skills.rest
buriedsignals
buriedsignalsOFFICIAL
Explore all skills by this author →
Website𝕏@buriedsignalsGitHub

technical-investigation

Analyze indicators, infrastructure history, documents, and GitHub activity using passive OSINT methods.

43|8|Updated Mar 25, 2026
Search Tags:#threat intelligence#osint#email forensics#passive dns#indicator triage#github osint#stix export
One-click install
npx skills add https://github.com/buriedsignals/spotlight --skill technical-investigation-buriedsignals
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: technical-investigation
Source: https://github.com/buriedsignals/spotlight/tree/main/skills/technical-investigation
Command: npx skills add https://github.com/buriedsignals/spotlight --skill technical-investigation-buriedsignals

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Investigators need to examine domains, IPs, URLs, file hashes, documents, email headers, and public GitHub history without tipping off targets, contaminating evidence, or overstating what technical signals actually prove. ## Core Features & Use Cases - Passive Indicator Triage: Classify domains, IPs, URLs, and file hashes using passive records and public APIs, capturing provider labels as dated observations rather than verdicts. - Infrastructure History Reconstruction: Build dated timelines from passive DNS, certificate transparency, RDAP/WHOIS, and web archives without scanning or probing live hosts. - Document and Email Forensics: Extract metadata from local files and parse raw email headers, treating SPF/DKIM/DMARC results as server assertions rather than identity proof. - Verified Indicator Export: Export fact-checked indicators (IPv4, domains, hashes, crypto addresses) to JSON, CSV, or STIX only after Gate 1 verification. - Use Case: A journalist receives a suspicious email linking to an unknown domain. Use this Skill to passively triage the domain, reconstruct its DNS and certificate history, analyze the raw email headers, and export only the indicators that survive fact-checking. ## Quick Start Use the technical-investigation skill to passively triage the domain in this phishing email and reconstruct its infrastructure history without contacting the live host.

Frequently Asked Questions about technical-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a suspicious domain or IP without alerting the target?▼

Use passive indicator triage: query passive DNS records, certificate transparency logs, and public provider APIs instead of visiting the URL or scanning the IP. Record each observation with its source URL, collection time, and provider wording as a dated lead.

How to analyze email headers for an investigation?▼

Preserve the raw message and hash it first, then unfold and read the Received chain from the earliest trusted boundary toward the recipient. Treat SPF, DKIM, and DMARC results as server assertions about handling, not proof of the human sender's identity.

Can shared infrastructure prove two domains have the same owner?▼

No. Shared IPs, certificates, nameservers, and analytics IDs are pivots, not proof of common control, since CDNs and shared hosting create false links. Corroborate with independent sources and word findings as time-bounded observations.

When can I export indicators as STIX or CSV?▼

Export is allowed only after Gate 1 fact-checking, when every linked claim has a verified verdict and the indicator value appears verbatim in the claim text. Personal selectors like emails and usernames are excluded, and URLs with query strings are rejected.

What are the limitations of GitHub OSINT for attribution?▼

Git author names and emails are self-asserted metadata that do not prove identity, employment, or intent. The method excludes secret hunting, credential validation, private access, and behavioral profiling, and requires independent corroboration before any attribution claim.

Related Skills

Explore More Education & Research Skills→
haolangehaolange
15

shader-ir

Parse HLSL, GLSL, and SPIR-V to detect suspicious shader fingerprints.

Community
Advanced
xalgordxalgord
954

extracting-iocs-from-malware-samples

Extracts file, network, and host IOCs from malware samples into STIX and CSV formats.

Community
Advanced
ethicalcapitalethicalcapital

evidence-crawl

Consolidate evidence from R2, Qdrant, and web crawling for narrative construction.

Official
Intermediate
xalgordxalgord
954

collecting-open-source-intelligence

Collects OSINT on threat actors and malicious infrastructure using passive reconnaissance tools.

Community
Intermediate