菜单
Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secret_scan.py and h1_reference.py helpers, run sync-skill-content.sh, run the smoke test. Use when asked to run, build, test, validate, or smoke-test claude-osint or its OSINT skills/scripts.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/elementalsouls/Claude-OSINT --skill run-claude-osint命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm scope-claimability nuanc
Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-
Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the record-level SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC fetch recipes in the offensive-osint arsenal (§16.14) with the reasoning that section doesn't do: a priority-ordered composite verdict for whether an attacker can actually land header-From-spoofed mail in an inbox, and by which vector (exact-domain vs subdomain) — grounded in the single most-misunderstood distinction in email security: the envelope MAIL FROM that SPF authenticates vs the visible header From: that only DMARC governs. Explains precisely why SPF -all/~all alone is NOT spoof-proof without DMARC enforcement, and why SPF +all bypasses DMARC even under p=reject pct=100. Covers RFC 7208 §4.6.4's 10-DNS-lookup / 2-void-lookup PermError fail-open condition with a runnable stdlib-only lookup-counter script, plus the SPF-include-takeover supply-chain vector (an attacker re-registering a dead include inherits SPF-pass authority ov
基于 SOC 职业分类
正在显示 SKILL.md
| name | run-claude-osint |
| description | Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secret_scan.py and h1_reference.py helpers, run sync-skill-content.sh, run the smoke test. Use when asked to run, build, test, validate, or smoke-test claude-osint or its OSINT skills/scripts. |
| version | 1.0.0 |
| triggers | ["run claude-osint","build claude-osint","test claude-osint","validate claude-osint","smoke test claude-osint","run secret_scan","run h1_reference","validate SKILL.md frontmatter","sync skill content"] |
claude-osint is not an app — it's a Claude skills package. Its product
is two SKILL.md files (skills/offensive-osint/, skills/osint-methodology/)
plus two runnable Python helpers under skills/offensive-osint/scripts/. There
is no GUI, server, or TUI. "Running it" means: the SKILL.md frontmatter parses
and is complete (that's what Claude loads), and the helper scripts work.
The driver is .claude/skills/run-claude-osint/smoke.sh — it does all of
that in one shot. All paths below are relative to the repo root.
Python 3 with PyYAML (already present on this container). If import yaml fails:
pip install pyyaml # or: apt-get install -y python3-yaml
The helpers are stdlib-only otherwise. h1_reference.py needs outbound HTTPS to
hackerone.com. No build step, no npm install — nothing to compile.
From the repo root:
.claude/skills/run-claude-osint/smoke.sh # full smoke (exits 0 on pass)
.claude/skills/run-claude-osint/smoke.sh --no-net # skip the HackerOne live check
It runs six checks and prints a ==> PASS / ==> FAIL line (exit 0 / 1):
py_compile both helpers.secret_scan.py detects AWS key + JWT from stdin (the CI canaries).secret_scan.py recursively scans skills/ and emits JSONL (~11 findings — example tokens in the SKILL.md docs).skills/*/SKILL.md has valid YAML frontmatter with name/description/version/triggers and ≥5 triggers.sync-skill-content.sh --check exits 0.h1_reference.py fetches one live disclosed report (non-fatal if offline).Verified this session:
# Secret scanner — stdin
printf 'AKIAIOSFODNN7EXAMPLE\n' | python3 skills/offensive-osint/scripts/secret_scan.py
# -> {"pattern": "AWS_ACCESS_KEY", "severity": "critical", ...}
# Secret scanner — scan a directory tree (JSONL, one finding per line)
python3 skills/offensive-osint/scripts/secret_scan.py skills/
# HackerOne reference helper (needs network)
python3 skills/offensive-osint/scripts/h1_reference.py --top-voted --limit 3
python3 skills/offensive-osint/scripts/h1_reference.py --top-bounty --limit 3
python3 skills/offensive-osint/scripts/h1_reference.py --top-voted --query "XSS" --pages 3
# Install the skills for Claude to load
cp -r skills/* ~/.claude/skills/
CI (.github/workflows/lint.yml) runs four jobs: markdown lint
(markdownlint-cli2), the frontmatter check, the secret_scan.py smoke, and
shellcheck ./scripts. smoke.sh covers the latter two plus the helpers
directly. markdownlint-cli2 and shellcheck are not installed on this
container; install with npm i -g markdownlint-cli2 / apt-get install -y shellcheck if you need to reproduce those jobs locally.
sync-skill-content.sh is a no-op in a fresh clone. It copies from
docs/full-skills/, which is not in the repo — the script prints
"⚠ Source missing … Skipping" and exits 0. The skills/*/SKILL.md files are
already the full inline content (offensive-osint ≈ 4,200 lines), so you do
not need to run sync after cloning. Don't be alarmed by the warnings.secret_scan.py skips its own findings as noise filters. It excludes
.git, node_modules, __pycache__, .venv, dist, build, .cache
and any file >10 MB. Scanning skills/ returns the example/doc tokens (~11),
not real secrets.h1_reference.py hits an undocumented public GraphQL endpoint. It works
unauthenticated but is sensitive to HackerOne-side changes and rate limits;
treat a failure there as environmental, not a repo bug (hence non-fatal in
the driver). It caps at 50 results/page — use --pages N for breadth.smoke.sh PASS output, not a GUI.| Symptom | Fix |
|---|---|
ModuleNotFoundError: No module named 'yaml' in check [4] | pip install pyyaml (only the frontmatter check needs it). |
Check [6] shows ~ no network / HackerOne unreachable | Expected when egress is blocked; run with --no-net to silence. Driver still passes. |
sync --check shows "Source missing" | Expected — see Gotchas. Not a failure; exit code is 0. |