Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.
Start a fresh conversation. Replace the highlighted placeholders.
Use performing-osint-with-spiderfoot to run a passive OSINT scan of [authorized target] and produce a structured intelligence report covering discovered domains, IPs, emails, DNS records, and relevant exposure findings.
Required inputs
[authorized target]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: performing-osint-with-spiderfootdescription: Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.domain: cybersecuritysubdomain: threat-intelligencetags: - osint- spiderfoot- reconnaissance- threat-intelligence- attack-surface- target-profilingversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - ID.RA-01- ID.RA-05- DE.CM-01- DE.AE-02mitre_attack: - T1591- T1592- T1593- T1589- T1595
Performing OSINT with SpiderFoot
Overview
SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.
When to Use
When conducting security assessments that involve performing osint with spiderfoot
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
Python 3.8+ with requests library
SpiderFoot server running on default port 5001
Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules
Steps
Connect to SpiderFoot REST API or use CLI interface
Create a new scan with target specification (domain, IP, email, name)
Select scan modules by use case (all, footprint, investigate, passive)
Monitor scan progress via API polling
Retrieve and parse scan results by data element type
JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.