Skip to content
Get packs

Open-Source Intelligence Collection

Guides the agent through passive OSINT on threat actor infrastructure using Shodan, crt.sh, WHOIS, Maltego and SpiderFoot.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent follows a structured open-source intelligence workflow: defining what questions need answering, then gathering public data such as domain records, WHOIS history, certificate transparency logs, and internet device search results from Shodan to map a threat actor's or suspicious domain's infrastructure. It also explains how to pivot through related domains, IPs and registrant emails in tools like Maltego and SpiderFoot, and warns about false connections and attribution overconfidence. A bundled Python script can run Shodan searches and host lookups and query crt.sh, returning results as structured data.

Great for

  • Security analysts enriching cyber threat intelligence reports with public adversary context
  • Red teams doing authorized pre-engagement reconnaissance within a defined scope
  • Incident responders investigating external infrastructure tied to a phishing campaign against their organization

Skip it if

  • Probing or port-scanning systems you do not have written authorization to test, since the skill itself warns that OSINT must stay passive unless scope allows active recon
  • Non-security users looking for general web research, because the workflow is specialised to threat intelligence and needs paid API keys and tools to be useful

Try asking

  • “Map the infrastructure around this suspicious domain: find hosting IPs, co-hosted domains and registrant emails I can pivot on”
  • “Use certificate transparency logs to list subdomains of our company domain that may have been exposed by accident”
  • “Summarise what public Shodan data shows about this threat actor's ASN and suggest a Maltego pivot plan”
Step-by-step guide: how to use Open-Source Intelligence CollectionInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    collecting-open-source-intelligence.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip collecting-open-source-intelligence.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip collecting-open-source-intelligence.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Write a clear intelligence requirement and scope before starting so collection stays focused and legally defensible
  • Treat Shodan and Maltego results as leads to verify independently, and record data timestamps since passive DNS goes stale
  • Review scripts/agent.py and keep API keys in environment variables rather than pasting them into prompts

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.