agentleFS
Sign inStart free
dRafaleDdRafaleD/cybersec-skills/skills/operations/lean-osint/SKILL.md

lean-osint

Skill2 starsChanged 57 days agoMITView on GitHub

Runs token-efficient authorized OSINT and exposure reviews for Cursor and Codex. Builds compact sourced intel cards from public information the user is allowed to collect. Use when the user asks for OSINT, own-org attack surface, public leak checks, brand impersonation review, or a threat-intel summary. Do not use for stalking, doxxing, social engineering, credential stuffing, scraping login walls, or accessing non-public systems.

The file

We split this skill into the rules it gives an agent

5 rules. About 0 are common, 4 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈4

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Write cards to a temp JSON (not the user's content tree unless they asked).

    line 27
  2. Distinctive:

    No fake personas, pretexting, or phishing "for OSINT".

    line 48
  3. Distinctive:

    No credentials, session cookies, or bypass of paywalls/auth.

    line 49
  4. Distinctive:

    No dossiers on private individuals (home address, family, phone) unless the user is that person and asked about their own exposure.

    line 50
  5. Distinctive:

    Do not dump WHOIS/full PDFs.

    line 51

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Lean OSINT

Authorized public-source intel with a hard context budget. Cite, compress, stop.

Let SKILL_ROOT be the folder that contains this SKILL.md. Prefer python3; on Windows use py -3.

python3 "$SKILL_ROOT/scripts/lean_osint.py" template
python3 "$SKILL_ROOT/scripts/lean_osint.py" check /path/to/cards.json
python3 "$SKILL_ROOT/scripts/lean_osint.py" trim --chars 2500 path/to/dump.txt

Write cards to a temp JSON (not the user's content tree unless they asked). Then check. Do not paste SERP dumps, HTML, or people-search exports into chat.

Mode

Default lean.

ModeBudget
lean≤5 sourced cards; references/intel.md
standard≤10 cards
deepstill public sources only; ≤15 cards

Workflow

  1. Confirm scope: the user's org, domain, product, or an incident they already own. If the target is a private person, stop and ask.
  2. Collect from public pages and the user's own workspace files. Prefer official sites, their DNS/certs they already exported, their GitHub org.
  3. One claim per card: source URL, date accessed, confidence, next defensive action.
  4. check the JSON. Report the table. Do not keep raw search pages in context.

Hard rules

  • No fake personas, pretexting, or phishing "for OSINT".
  • No credentials, session cookies, or bypass of paywalls/auth.
  • No dossiers on private individuals (home address, family, phone) unless the user is that person and asked about their own exposure.
  • Do not dump WHOIS/full PDFs. Quote ≤12 lines from a source.

Report template

## Lean-osint (`<mode>`)

**Question:** <one line> | **Scope:** <domain/org>

| Conf | Claim | Source | Defensive next step |
|------|-------|--------|---------------------|
| med | one clause | host + date | one action |

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free