offensive-osint

Subdomain enumeration and cloud bucket discovery are supported through a structured library of probes and wordlists, allowing you to systematically map an organization's external attack surface during authorized red-team engagements.

A 48-pattern secret-scanning catalog provides regex patterns to identify leaked credentials across platforms like AWS, GitHub, and OpenAI, utilizing standard library Python scripts to validate potential secret leaks found during reconnaissance.

No external dependencies are required, as the skill relies on standard library Python for secret scanning and modular reference loading to execute task-specific asset discovery and attack-path mapping operations.

Yes, the operational arsenal is explicitly designed for authorized external bug bounty and vulnerability research, providing concrete probes, wordlists, and regex patterns to map attack paths across cloud, identity, and web infrastructure.

Identity fabric mapping is achieved by utilizing the skill's comprehensive operational index of probes, enabling systematic discovery and attack-path mapping across cloud, identity, and web infrastructure targets during security audits.

The skill is strictly designed for authorized external red-team and bug-bounty reconnaissance, and its probes, wordlists, and secret triage scripts should not be deployed against targets without explicit permission.