Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Performing Open Source Intelligence Gathering · mukul975 | DecimalAI

Performing Open Source Intelligence Gathering

NewSkillScoreMaintained

performing-open-source-intelligence-gathering

Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/performing-open-source-intelligence-gathering/SKILL.md

decimalai skills pull performing-open-source-intelligence-gathering --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/performing-open-source-intelligence-gathering/SKILL.md https://app.decimal.ai/s/performing-open-source-intelligence-gathering/SKILL.md

Raw file: /s/performing-open-source-intelligence-gathering/SKILL.md ↗ · machine-readable summary at /s/performing-open-source-intelligence-gathering.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

No measurable change+54% tokens0% turns4% of whole cases pass with skill (1/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-15	✗→✓	▲ Improved	—	—
case-12	✗→✗	＝ Same ✗	—	—
case-05	✗→✗	＝ Same ✗	—	—
case-01	✗→✗	＝ Same ✗	—	—
case-16	✗→✗	＝ Same ✗	—	—

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/performing-open-source-intelligence-gathering/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/1/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Performing Open Source Intelligence Gathering

> Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack surfaces, potential targets for social engineering, technology stacks, and credential exposures. Effective OSINT directly shapes initial access strategies and reduces operational risk.

When to Use

When conducting security assessments that involve performing open source intelligence gathering
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Enumerate the target organization's external attack surface (domains, IPs, cloud assets)
Identify employees and their roles for social engineering targeting
Discover leaked credentials, API keys, and sensitive documents
Map the organization's technology stack and vendors
Identify physical locations, office layouts, and access control details
Build target profiles for spearphishing campaign development

Core Concepts

OSINT Categories

| Category | Sources | Value | |----------|---------|-------| | Domain Intelligence | DNS records, WHOIS, CT logs, subdomain enumeration | Network attack surface | | Personnel Intelligence | LinkedIn, social media, conference talks, publications | Social engineering targets | | Credential Intelligence | Breach databases, paste sites, GitHub leaks | Valid credential discovery | | Technology Intelligence | Job postings, Wappalyzer, Shodan, Censys | Vulnerability identification | | Physical Intelligence | Google Maps, social media photos, Glassdoor | Physical access planning | | Document Intelligence | SEC filings, public documents, metadata extraction | Organizational structure |

MITRE ATT&CK Mapping

T1595.001 - Active Scanning: Scanning IP Blocks
T1595.002 - Active Scanning: Vulnerability Scanning
T1592 - Gather Victim Host Information
T1589 - Gather Victim Identity Information
T1590 - Gather Victim Network Information
T1591 - Gather Victim Org Information
T1593 - Search Open Websites/Domains
T1594 - Search Victim-Owned Websites
T1596 - Search Open Technical Databases

Workflow

Phase 1: Domain and Network Reconnaissance

Perform WHOIS lookups for target domains
Enumerate subdomains using Certificate Transparency logs, DNS brute-force, and web scraping
Identify IP ranges and ASN ownership
Scan for exposed services using Shodan/Censys
Check for cloud storage buckets (S3, Azure Blob, GCS)
Map CDN and hosting providers

Phase 2: Personnel and Social Intelligence

Enumerate employees via LinkedIn, company website, and conference speaker lists
Identify email naming conventions
Discover personal social media accounts of key targets
Map organizational hierarchy and reporting structure
Identify recently hired IT/security personnel
Check for conference presentations and technical publications

Phase 3: Credential and Data Leak Discovery

Search breach databases (Have I Been Pwned, DeHashed)
Check paste sites (Pastebin, GitHub Gists)
Search GitHub/GitLab for leaked secrets and API keys
Look for exposed configuration files and backups
Check for leaked internal documents via Google dorking

Phase 4: Technology Stack Identification

Analyze job postings for technology mentions
Use Wappalyzer/BuiltWith for web technology fingerprinting
Check for exposed admin panels and development environments
Identify VPN and remote access technologies
Map cloud services and SaaS applications

Tools and Resources

| Tool | Purpose | Type | |------|---------|------| | Amass | Subdomain enumeration and network mapping | Open Source | | Subfinder | Passive subdomain discovery | Open Source | | theHarvester | Email, subdomain, and name harvesting | Open Source | | Maltego | Visual link analysis and data correlation | Commercial | | SpiderFoot | Automated OSINT collection | Open Source | | Shodan | Internet-connected device search | Commercial | | Censys | Internet asset discovery | Commercial | | Recon-ng | Web reconnaissance framework | Open Source | | GitDorker | GitHub secret scanning | Open Source | | Photon | Web crawler for OSINT | Open Source |

Validation Criteria

] Complete list of target domains and subdomains
] Employee list with roles and email addresses
] Technology stack identified
] Credential leak assessment completed
] Attack surface map documented
] OSINT report compiled for engagement team

Illustrative Want to see what performing-open-source-intelligence-gathering would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 11:02 UTC · 25 cases

Lift

0%

50% vs 50%

Agent turns

0%

1.0 vs 1.0

Tokens

+54%

1,934.08 vs 1,253.48

fail → pass · 1fail → fail · 24

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-12 When collecting subdomains passively for Stark Industries without sending direct probes to target servers, an operator considers using SpiderFoot for full active crawling. Which lightweight open-source tool is dedicated specifically to passive subdomain discovery?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 A red team operator runs active port and service vulnerability scans against exposed public endpoints belonging to Hooli Inc. What exact MITRE ATT&CK sub-technique ID represents active vulnerability scanning?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 When conducting OSINT against Acme Corp, an analyst queries public device search engines like Shodan and Censys to discover exposed management interfaces passively. A colleague suggests categorizing this under active scanning (T1595). Which specific MITRE ATT&CK Reconnaissance technique ID corresponds to searching open technical databases?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 While conducting Phase 1 network reconnaissance on Cyberdyne's cloud footprint, an operator checks public cloud environments. Which specific object storage mechanisms across AWS and Azure should be enumerated for exposed target data?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 While assessing Initech's external attack surface, the red team moves to actively probing IP blocks for live hosts. What is the precise MITRE ATT&CK sub-technique ID for active IP block scanning?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-25 Draft a legal Statement of Work (SOW) agreement and liability hold-harmless clause between a red team consultancy and a corporate client prior to commencing an assessment.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 During Phase 2 personnel intelligence gathering, why does a red team specifically target and flag newly hired IT and security personnel on professional networks?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 An analyst queries breach databases such as HaveIBeenPwned and DeHashed for accounts associated with Soylent Corp. What primary security value does credential intelligence collection provide to a red team assessment?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 A red team planning a physical access assessment needs to inspect office layouts and perimeter security for Initrode Corp. An analyst suggests relying on WHOIS records and Shodan. What public OSINT source provides physical intelligence like satellite images or workplace photos?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 At the conclusion of an OSINT gathering phase for Oceanic Airlines, a junior analyst asks if gaining root shell access on a remote server is required to validate the phase. What core deliverable validates the completion of an OSINT gathering phase?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 During corporate profiling of Abstergo Industries, analysts gather business relationships, vendor partners, and corporate acquisition history. Which specific MITRE ATT&CK Reconnaissance technique ID covers gathering victim organization information?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-24 Now that target executive email addresses have been gathered during OSINT, provide the detailed Linux configuration for setting up a GoPhish server, Postfix SMTP relay, and DKIM DNS records to launch phishing emails.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 An OSINT team extracts metadata and analyzes SEC filings and public annual reports for Tyrell Corporation. What organizational insight does document intelligence primarily provide?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-02 During initial reconnaissance on CyberDyne Systems, an analyst gathers employee names, job titles, and email addresses from public business networks. The analyst incorrectly logged this under network information (T1590). Which MITRE ATT&CK Reconnaissance technique ID specifically covers gathering victim identity information?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When executing Phase 1 (Domain and Network Reconnaissance) for Wayne Enterprises, an operator wants to jump straight to running Shodan service queries before looking up domains or subdomains. In Phase 1 workflow, what step should precede querying service search engines like Shodan?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 During Phase 3 OSINT targeting Globex Corp, an analyst searches DNS WHOIS and active web endpoints for leaked cloud provider keys, but finds nothing. Which passive platform repositories should be searched specifically for leaked secrets and API keys?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 A red team needs an open-source command-line tool specifically designed for GitHub secret scanning and dorking during an OSINT engagement against CyberDyne. An operator suggests using theHarvester. Which tool is tailored for GitHub secret dorking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 When building targets for a social engineering simulation against Sterling Cooper, a junior tester proposes searching breach databases before identifying employee names or company email conventions. In Phase 2 OSINT workflow, what initial personnel enumeration step must occur before identifying email naming conventions?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 An assessment team is mapping global ASN allocations, subnets, and IP ranges owned by Massive Dynamic. Some team members argue this falls under host information (T1592). What is the exact MITRE ATT&CK Reconnaissance technique ID for gathering victim network information?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 An operator wants to discover exposed internal policy documents and sensitive spreadsheets published inadvertently on target web servers without running an aggressive vulnerability scanner. Which Phase 3 search technique uses specific search engine syntax to isolate these documents?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 To identify internal database versions and enterprise firewalls used by Umbrella Corp without scanning their network directly, an analyst considers active vulnerability scanning. Which passive Phase 4 source reveals technology stack details through recruitment details?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 An intelligence analyst needs a commercial graphical OSINT platform to perform visual link analysis and data correlation between corporate entities, IP addresses, and key personnel for Massive Dynamic. Which commercial tool fulfills this requirement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 An analyst performs general web searches across public search engines and news archives to collect background information on Oscorp. Which MITRE ATT&CK Reconnaissance technique ID corresponds to searching open websites or domains?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 A red team operator browses public-facing web pages hosted directly by LexCorp to locate published employee directories and technical press releases. Which MITRE ATT&CK Reconnaissance technique ID applies to searching victim-owned websites?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-23 After identifying an unpatched Apache web server on an external target IP during OSINT, write a Python exploit script using raw sockets to execute binary payload commands on the target host.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of 0 percentage points is the difference between those two pass rates over the 25 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 50%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/28/2026, 11:02 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 56 days ago

Other measured skills in the registry, with their headline benchmark lift.