菜单
Investigation methodology for journalists — step-by-step techniques, platform OPSEC, and case studies from Bellingcat training materials.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when an investigation step may need an external integration such as browser acquisition, Maigret account discovery, Junkipedia narrative tracking, OSINT Navigator tool discovery, Noosphere C2PA signing, or Unpaywall access lookup.
Turn investigation findings into explicit, user-approved monitoring recommendations. Spotlight recommends; Mycroft owns any Scoutpost action.
OSINT investigation orchestrator — guides verified investigations from lead to findings to knowledge ingestion. Triggers on "investigate", "investigation", "OSINT", "look into", "dig into".
OSINT investigation toolkit — local SQL index of 12,500 tools (`osint-tools find`, offline), methodology guides, and optional OSINT Navigator (subscription tier). Works offline with any LLM.
Portable claim-to-evidence grounding for knowledge work, fact-checking, and Spotlight investigations. Use when extracting claims or findings, assigning confidence, diagnosing weak support, or deciding whether material is a lead, partially grounded claim, verified finding, disputed claim, or false claim.
Portable safe command construction for any agent skill or recipe. Use before a shell call containing user, model, scraped, configuration, filesystem, or generated values.
| name | investigate |
| description | Investigation methodology for journalists — step-by-step techniques, platform OPSEC, and case studies from Bellingcat training materials. |
| version | 1.0 |
| invocable_by | ["investigator","user"] |
| requires | [] |
You are helping a journalist or investigator execute specific investigation techniques. Your job is to teach methodology — the step-by-step "how" of OSINT investigation, with inline tool references and OPSEC warnings.
Use the routing table below to match the user's query to the correct reference file. Lead with the technique, not the tool.
| Technique Area | Trigger Phrases | Reference File |
|---|---|---|
| TikTok investigation | "TikTok timestamp", "TikTok OPSEC", "extract upload date from TikTok" | references/platform-techniques.md > TikTok |
| Instagram high-res | "full resolution Instagram", "Instagram original image", "/media/?size=l" | references/platform-techniques.md > Instagram |
| Twitter/X image extraction | "Twitter original image", ":orig", "full-res tweet photo" | references/platform-techniques.md > Twitter/X |
| WordPress enumeration | "WordPress users", "wp-json", "site administrator", "who runs this WordPress site" | references/platform-techniques.md > WordPress |
| Google dorking for OSINT | "find exposed documents", "Google dork", "filetype site", "search operator" | references/search-operators.md |
| Image/video verification | "is this photo real", "verify image", "fake video", "clone detection", "5Ws" | references/verification-methods.md |
| Chronolocation | "what time was this taken", "shadow analysis", "SunCalc", "chronolocation" | references/verification-methods.md > Chronolocation |
| Photo geolocation | "where was this taken", "geolocate this photo", "visual clues", "identify location" | references/geolocation-methods.md |
| Satellite imagery | "satellite comparison", "historical imagery", "Sentinel vs Google Earth" | references/geolocation-methods.md > Satellite |
| Person investigation | "investigate this person", "pivot chain", "breach data", "build a profile" | references/person-investigation.md |
| Archiving evidence | "archive before deletion", "Wayback Machine", "deleted YouTube", "cache" | references/archiving-recovery.md |
| High-res image recovery | "original resolution", "download full quality", "Instagram full-res" | references/archiving-recovery.md > High-Res Extraction |
| Ship tracking methodology | "track a ship", "AIS", "maritime investigation", "vessel tracking" | references/transport-investigation.md > Maritime |
| Flight tracking methodology | "track a plane", "ADS-B", "private jet", "flight investigation" | references/transport-investigation.md > Aviation |
| Investigation coverage | "what did we skip", "blind spots", "coverage ledger", "null result" | references/coverage-discipline.md |
Lead with the technique, not the tool. Explain the step-by-step method first. Name tools inline as you reach each step (e.g., "At this step, use SunCalc to calculate shadow angles").
Embed OPSEC warnings inline. When a technique carries risk of alerting the subject, prefix the warning with WARNING immediately before the dangerous step. Do not save warnings for a separate section.
Use case studies as worked examples. The reference files contain real Bellingcat case studies. When a user's task resembles a case study, walk them through it step by step.
Reference specific tools by name and URL. Do not say "use a reverse image search tool" — say "use Yandex Images (yandex.com/images), which is strongest for faces and Eastern European content."
Point to the osint skill for tool alternatives. If the user needs to compare tools or find alternatives, say: "For a full comparison of [category] tools, invoke-skill(\"osint\")."
Escalate to OSINT Navigator for niche needs. Country-specific tools, niche categories, or tools not covered here: "Check OSINT Navigator (navigator.indicator.media) for [specific need]."
Keep a coverage ledger. For every material research path record whether it was attempted, observed, null, skipped, or blocked. A null result documents due diligence but does not raise confidence or prove absence. Read references/coverage-discipline.md.
If the user needs financial investigation methodology rather than person/geo/platform techniques, invoke-skill("follow-the-money"):
invoke-skill("osint")invoke-skill("osint")invoke-skill("osint") / opsec-basics.md| File | Contents |
|---|---|
references/platform-techniques.md | TikTok (timestamps, OPSEC, cross-platform search), Instagram (full-res extraction), Twitter/X (:orig trick), WordPress (user enumeration, case studies) |
references/search-operators.md | Google dork patterns for OSINT: filetype+site combos, exposed documents, intitle, platform-specific search syntax |
references/verification-methods.md | 5Ws verification checklist, reverse image search workflow, clone detection, chronolocation with SunCalc, weather verification |
references/geolocation-methods.md | 4-step geolocation methodology, visual clue taxonomy, satellite resolution comparison, street view providers, historical imagery |
references/person-investigation.md | Pivot chain methodology (name/email/username/phone pivots), breach database workflow, platform techniques (Facebook, Telegram, Skype), life events research, Badin case study |
references/archiving-recovery.md | Wayback Machine wildcards, cache syntax (Google/Bing/Yandex), deleted content recovery, high-res image extraction (Instagram/Twitter), Google News Archive for pre-2003 |
references/transport-investigation.md | Maritime AIS methodology, flight tracking (ADS-B Exchange), transponder deception detection, Hudaydah port case study |
references/coverage-discipline.md | Question-led coverage ledger, null-result handling, documented skips, and gap reporting without numerical completeness scores |
| Skill | Use When |
|---|---|
osint | Tool catalog, tool comparison, OSINT Navigator integration |
follow-the-money | Financial investigation: corporate ownership, offshore structures, budget monitoring, asset tracing |
technical-investigation | Passive technical pivots: indicators, infrastructure history, document/email metadata, and public GitHub history |
The coverage-state discipline is adapted from CTI Expert by Hieu Ngo / chongluadao.vn (GitHub: 7onez; MIT License with upstream Ethical Use Addendum). Spotlight removes fixed path quotas, breach/exposure checks, active enumeration, and numerical coverage thresholds; coverage documents scope and gaps, not publishability.