OSINT

Conducts structured open-source intelligence investigations on people, companies, domains, and threat entities.

Updated Jul 10, 2026
One-click install
npx skills add https://github.com/Kaleb-Rupe/aurora --skill osint-kaleb-rupe
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: OSINT
Source: https://github.com/Kaleb-Rupe/aurora/tree/main/claude/skills/Investigation/OSINT
Command: npx skills add https://github.com/Kaleb-Rupe/aurora --skill osint-kaleb-rupe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Gathering reliable intelligence about a person, company, domain, or threat actor from public sources is slow and error-prone without a defined methodology, verified source catalog, and legal guardrails. This Skill provides structured investigation workflows with an authorization framework and a catalog of 279+ vetted OSINT sources. ## Core Features & Use Cases - Workflow Routing: Routes requests to dedicated workflows for people lookup, company lookup, investment due diligence, entity/threat intel, domain recon, and organization research. - Curated Source Catalog: Ships a SOURCES.JSON catalog of 279 sources across GitHub tools, directories, people search, business registries, and threat intelligence platforms. - Ethical & Legal Framework: Enforces authorization checks, proportionality, and legal compliance (CFAA, FCRA, GDPR) before any collection begins. - Use Case: An investor asks whether a startup is legitimate. The Skill runs the CompanyDueDiligence workflow, checks SEC EDGAR, OpenCorporates, and domain infrastructure, then produces a confidence-scored report with red flags. ## Quick Start Run an OSINT investigation on the company example.com including domain enumeration and business registry checks.

Frequently Asked Questions about OSINT

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an OSINT investigation on a company?

Provide the company name and confirm authorization and scope. The Skill routes to the CompanyLookup or CompanyDueDiligence workflow, checks registries like SEC EDGAR and OpenCorporates, enumerates domains, and produces a confidence-scored report.

What tools are used for domain and subdomain enumeration?

The Skill uses certificate transparency via crt.sh, DNS tools like DNSDumpster and SecurityTrails, and open-source tools like Amass and subfinder. It applies a domain-first protocol requiring 95% confidence before proceeding.

What sources are included for threat intelligence lookups?

The catalog includes VirusTotal, Hybrid Analysis, Shodan, Censys, AbuseIPDB, GreyNoise, AlienVault OTX, and MITRE ATT&CK. Sources are organized in SOURCES.JSON with cost, coverage, and status metadata.

Is authorization required before starting an OSINT investigation?

Yes, explicit written authorization, defined scope, and legal compliance verification are mandatory before any collection. The EthicalFramework.md file defines prohibited actions like unauthorized access, pretexting, and purchasing breached data.

What are the limitations of public-source OSINT investigations?

OSINT only covers publicly available data, so private systems, unindexed records, and recent events may be missed. Findings require multi-source verification, and reports must document gaps, confidence levels, and unverified claims.