Guide · Agent skill
How to use the Open-Source Intelligence Collection agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the collecting-open-source-intelligence agent skill, which lets an AI agent run a structured open-source intelligence (OSINT) workflow on a domain, IP or threat actor's infrastructure. It is written for security analysts, red teams and incident responders, and assumes you may never have used an agent skill before. By the end you will know how to install the skill, phrase a request so it activates, what API keys and tools you need, and which safety limits to respect.
Open-Source Intelligence Collectionmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this directory page.
- 2Install the skill. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 3Prepare your keys and tools. Install Python 3 with the requests and shodan libraries, and obtain a Shodan API key and, for the passive DNS example, a SecurityTrails API key.
- 4Define the requirement. Ask the agent to set the target and the questions you need answered before any collection starts.
- 5Collect passively. Run passive lookups such as WHOIS, certificate transparency and Shodan searches, using scripts/agent.py where it fits your scope.
- 6Pivot and verify. Use Maltego or SpiderFoot if available to expand from domains, IPs and registrant emails, and verify each link before treating it as confirmed.
- 7Check timestamps and write up. Confirm the age of every record and document findings with their sources and TLP classification.
What an agent skill is and what this one does
An agent skill is a folder of instructions (a SKILL.md file, plus optional reference files and scripts) that an AI agent loads when a request matches the skill's description. This skill is licensed under Apache-2.0 and is aimed at cybersecurity work in the threat-intelligence subdomain.
Once active, the agent follows a set workflow: it first defines what questions need answering (the priority intelligence requirements), then gathers public data such as domain records, WHOIS data, certificate transparency logs and Shodan search results. The goal is to map the infrastructure of a threat actor or suspicious domain. The skill also explains how to pivot from one data point to related domains, IPs and registrant emails in Maltego and SpiderFoot, and warns about false connections and overconfident attribution.
- Defines intelligence requirements and the target before collecting
- Covers passive DNS, WHOIS and certificate transparency lookups
- Describes Shodan infrastructure mapping and Maltego graph pivots
- Flags common pitfalls such as confirmation bias and outdated data
How to install the skill
You can install the skill in one of two ways. The first is to download the ZIP file from this directory page and unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want it available only for that project. The skill folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.
The second way is to upload the ZIP in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the file there.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
How to trigger the skill with natural requests
You do not need a special command. The skill activates when your request involves external threat actor infrastructure, pre-engagement reconnaissance for an authorized red team assessment, enriching a threat intelligence report, or tools named in its description such as Maltego, Shodan, OSINT framework, SpiderFoot or infrastructure reconnaissance.
Be specific about the target and the question. A request that names a domain and a goal gives the agent what it needs to set up the collection requirements in its first step.
- Investigate the infrastructure behind this phishing domain that targeted our staff: evil-domain.com
- Find other domains that share hosting with this suspicious IP and explain how you would pivot in Maltego
- Enrich this threat actor profile with public certificate and WHOIS data for our CTI report
- Map the external exposure of our organization's domain as part of an authorized attack surface review
Run the bundled script
The skill includes scripts/agent.py, which can run Shodan searches and host lookups and query crt.sh, returning results as structured data. The reference file documents its command-line options: a target domain, a Shodan key, a GitHub token and an output file. The reference also lists GitHub code search and RDAP WHOIS among the sources the collection covers.
The script needs Python 3 with the requests and shodan libraries installed. Replace the placeholders with your own keys.
- --domain sets the target domain
- --shodan-key sets your Shodan API key
- --github-token sets your GitHub token
- --output writes the results to a file (report.json in the example)
python agent.py --domain example.com --shodan-key <key> --github-token <token> --output report.jsonWhat you need before you start
The skill itself is a set of instructions and scripts; the useful results depend on accounts and tools you supply. A Shodan API key is needed for internet-wide device and service discovery. A SecurityTrails API key is needed for the passive DNS example. Certificate transparency lookups through crt.sh do not require an API key.
Maltego (Community Edition or a commercial licence) and SpiderFoot are optional. Maltego is used for graph-based link analysis, and SpiderFoot for automated correlation. The agent also needs internet access to crt.sh, WHOIS servers and the APIs above.
- Python 3 with the requests and shodan libraries
- Shodan API key
- SecurityTrails API key (for the passive DNS example)
- Maltego CE or commercial licence and SpiderFoot (optional)
- Internet access to crt.sh, WHOIS servers and the APIs listed
Safety: scripts, network access and passive collection
This skill runs scripts and uses the network. Read scripts/agent.py before you run it, and only run it with keys you control. The skill is for authorized assessments only. Its own rule is that OSINT must stay passive, meaning no packets are sent to target systems, unless the scope of your engagement allows active reconnaissance.
Some tools in the workflow perform active scans such as port scanning or banner grabbing. The skill advises confirming a tool's behaviour before you use it against an external target. Visiting a threat actor's site or querying their IP in Shodan can alert the adversary, so the skill suggests Tor or a VPN with a dedicated OSINT virtual machine.
- Do not probe or port-scan systems without written authorization
- Confirm whether each tool performs active scans before use
- Use a dedicated OSINT environment to avoid leaving footprints
- Protect your API keys and do not hard-code them in shared files
Tips for better results
Write down the intelligence requirement before you collect anything. A clear question keeps the agent from gathering data that does not help. Check the timestamp on every record, because WHOIS privacy services and hosting providers change often and six-month-old passive DNS may no longer be valid.
Verify each pivot on its own before you treat it as confirmed. Shared infrastructure does not prove that two groups are the same, since false flag operations can deliberately share indicators.
- Start from one known malicious domain or IP and expand step by step
- Pivot on registrant email to find other domains with the same registrant
- Use certificate transparency to surface staging, VPN or internal hostnames that were made public
- Record the TLP classification of collected intelligence
What people use it for
- Enriching a cyber threat intelligence report with public context on an adversary's domains and hosting
- Pre-engagement reconnaissance for a red team, limited to the scope agreed in writing
- Investigating external infrastructure linked to a phishing campaign against your organization
- Mapping co-hosted domains and registrant emails around a suspicious IP or domain
Frequently asked questions
How do I install the collecting-open-source-intelligence skill?
Download the ZIP from this directory page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need to run this OSINT skill?
You need Python 3 with the requests and shodan libraries and a Shodan API key. A SecurityTrails API key is needed for the passive DNS example, and Maltego and SpiderFoot are optional for graph analysis and automation.
Is the Open-Source Intelligence Collection skill free?
The skill is licensed under Apache-2.0. The services it uses, such as Shodan, SecurityTrails and Maltego, require their own API keys or licences, which are separate from the skill and are not covered by this page.
Can this skill scan my targets or find open ports?
The skill is designed for passive collection and warns against active scanning without written authorization. Some third-party tools in the workflow do perform active scans, so check each tool's behaviour before using it on external targets.
Does the skill work without a Shodan key?
The bundled script runs Shodan searches and host lookups, so those features need a Shodan API key. Certificate transparency lookups through crt.sh do not require an API key, according to the skill.
How does this compare with general OSINT or web research tools?
This skill is specialised for threat intelligence and infrastructure mapping, using tools such as Maltego, Shodan and SpiderFoot. For general web research that does not involve threat actors or infrastructure, it is not the right fit.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose this skill if you are a security analyst, red teamer or incident responder who already has Shodan and, ideally, Maltego or SpiderFoot, and needs a structured passive workflow for threat infrastructure. Skip it if you want general web research, or if you lack the API keys and written authorization needed for the work.
Download the skill