agentleFS
Sign inStart free
MysterionRiseMysterionRise/ctf-kit/skills/osint/SKILL.md

osint

Skill12 starsChanged 9 months agoMITView on GitHub

Solve CTF OSINT (open source intelligence) challenges: username enumeration, domain recon, social media investigation, geolocation from images, and public records research. Use when given a username, email, domain, or photo to investigate. Triggers: "find this person", "username lookup", "who is", "geolocation", "reverse image search", "EXIF GPS", "whois", "domain recon", "social media". Tools: sherlock, theHarvester, exiftool, whois, dig. NOT for web app exploitation (use web).

18 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use sqli, xss and 2 more.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • SubhiSecSkill

    sqli

    Hunt SQL injection in REST/GraphQL/SOAP/raw parameters using sqlmap, ghauri, manual UNION/Time/Boolean techniques, and custom WAF-bypass tamper scripts. Use when an input flows into a database query or when the user has identified a parameter that might be vulnerable.

    Also in 3 projects that use this

  • SubhiSecSkill

    xss

    Hunt reflected, stored, and DOM-based Cross-Site Scripting (XSS) including CSP bypass, polyglot payloads, mutation XSS (mXSS), markdown XSS, and template XSS. Use when the user has identified a parameter or input that reflects to the page, or wants to test for XSS in a specific input.

    Also in 3 projects that use this

  • jord0-cmdSkill

    RECON

    Deep technical research that persists. Use when: exploring new technologies, investigating frameworks, comparative analysis of tools, understanding complex systems, or any research task that should be saved for future reference. Invokes Claude's built-in research agent and auto-saves results to a knowledge base for retrieval across sessions.

    Also in 4 projects that use this

  • NVIDIASkill

    research

    Before designing a feature, research how comparable libraries solve the problem, check best practices, known pitfalls, and upstream changes. Use when starting a new feature, investigating an unfamiliar area, or the user asks to research something.

    Also in 3 projects that use this

The file

We split this skill into the rules it gives an agent

4 rules. 0 are common, 3 are distinctive, and 1 is very specific to this project.

  • 0

    Common

    Most of the 16 edited versions we read keep these.

  • 3

    Distinctive

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Use this command for challenges involving:

    line 20
  2. Very specific:

    When using /ctf-kit:team-solve with an OSINT challenge, the lead spawns 3 specialists.

    line 85
  3. Distinctive:

    All OSINT teammates require plan approval: before querying external services.

    line 87
  4. Distinctive:

    Before any teammate queries an external service:

    line 104

“Common” is measured: kept by at least 6 in 10 of the 16 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

CTF OSINT

Gather open source intelligence for OSINT challenges.

When to Use

Use this command for challenges involving:

  • Username searching
  • Domain reconnaissance
  • Social media investigation
  • Geolocation from images
  • Public records research

Bundled Scripts

  • check-tools.sh — Verify required OSINT tools are installed
  • run-sherlock.sh — Username enumeration across platforms. Outputs JSON with found profiles categorized by type (social media, code platforms, other).
  • run-exiftool.sh — OSINT-focused metadata extraction with GPS coordinate extraction. Outputs JSON with interesting fields, GPS data, and flag detection.

Instructions

  1. First check tool availability: bash scripts/check-tools.sh

  2. For username enumeration (outputs structured JSON):

    bash scripts/run-sherlock.sh <username>

    JSON output includes:

    • profiles[]: all found profiles with site and URL
    • social_media[]: social media profiles specifically
    • code_platforms[]: GitHub, GitLab, etc.
    • suggestions: cross-referencing guidance

  3. For image geolocation (outputs structured JSON):

    bash scripts/run-exiftool.sh <image>

    JSON output includes:

    • gps_data: GPS coordinates if present
    • interesting_fields[]: CTF-relevant metadata (comments, author, etc.)
    • has_flag: true if flag pattern found in metadata

  4. For domain reconnaissance:

    theHarvester -d target.com -b all
dig target.com ANY
whois target.com
  5. Online resources:
    • Maps: Google Maps, Google Earth
    • Archive: web.archive.org
    • Reverse Image: Google Images, TinEye
    • Social: LinkedIn, Twitter, Facebook
    • Breach Data: haveibeenpwned.com

OSINT Workflow

  1. run-sherlock.sh username → check JSON for profiles
  2. Cross-reference social and code platforms
  3. run-exiftool.sh image.jpg → check JSON for GPS, metadata clues
  4. Build complete picture from combined findings

Team Roles

When using /ctf-kit:team-solve with an OSINT challenge, the lead spawns 3 specialists.

All OSINT teammates require plan approval before querying external services.

RoleTeammate NameFocusToolsFirst Action
People & Socialsocial-investigatorUsername enumeration, social media profiling, identity correlation, breach datasherlock, scripts/run-sherlock.shRun sherlock on any usernames, cross-reference profiles across platforms
Domain & Infrastructuredomain-analystWHOIS, DNS records, subdomain enumeration, email harvesting, IP geolocation, certificate transparencywhois, dig, theHarvesterRun whois + dig on domains, check certificate transparency logs
Geolocation & Mediageo-analystEXIF GPS extraction, reverse image search, visual landmark identification, Street View correlationexiftool, scripts/run-exiftool.shExtract EXIF GPS, identify visual landmarks, cross-reference with maps

When to broadcast

  • Social: "Username 'target123' has GitHub with a repo containing coordinates" — geo analyst investigates
  • Domain: "Domain registered to email X, also found on social platform Y" — social investigator digs deeper
  • Geo: "EXIF GPS points to 48.8584, 2.2945 (Eiffel Tower)" — others search for related context
  • Any: "Found the flag" — immediate broadcast, all stop

Plan approval flow

Before any teammate queries an external service:

  1. Teammate describes the query and target
  2. Lead reviews for scope (only target what the challenge asks for)
  3. Lead approves or suggests alternative approach

Example Usage

/ctf-kit:osint image.jpg
/ctf-kit:osint challenge.txt

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free