agentsclimarketplace
Sign in

OSINT

Skill mj-deving/pai-skills/skills/Investigation/OSINT

Structured OSINT investigations — people lookup, company intel, investment due diligence, entity/threat intel, domain recon, organization research using public sources with ethical authorization framework. USE WHEN OSINT, due diligence, background check, research person, company intel, investigate, company lookup, domain lookup, entity lookup, organization lookup, threat intel, discover OSINT sources.From its SKILL.md

Install
npx -y skills add mj-deving/pai-skills --skill OSINT

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

5.7 KB, ~1.3k tokens by cl100k_base, as published. Nobody here has run it

Customization

Before executing, check for user customizations at: ${PAI_USER_DIR}/SKILLCUSTOMIZATIONS/OSINT/

If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.

<!-- ## 🚨 MANDATORY: Voice Notification (REQUIRED BEFORE ANY ACTION) **You MUST send this notification BEFORE doing anything else when this skill is invoked.** 1. **Send voice notification**: ```bash curl -s -X POST http://localhost:8888/notify \ -H "Content-Type: application/json" \ -d '{"message": "Running the WORKFLOWNAME workflow in the OSINT skill to ACTION"}' \ > /dev/null 2>&1 & ``` -->
  1. Output text notification: 
    Running the **WorkflowName** workflow in the **OSINT** skill to ACTION...

This is not optional. Execute this curl command immediately upon skill invocation.

OSINT Skill

Open Source Intelligence gathering for authorized investigations.

Workflow Routing

Investigation TypeWorkflowContext
People lookupWorkflows/PeopleLookup.mdSOURCES.JSON
Company lookupWorkflows/CompanyLookup.mdSOURCES.JSON
Investment due diligenceWorkflows/CompanyDueDiligence.mdSOURCES.JSON
Entity/threat intelWorkflows/EntityLookup.mdSOURCES.JSON
Domain/subdomain investigationWorkflows/DomainLookup.mdSOURCES.JSON
Organization/NGO/gov researchWorkflows/OrganizationLookup.mdSOURCES.JSON
Discover new OSINT sourcesWorkflows/DiscoverOSINTSources.mdSOURCES.JSON

Trigger Patterns

People OSINT:

  • "do OSINT on [person]", "research [person]", "background check on [person]"
  • "who is [person]", "find info about [person]", "investigate this person" -> Route to Workflows/PeopleLookup.md

Company OSINT:

  • "do OSINT on [company]", "research [company]", "company intelligence"
  • "what can you find about [company]", "investigate [company]" -> Route to Workflows/CompanyLookup.md

Investment Due Diligence:

  • "due diligence on [company]", "vet [company]", "is [company] legitimate"
  • "assess [company]", "should we work with [company]" -> Route to Workflows/CompanyDueDiligence.md

Entity/Threat Intel:

  • "investigate [entity]", "threat intelligence on [entity]", "is this malicious"
  • "research this threat actor", "analyze [entity]", "check this IP" -> Route to Workflows/EntityLookup.md

Domain/Subdomain Investigation:

  • "investigate domain", "check domain", "subdomain enumeration"
  • "domain recon on [domain]", "what subdomains does [domain] have"
  • "DNS investigation", "certificate transparency for [domain]" -> Route to Workflows/DomainLookup.md

Organization/NGO/Government:

  • "research organization", "investigate NGO", "research agency"
  • "who is [organization]", "investigate [nonprofit]", "research [government agency]"
  • "what do we know about [association]", "background on [institution]" -> Route to Workflows/OrganizationLookup.md

Authorization (REQUIRED)

Before ANY investigation, verify:

  • Explicit authorization from client
  • Clear scope definition
  • Legal compliance confirmed
  • Documentation in place

STOP if any checkbox is unchecked. See EthicalFramework.md for details.

Resource Index

FilePurpose
SOURCES.JSONMaster catalog of 279 OSINT sources across 8 categories
SOURCES.mdHuman-readable source reference with descriptions and access info
EthicalFramework.mdAuthorization, legal, ethical boundaries
Methodology.mdCollection methods, verification, reporting
PeopleTools.mdPeople search, social media, public records (legacy — use SOURCES.JSON)
CompanyTools.mdBusiness databases, DNS, tech profiling (legacy — use SOURCES.JSON)
EntityTools.mdThreat intel, scanning, malware analysis (legacy — use SOURCES.JSON)

Integration

Automatic skill invocations:

  • Research Skill - Parallel researcher agent deployment (REQUIRED)
  • Recon Skill - Technical infrastructure reconnaissance

Agent fleet patterns:

  • Quick lookup: 4-6 agents
  • Standard investigation: 8-16 agents
  • Comprehensive due diligence: 24-32 agents

Researcher types:

ResearcherBest For
PerplexityResearcherCurrent web data, social media, company updates
ClaudeResearcherAcademic depth, professional backgrounds
GeminiResearcherMulti-perspective, cross-domain connections
GrokResearcherContrarian analysis, fact-checking

File Organization

Active investigations:

${AGENT_MEMORY_DIR}/WORK/$(jq -r '.work_dir' ${AGENT_MEMORY_DIR}/STATE/current-work.json)/YYYY-MM-DD-HHMMSS_osint-[target]/

Archived reports:

${AGENT_HISTORY_DIR}/research/YYYY-MM/[target]-osint/

Ethical Guardrails

ALLOWED: Public sources only - websites, social media, public records, search engines, archived content

PROHIBITED: Private data, unauthorized access, social engineering, purchasing breached data, ToS violations

See EthicalFramework.md for complete requirements.

Version: 3.0 (SOURCES.JSON Integration) Last Updated: February 2026

What ships with it: 14 files

218.6 KB alongside SKILL.md, 9 of them executable

Workflows/

Keep looking

Skills are one crate of 326,679. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.