28 skills that let Cursor, Claude, and other coding agents actually run an open-source-intelligence investigation — pivot from an email to a breach to a reused handle to a real name, geolocate a photo from the pixels, map a company's subsidiaries — and write it up with sources instead of vibes.

Two kinds:

• 10 you run by name — end-to-end workflows for a person, company, domain, username, email, phone, photo, or social account.
• 18 the agent reaches for on its own — the individual techniques those workflows lean on (reverse image search, WHOIS, certificate transparency, breach lookups, chronolocation, and so on).

You point it at a target. It picks the workflow, chains the techniques, and hands back a report where every claim has a source and a confidence level.

These aren't cheat sheets. Every skill carries the tradecraft that separates a lead from a finding — where each source lies to you, which results are artefacts of how the tool works, and what it takes to call something confirmed. Each one ships with reference/ material too: the query cookbooks, per-country indicator guides, registry catalogues, and format tables you'd otherwise keep in a browser tab.

What a run looks like

> recon-a-domain-passively example.com

scope        passive only, no scanning
whois        NameCheap, created 2019-03-11, registrant behind privacy guard
dns          MX → Google Workspace · SPF lists sendgrid + mailgun
crt.sh       14 subdomains, incl. staging.example.com and vpn.example.com
shodan       vpn:443 Fortinet · staging exposes :8080 Jenkins (no auth)
wayback      2021 team page named 6 staff, since deleted

pivoted 3 staff → LinkedIn, flagged the open Jenkins, wrote report.md

Illustrative — a real run depends on the target and which tools you have keys for. The skills are the technique and the tooling; some tools (Shodan, HIBP, DeHashed) want their own API key, and free alternatives are called out inline.

Install

git clone https://github.com/useosint/osint-skills.git
cd osint-skills
./install.sh

install.sh symlinks all 28 skills into ~/.cursor/skills, so git pull keeps them current. Restart your agent afterward.

For a single project instead of your whole machine, drop the skills/ folder into that repo's .cursor/skills/.

Where to start

Pick the workflow that matches whatever you're holding. If you don't know, investigate-anything routes you.

flowchart TD
    Q{What do you<br/>already have?}
    Q -->|a real name| P[find-anyone]
    Q -->|a company / brand| C[x-ray-a-company]
    Q -->|a domain or IP| D[recon-a-domain-passively]
    Q -->|a username| U[hunt-a-handle]
    Q -->|an email| E[what-an-email-reveals]
    Q -->|a phone number| PH[whose-number-is-this]
    Q -->|a photo / video| G[where-was-this-taken]
    Q -->|a social profile| S[pattern-of-life-from-socials]
    Q -->|no idea| R([investigate-anything])
    R -.picks one.-> Q
    P --> RPT[[write-the-intel-brief]]
    C --> RPT
    D --> RPT
    U --> RPT
    E --> RPT
    PH --> RPT
    G --> RPT
    S --> RPT

Workflows — you type these

Techniques — the agent pulls these in as needed

How a case actually moves

It's a chain of pivots. One thing you know turns into the next, until the picture holds together under more than one source. Start with an email and it can unfold like this:

flowchart LR
    E[email] --> B[what-leaked-about-you]
    E --> V[validate + Gravatar]
    B --> U[reused username]
    B --> N[name / fields leaked]
    U --> A[accounts across platforms]
    V --> N
    A --> PH[posted photos]
    A --> GH[code repos]
    PH --> GEO[home / work location]
    N --> PR{{corroborated identity}}
    GEO --> PR
    GH --> PR
    PR --> RPT[[write-the-intel-brief]]

Every hop is one of the technique skills; nothing gets called a fact off a single weak match. And a workflow isn't one lookup — recon-a-domain-passively, for example, fans out across several techniques at once:

flowchart TD
    D([recon-a-domain-passively]) --> W[who-owns-this-domain]
    D --> CT[find-hidden-subdomains]
    D --> WB[read-deleted-pages]
    D --> GH[secrets-in-git-history]
    CT --> SUB[subdomains]
    SUB --> SH[find-exposed-servers]
    W --> OWN[registrant] -.pivot.-> CO([x-ray-a-company])
    D --> RPT[[write-the-intel-brief]]
    SH --> RPT
    WB --> RPT
    GH --> RPT

Rules

OSINT is collecting information that is already public, for a legitimate reason. That's legal most places. Logging into someone's accounts, using leaked passwords, scanning boxes you don't own, stalking, doxxing — that isn't, and it's not what any of this is for.

Every workflow makes you state scope and authorization before it does anything, and stays passive by default. The details are in ETHICS.md. If your goal is to hurt a specific person, these skills aren't for you.

Contributing

One folder, one SKILL.md, passive-first, every technique backed by a real tool and source. CONTRIBUTING.md has the rest.

License

MIT. No warranty. What you do with it is on you.