Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secret_scan.py and h1_reference.py helpers, run sync-skill-content.sh, run the smoke test. Use when asked to run, build, test, validate, or smoke-test claude-osint or its OSINT skills/scripts.
.claude/skills/elementalsouls-run-claude-osint/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-04 | ✗→✓ | ▲ Improved | 7% | 0% |
| case-05 | ✗→✓ | ▲ Improved | -14% | 0% |
| case-06 | ✗→✓ | ▲ Improved | -6% | 0% |
| case-08 | ✗→✓ | ▲ Improved | 13% | 0% |
| case-09 | ✗→✓ | ▲ Improved | 26% | 0% |
claude-osint is not an app — it's a Claude skills package. Its product is two SKILL.md files (skills/offensive-osint/, skills/osint-methodology/) plus two runnable Python helpers under skills/offensive-osint/scripts/. There is no GUI, server, or TUI. "Running it" means: the SKILL.md frontmatter parses and is complete (that's what Claude loads), and the helper scripts work.
The driver is .claude/skills/run-claude-osint/smoke.sh — it does all of that in one shot. All paths below are relative to the repo root.
Python 3 with PyYAML (already present on this container). If import yaml fails:
bashpip install pyyaml # or: apt-get install -y python3-yaml
The helpers are stdlib-only otherwise. h1_reference.py needs outbound HTTPS to hackerone.com. No build step, no npm install — nothing to compile.
From the repo root:
bash.claude/skills/run-claude-osint/smoke.sh # full smoke (exits 0 on pass) .claude/skills/run-claude-osint/smoke.sh --no-net # skip the HackerOne live check
It runs six checks and prints a ==> PASS / ==> FAIL line (exit 0 / 1):
py_compile both helpers.secret_scan.py detects AWS key + JWT from stdin (the CI canaries).secret_scan.py recursively scans skills/ and emits JSONL (~11 findings — example tokens in the SKILL.md docs).skills/*/SKILL.md has valid YAML frontmatter with name/description/version/triggers and ≥5 triggers.sync-skill-content.sh --check exits 0.h1_reference.py fetches one live disclosed report (non-fatal if offline).Verified this session:
bash# Secret scanner — stdin printf 'AKIAIOSFODNN7EXAMPLE\n' | python3 skills/offensive-osint/scripts/secret_scan.py # -> {"pattern": "AWS_ACCESS_KEY", "severity": "critical", ...} # Secret scanner — scan a directory tree (JSONL, one finding per line) python3 skills/offensive-osint/scripts/secret_scan.py skills/ # HackerOne reference helper (needs network) python3 skills/offensive-osint/scripts/h1_reference.py --top-voted --limit 3 python3 skills/offensive-osint/scripts/h1_reference.py --top-bounty --limit 3 python3 skills/offensive-osint/scripts/h1_reference.py --top-voted --query "XSS" --pages 3 # Install the skills for Claude to load cp -r skills/* ~/.claude/skills/
CI (.github/workflows/lint.yml) runs four jobs: markdown lint (markdownlint-cli2), the frontmatter check, the secret_scan.py smoke, and shellcheck ./scripts. smoke.sh covers the latter two plus the helpers directly. markdownlint-cli2 and shellcheck are not installed on this container; install with npm i -g markdownlint-cli2 / apt-get install -y shellcheck if you need to reproduce those jobs locally.
sync-skill-content.sh is a no-op in a fresh clone. It copies fromdocs/full-skills/, which is not in the repo — the script prints "⚠ Source missing … Skipping" and exits 0. The skills/*/SKILL.md files are already the full inline content (offensive-osint ≈ 4,200 lines), so you do not need to run sync after cloning. Don't be alarmed by the warnings.
secret_scan.py skips its own findings as noise filters. It excludes.git, node_modules, __pycache__, .venv, dist, build, .cache and any file >10 MB. Scanning skills/ returns the example/doc tokens (~11), not real secrets.
h1_reference.py hits an undocumented public GraphQL endpoint. It worksunauthenticated but is sensitive to HackerOne-side changes and rate limits; treat a failure there as environmental, not a repo bug (hence non-fatal in the driver). It caps at 50 results/page — use --pages N for breadth.
asks to "see it run," that means the smoke.sh PASS output, not a GUI.
| Symptom | Fix | |---|---| | ModuleNotFoundError: No module named 'yaml' in check 4] | pip install pyyaml (only the frontmatter check needs it). | | Check 6] shows ~ no network / HackerOne unreachable | Expected when egress is blocked; run with --no-net to silence. Driver still passes. | | sync --check shows "Source missing" | Expected — see Gotchas. Not a failure; exit code is 0. |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 10,426 | 8,250 | -21% | 1 | 1 | 0% | 1,037 | 1,536 | +48% | 0 | 0 | — |
case-02 | fail→fail | 11,818 | 19,139 | +62% | 1 | 1 | 0% | 1,050 | 1,796 | +71% | 0 | 0 | — |
case-03 | fail→fail | 13,670 | 33,104 | +142% | 1 | 1 | 0% | 145 | 1,592 | +998% | 0 | 0 | — |
case-04 | fail→pass | 16,762 | 10,417 | -38% | 1 | 1 | 0% | 2,103 | 2,251 | +7% | 0 | 0 | — |
case-05 | fail→pass | 11,817 | 2,124 | -82% | 1 | 1 | 0% | 1,900 | 1,641 | -14% | 0 | 0 | — |
case-06 | fail→pass | 15,622 | 2,679 | -83% | 1 | 1 | 0% | 1,878 | 1,758 | -6% | 0 | 0 | — |
case-07 | pass→pass | 2,688 | 7,449 | +177% | 1 | 1 | 0% | 378 | 1,697 | +349% | 0 | 0 | — |
case-08 | fail→pass | 12,425 | 9,654 | -22% | 1 | 1 | 0% | 1,862 | 2,110 | +13% | 0 | 0 | — |
case-09 | fail→pass | 15,080 | 9,026 | -40% | 1 | 1 | 0% | 1,609 | 2,031 | +26% | 0 | 0 | — |
case-10 | fail→fail | 12,804 | 10,743 | -16% | 1 | 1 | 0% | 2,151 | 1,521 | -29% | 0 | 0 | — |
case-11 | fail→pass | 16,094 | 2,652 | -84% | 1 | 1 | 0% | 1,867 | 1,765 | -5% | 0 | 0 | — |
case-12 | fail→fail | 25,949 | 10,108 | -61% | 1 | 1 | 0% | 2,146 | 1,552 | -28% | 0 | 0 | — |
case-13 | pass→pass | 17,894 | 12,324 | -31% | 1 | 1 | 0% | 2,088 | 2,485 | +19% | 0 | 0 | — |
case-14 | fail→pass | 12,537 | 10,486 | -16% | 1 | 1 | 0% | 1,100 | 1,674 | +52% | 0 | 0 | — |
case-15 | pass→fail | 11,261 | 5,173 | -54% | 1 | 1 | 0% | 1,208 | 1,523 | +26% | 0 | 0 | — |
case-16 | fail→pass | 19,696 | 14,598 | -26% | 1 | 1 | 0% | 2,829 | 2,546 | -10% | 0 | 0 | — |
case-17 | fail→pass | 16,241 | 4,386 | -73% | 1 | 1 | 0% | 2,132 | 2,234 | +5% | 0 | 0 | — |
case-18 | pass→pass | 11,513 | 9,353 | -19% | 1 | 1 | 0% | 2,059 | 2,113 | +3% | 0 | 0 | — |
case-19 | fail→fail | 9,147 | 12,710 | +39% | 1 | 1 | 0% | 1,435 | 3,351 | +134% | 0 | 0 | — |
case-20 | pass→pass | 16,713 | 11,957 | -28% | 1 | 1 | 0% | 2,073 | 2,767 | +33% | 0 | 0 | — |
case-21 | pass→pass | 19,135 | 13,220 | -31% | 1 | 1 | 0% | 2,730 | 2,713 | -1% | 0 | 0 | — |
case-22 | fail→pass | 18,101 | 6,596 | -64% | 1 | 1 | 0% | 3,287 | 1,534 | -53% | 0 | 0 | — |
case-23 | fail→pass | 9,085 | 14,828 | +63% | 1 | 1 | 0% | 453 | 2,870 | +534% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 17 counted toward the lift figure. The other 6 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +43 percentage points is the difference between those two pass rates over the 17 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.