- name
- osint-investigator
- description
- Investigate public online footprints using open-source intelligence techniques. Use when a user wants to research a username, email, person, company, domain, IP, phone number, location, image, or other public target using publicly available information; correlate findings; validate profile candidates; enrich results with web search; capture public profile links and profile images; run optional defensive HIBP email checks when configured; or export structured JSON and reports.
OSINT Investigator
Use this skill for broad public-footprint OSINT.
Supported target types include:
- username / handle
- email address
- person / alias
- organisation / company
- domain / website
- IP address
- phone number
- location / address
- image
Read as needed:
references/target-types.mdfor classificationreferences/workflow.mdfor investigation flowreferences/modules.mdfor module selectionreferences/osint-sources.mdfor source categoriesreferences/platforms.mdfor target platforms and search ideasreferences/platform-validation.mdfor platform-specific validation rulesreferences/profile-media.mdfor profile image handlingreferences/scoring.mdfor confidence logicreferences/aggregation.mdfor overall scoring and result mergingreferences/variants.mdfor handle-variant generationreferences/tooling.mdfor lightweight discovery helpersreferences/breach-checks.mdfor optional defensive breach lookup behaviorreferences/apis.mdfor optional API enrichmentreferences/configuration.mdfor HIBP API key setupreferences/report-format.mdfor structured reportingreferences/safety.mdfor acceptable-use boundariesreferences/output.mdfor response structure
Use scripts when helpful:
scripts/generate_variants.pyfor plausible username variantsscripts/check_profiles.pyfor first-pass platform checks with platform-aware validationscripts/check_hibp.pyfor optional Have I Been Pwned email checksscripts/check_domain.pyfor lightweight domain enrichmentscripts/check_ip.pyfor lightweight IP enrichmentscripts/aggregate_results.pyto merge findings into a scored summaryscripts/export_json.pyfor structured JSON outputscripts/build_report.pyfor compact report generation from structured results
Use web_search and web_fetch to confirm weak findings, enrich strong ones, and gather public evidence when helper-script results alone are ambiguous.
Core behavior
- Focus on public data only.
- Prefer lightweight verification over aggressive scraping.
- A 200 HTTP status is not enough to confirm a profile.
- Separate facts from guesses.
- Report confidence, not certainty.
- Keep results structured and easy to audit.
- Prefer a smaller set of verified findings over a noisy wall of guesses.
- Run only the modules relevant to the target.
Workflow
- Classify the target using
references/target-types.md. - Normalize the input.
- Select relevant modules using
references/modules.md. - Run lightweight helper scripts where useful.
- Use targeted web search to confirm or enrich weak and likely matches.
- Capture final links and public profile image URLs when available.
- If an email is provided and HIBP is configured, run a defensive breach check.
- For domains or IPs, run the relevant lightweight helper.
- Record exact matches, likely matches, weak matches, no-results, and not-verifiable results.
- Compare public signals across findings.
- Aggregate the findings into a scored summary using
scripts/aggregate_results.pyandreferences/aggregation.md. - Return a concise human summary or a structured report depending on the request.
- Export JSON if requested.
Output rules
Always distinguish between:
- confirmed public match
- likely match
- weak/uncertain match
- not verifiable
- no evidence found
Include final links for meaningful findings. Include profile image links only when they are publicly exposed and easy to extract. If HIBP is used, report breach results as defensive exposure information, not identity proof. If using domain/IP helpers, treat them as enrichment, not full attribution.
Do not overclaim identity resolution. If evidence is thin, say so clearly. If evidence conflicts, say so clearly. Lead with the strongest public evidence first. Prefer the compact format by default; use an extended report only when the user asks for depth.
Safety
Read references/safety.md when the request could drift into harassment, private-person targeting, or invasive tracking.
Do not help with:
- credential theft
- account takeover
- bypassing access controls
- doxxing
- stalking or targeted harassment
- collecting non-public personal data
- invasive private-person targeting
Style
- concise
- factual
- audit-friendly
- explicit about uncertainty