skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

osint-methodology

Guides structured OSINT investigations across cryptocurrency, imagery, threat actors, and social media.

Updated Sep 17, 2026
Search Tags:#investigation#reconnaissance#attribution#threat intelligence#geolocation#osint#cryptocurrency tracing
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill osint-methodology-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: osint-methodology
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-osint-methodology
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill osint-methodology-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Open-source intelligence investigations often fail due to ad-hoc workflows, missed pivots, and poor evidence handling. This Skill provides a structured, checklist-driven OSINT methodology so investigations are systematic, reproducible, and properly documented. ## Core Features & Use Cases - Full Investigation Checklists: Covers OpSec and sock puppets, cryptocurrency and Layer-2 tracing, image/video geolocation, chronolocation via shadow and astronomical analysis, threat actor attribution, and social media enumeration. - Tool and Platform Guidance: Recommends concrete tools per task, such as SunCalc for shadow analysis, crt.sh for certificate pivots, Sherlock for username enumeration, and Arkham or TRM for wallet tracing. - Attribution Discipline: Enforces confidence levels, rule-of-three corroboration, and MITRE ATT&CK mapping to avoid single-source attribution errors. - Use Case: An analyst investigating a suspicious crypto wallet uses the methodology to trace fund flows across bridges, profile the wallet, pivot to exchange accounts, and produce a documented report with hashed evidence artifacts. ## Quick Start Ask the assistant to walk you through an OSINT investigation of a target using the structured methodology checklist, starting with scoping and OpSec setup.

Frequently Asked Questions about osint-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start an OSINT investigation with a structured methodology?▼

Begin with OpSec by creating a sock puppet identity isolated from your real accounts, then define the target scope and hypothesis. Follow the checklist in order: collect indicators, correlate data across sources, reconstruct timelines, and document each step with timestamps and artifact hashes.

What tools are used for cryptocurrency wallet tracing in OSINT?▼

The methodology recommends Arkham, TRM, Cielo, and MetaSleuth for wallet tracking and relationship graphs, plus Chainalysis and Elliptic for cross-chain tracing. For Layer-2 networks, use chain-specific explorers like Arbiscan or zkSync Explorer and anchor analysis on L1 bridge deposit and withdrawal events.

How do I geolocate an image using OSINT techniques?▼

Run reverse image searches across Google Lens, Yandex, Bing, and TinEye, then extract EXIF metadata with ExifTool. Analyze foreground and background clues like signs, vegetation, and landmarks, and verify candidates against Google Street View, Yandex Panorama, or Overpass Turbo map data.

Can OSINT shadow analysis determine when a photo was taken?▼

Yes, chronolocation uses shadow length and direction to calculate solar elevation and azimuth. Tools like SunCalc, ShadeMap, and the NOAA Solar Calculator let you match observed shadows to specific dates and times at a candidate location.

What are the limitations of threat actor attribution in OSINT?▼

Attribution requires separating capability from intent and avoiding single-source claims. The methodology enforces a rule-of-three with independent weak signals or one strong plus one weak signal, prefers durable pivots like registrar accounts over ephemeral IPs, and requires explicit confidence levels.

How do I investigate Bluesky or Mastodon accounts in OSINT?▼

For Bluesky, resolve handles via the AT Protocol XRPC endpoint to get DIDs and query the PLC directory for identity history. For Mastodon, use WebFinger for actor discovery and export public follower graphs via the API, archiving content early since deletions propagate asynchronously.

Related Skills

Explore More Education & Research Skills→
DozyboyDozyboy

hs:cti-expert

Conducts OSINT and cyber threat intelligence investigations with structured reports.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

analyzing-campaign-attribution-evidence

Analyze attribution evidence to rank threat actor hypotheses with confidence levels.

Community
Advanced
zli5460zli5460
2

domain-intel

Perform passive OSINT domain analysis using DNS, WHOIS, SSL, and certificate transparency logs.

Community
Basic
UseOSINTUseOSINT
38

graph-the-network

Build entity-relationship link-analysis graphs with sourced, confidence-graded edges for OSINT investigations.

Official
Advanced