----------------
🛠️ Tool: claude-osint ships external recon tradecraft as Claude skills
===================
What it is. claude-osint, built by Sachin Sharma (GenAI Security Research), is a library of eight SKILL.md files for the Claude skills system. Each file primes Claude with a written methodology covering one slice of external recon, aimed at authorized red-team and bug-bounty engagements. The bulk is structured markdown, about 10,000 lines total, plus two small Python scripts.
Core skills.
• osint-methodology (515 lines): strategy and discipline; asset-graph management, a severity rubric, time budgeting, identity-fabric mapping, deliverable templates.
• offensive-osint (4,555 lines): the tactical layer; probe paths, regexes, payloads, scoring rules, curl one-liners, plus 80 secret patterns, 80+ dorks, 9 read-only credential validators, and 27 attack-path templates.
Org-scale skills. Six additional skills, per the README:
• org-attack-surface: maps a legal entity to its owned footprint using GLEIF org-trees, org-first RIR netblock recall, and an ASN hyperscaler-scope guard; discovery only.
• email-domain-security: composite spoofability verdict separating envelope from header-From; explicit note that SPF -all alone does not make a domain spoof-proof; SPF supply-chain analysis.
• exposure-risk-quantification: FAIR-based 0-100 and A-F score, dollar-denominated loss model, board one-pager, and honesty caps on ownership/proof claims.
• continuous-exposure-monitoring: rescan/diff loop, CTI and ransomware chatter checks, finding-lifecycle false-positive discipline, durable alert outbox.
• cloud-saas-exposure: ownership-gated bucket severity, offline AWS account-ID decoding, dependency-confusion confirmation, K8s/CI fingerprinting.
• identity-provider-recon: tenant and federation mapping, pre-auth user-enumeration oracle, name×pattern login synthesis, with a "hard enumeration boundary".
Scripts. secret_scan.py is a stdlib-only 80-pattern secret scanner; h1_reference.py acts as a reference agent over disclosed HackerOne reports.
Use cases. The recon phase of authorized engagements: entity-to-footprint mapping, per-domain spoofability triage, and exposure scoring for client or board reporting. The files also read as standalone reference documents.
Limitations. The evaluation figures (56/56 pass on a 56-prompt self-evaluation, zero fabrications, ~85-90% practitioner coverage) are self-reported by the author and not independently verified. Structurally these are prompt files, not enforcement code: scope controls such as the enumeration boundary live in the instructions themselves, so scope discipline depends on the operator. The README bills the package as "god-mode" recon; the substance is closer to a well-ordered methodology library, which is the more useful framing anyway.
References. Repo: claude-osint on GitHub, author profile under Sachin Sharma; Claude skills documentation.
🔹 tool #OSINT #ClaudeSkills #RedTeam #BugBounty