elementalsouls/Claude-OSINT

What it solves

claude-osint provides a comprehensive library of expert-level reconnaissance (OSINT) methodology and tactical tradecraft to transform Claude into a specialized external recon operator. It solves the problem of LLMs lacking the specific, structured procedural knowledge required for professional red-team and bug-bounty engagements, providing the strategic "how to think" and tactical "what to reach for" needed for authorized security assessments.

How it works

The project consists of a collection of structured SKILL.md files designed for the Claude skills system. These files act as system prompts that prime Claude with specialized knowledge across eight distinct skills:

• Core Recon Pair: osint-methodology (strategic planning, asset-graph discipline, and reporting) and offensive-osint (tactical tools, regexes, and payloads).
• Organization-Grade Depth Skills: Specialized modules for attack-surface mapping (legal entity to footprint), email security (spoofability and SPF analysis), risk quantification (FAIR $ loss models), continuous monitoring, cloud/SaaS exposure, and identity provider reconnaissance.

Users can drop these skills into their Claude environment (e.g., ~/.claude/skills/) or paste them into system prompts, allowing Claude to auto-trigger on relevant phrases during a security session.

Who it’s for

Security practitioners, red-teamers, and bug-bounty hunters who have written authorization to assess targets. It is designed for the reconnaissance phase of authorized engagements to ensure a professional, structured approach to asset discovery and exposure analysis.

Highlights

• Extensive Tradecraft: Over 10,000 lines of structured tradecraft, including 100+ recon capabilities, 80 secret-regex patterns, and 80+ dorks.
• Enterprise-Scale Reasoning: Capabilities for legal entity attribution, FAIR risk scoring, and identity provider mapping.
• Specialized Tooling: Includes a stdlib-only secret scanner (secret_scan.py) and a HackerOne disclosed-reports reference agent (h1_reference.py).
• Strict Boundary Enforcement: Built-in soft scope-checks and hard boundaries to exclude active exploitation or credential submission.
• High Accuracy: 100% pass rate on a 56-prompt self-evaluation suite to prevent fabrications.