA, or AROA access-key ID entirely offline: <access-key-ID-lawfully-held>. Screen the decoded value against the documented AWS example-account IDs and label the result as a lead rather than proof of ownership. Do not make network or AWS API calls.
Severity, confidence, ownership, and proof annotations where available
Optional breach-record counts separated by source
Use the exposure-risk-quantification skill to compute and explain a defensible 0–100 risk score and A–F grade for the completed finding set below. Apply the ownership and proof demotion cap, show the Exposure, Threat, and Impact inputs, and clearly identify missing evidence. Use only the supplied findings and make no network calls. Findings: <completed-findings-with-severity-confidence-ownership-and-proof>. Assets: <associated-assets>. Optional breach-record counts by source: <counts-or-none>.
Claude
Cursor
Amp