Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

CTF OSINT · ljagiello | DecimalAI

securityby ljagiello

CTF OSINT

ljagiello/ctf-osint

Source ljagiello/ctf-skills ↗License MIT

Provides open source intelligence techniques for CTF challenges.

SkillScore82Maintained

Automatic

Security & AppSec pack

Last verified 8/10/2026

What it changes

Passed 17 of 21 test cases with the skill, and 14 of 21 without it.

Without skill68%

With skill82%

Checks it passed that the model alone missed

Shift the account ID right by 22 bits.
Add 1288834974657 to the shifted result.
Pivot to ctf-malware for binary malware analysis.

and 2 more in the full report

4 fixed14 passed either way3 still failing1 broke

Pass-rate lift: +14 pp
Tokens: +157%
Agent turns: 0%
Response time: -38%

Model Measured 8/10/2026v1 · latest is v218 of 22 cases passed with skill · 21 comparable

Tokens, turns and time describe resource use, not a dollar price.

This benchmark measured an earlier version of the skill.

A newer attempt on gemini-3.8-flash on 10/18/2026 did not produce a publishable comparison (not comparable). The snapshot above is the previously measured run.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/ljagiello-ctf-osint/SKILL.md https://app.decimal.ai/s/ljagiello-ctf-osint/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add ljagiello-ctf-osint, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/ljagiello-ctf-osint/ and pins it in .decimal/skills.lock

decimalai skills add ljagiello-ctf-osint

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/ljagiello-ctf-osint/SKILL.md https://app.decimal.ai/s/ljagiello-ctf-osint/SKILL.md

Raw file: /s/ljagiello-ctf-osint/SKILL.md ↗ · machine-readable summary at /s/ljagiello-ctf-osint.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 3

Prompt

I discovered a 40-character hex fingerprint belonging to an active Tor router node. What web URL path on the official Tor Project metrics service allows directly opening the relay lookup page for this fingerprint?

What was checked, without and with the skill
Checked	Without skill	With skill
Look up the relay at metrics.torproject.org/rs.html#simple/.	Missed	Passed

case-09 · gemini-3.6-flash · 8/10/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md188 linessingle file

CTF OSINT

Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Prerequisites

Python packages (all platforms):

pip install shodan Pillow

Linux (apt):

apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl

macOS (Homebrew):

brew install whois bind nmap exiftool imagemagick curl

MCP servers (optional): Playwright MCP (microsoft/playwright-mcp) for browser-driven OSINT (JS-rendered pages, reverse-image/map flows) — see tools-mcp.md.

Additional Resources

social-media.md - Twitter/X (user IDs, Snowflake timestamps, syndication API, memory.lol, Wayback CDX), Tumblr (blog checks, post JSON, avatars), BlueSky search + API, Unicode homoglyph steganography, Discord API, username OSINT (namechk, whatsmyname, Osint Industries), username metadata mining (postal codes), platform false positives, multi-platform chains, Strava fitness route OSINT
geolocation-and-media.md - Image analysis, reverse image search (including Baidu for China), Google Lens cropped region search, reflected/mirrored text reading, geolocation techniques (railroad signs, infrastructure maps, MGRS), Google Plus Codes, EXIF/metadata, hardware identification, newspaper archives, IP geolocation, Google Street View panorama matching, What3Words micro-landmark matching, Google Maps crowd-sourced photo verification, Overpass Turbo spatial queries, music-themed landmark geolocation with key encoding
web-and-dns.md - Google dorking (including TBS image filters), Google Docs/Sheets enumeration, DNS recon (TXT, zone transfers), Wayback Machine, FEC research, Tor relay lookups, GitHub repository analysis, Telegram bot investigation, WHOIS investigation (reverse WHOIS, historical WHOIS, IP/ASN lookup), fake service banner detection via nmap fingerprinting
tools-mcp.md - Playwright MCP for OSINT: reading JS-rendered pages, screenshots, interactive reverse-image and map/Street View search flows, social media and Wayback snapshots, profile-API mining via browser_network_requests (list) + browser_network_request part="response-body" (payload)

When to Pivot

If you already have the files or packets locally and now need extraction or carving, switch to /ctf-forensics.
If the task becomes active exploitation of a live HTTP service, switch to /ctf-web.
If you uncover malware samples, beacons, or suspicious binaries during attribution, switch to /ctf-malware.

Quick Start Commands

Track record

Benchmark

17 / 21

test cases passed, vs 14 / 21 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v6 — 10/16/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

ljagiello / ctf-skills

ctf-osint/SKILL.md

View on GitHub ↗

License MITImported 10/16/2026Version v2

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

CTF OSINT

Prerequisites

Additional Resources

When to Pivot

Quick Start Commands

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills