Overcast connect the dots

Skill kdr/overcast/skills/overcast-connect-the-dots

Video OSINT agent: senses + OSINT reach for any agent.

Install

npx -y skills add kdr/overcast --skill overcast-connect-the-dots

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

String the board — build the case knowledge graph, read its hubs (shared media, targets, device fingerprints, places, typed entities), focus the neighborhood around a node, optionally run the opt-in LLM entity pass, and promote real connections into evidence via findings.

SKILL.md

4.0 KB, as published. Nobody here has run it

overcast-connect-the-dots

Use this skill to "connect the dots": render the whole case as one relational graph and find the links that tie records, people, devices, places, and entities together. This is the relational/entity board; the visual crop corkboard is overcast-crime-board (faces + object crops with red string). Use the broad overcast skill and overcast/reference/verbs.md for exact flags.

Workflow

Build the graph and read the hubs. graph emits ONE self-contained interactive HTML force-graph — records, shared-media hubs, targets, accepted/open findings, cluster people, device fingerprints, places, and regex-harvested typed entities (email / phone / @handle / url / domain / hashtag + exif serial + scan identity lifts) — with every edge carrying its provenance record id:

overcast doctor --json
overcast case init --json
overcast graph --no-open --json           # build; inspect the payload's nodes/edges/hubs
overcast graph --json                     # (also opens the viewer) hand-rolled canvas, no CDN/egress

Focus a node's 2-hop neighborhood — a target, a finding, a record id, a media ref, or an entity's text. The anchor is never trimmed; --limit drops lowest-degree leaf entities first, --since is capture-time-aware (an in-window finding pulls its out-of-window source record back in):

overcast graph --focus <target-id> --json          # everything around a line of investigation
overcast graph --focus "+15551234567" --json       # everything touching an entity value
overcast graph --since 7d --limit 250 --json        # recent, trimmed

(Optional) Run the opt-in LLM entity/relation pass. --extract sends evidence TEXT to your brain LLM (BYO, text-only), caches to .overcast/graph/extract.jsonl (delete the file to re-extract), and marks every result leads-not-proof (payload.caveat). It co-filters with --since:

overcast graph --extract --json                     # adds LLM-inferred entities/relations (cached)
overcast graph --extract --since 7d --focus <target-id> --json

Promote real connections into evidence. Graph edges and --extract output are NOT evidence on their own — a link you confirm becomes a finding stamped onto a line of investigation, which is what enters ask/brief:

overcast finding create "@handle in scan REC and phone in property REC resolve to the same person" --ref <record-id> --target <target-id> --confidence medium --json
overcast finding list --state triage --json         # if a match verb auto-suggested the link
overcast finding accept <id> --target <target-id> --json
overcast note "graph: <n> shared-media hubs; strongest cross-link = <a> to <b> via <record-id>" --tag tldr --json
overcast brief --export ./connect-the-dots.html --json

Output

The graph HTML plus a written read of its structure: the shared-media hubs, the target-to-evidence threads, device-fingerprint memberships, and the typed entities that recur across records — each asserted connection cited to the edge's provenance record.id, and each CONFIRMED connection promoted to a finding.

Caveats

graph is operational — it (and --extract output) stays OUT of ask/brief evidence; only findings you accept carry a link into the narrative. --extract is a brain-LLM inference (BYO): treat its entities/relations as leads to verify against the underlying records, never proof — every extracted item carries payload.caveat. Regex-harvested entities over-match (a string that looks like a handle may not be one); confirm before drawing the string. --limit trims leaves to keep the canvas legible, so a very large case may hide low-degree entities — raise it or --focus.