CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

offensive-osint

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./Skills/recon/offensive-osint/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-categorized, comprehensive OSINT tool catalog with a reasonable investigative workflow, but it is a monolithic inline directory with minimal executable commands, no progressive file split, and no explicit validation checkpoints in the workflow.

Suggestions

Move per-category tool catalogs into one-level-deep reference files (e.g. references/infra-osint.md, references/crypto-osint.md) and keep SKILL.md as a concise overview with signaled links, improving both progressive disclosure and conciseness.

Add explicit validation/verification checkpoints to the workflow (e.g. 'corroborate a finding with a second source before logging it as confirmed') and a feedback loop for pivoting, rather than only an implicit 'suggest next steps' step.

Replace time-sensitive model/version labels in the AI-Assisted section with capability descriptions, and prune redundant overlapping tools within each category to tighten token usage.

DimensionReasoningScore

Conciseness

Per-line entries are lean (tool + one-line note), but the ~400-line inline catalog has overlapping redundancy per category and includes time-sensitive version labels ('Gemini 1.5 Pro', 'GPT-4 Vision') and mild over-explanation ('Claude ... 200K token context') that could be trimmed.

3 / 5

Actionability

Provides a per-task tool directory with URLs and a numbered workflow, plus a few inline commands ('https://t.me/s/<channel>', 'Favicon hash (mmh3)'), but most guidance points to external tools rather than copy-paste-ready commands or code.

3 / 5

Workflow Clarity

A clear 6-step investigative sequence exists (scope → select categories → work top-down → archive → log JSONL → suggest next steps) with implicit checkpoints (archive each artifact, log with run_id), but explicit validation/verification checkpoints are absent in the main workflow.

3 / 5

Progressive Disclosure

Well-organized section headers provide navigation, but no bundle/reference files exist and the entire ~400-line catalog is inlined in SKILL.md — content that clearly belongs in separate category reference files is not split out.

3 / 5

Total

12

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description: third-person voice, explicit 'Use when...' triggers, and a comprehensive enumeration of capability areas. Minor gaps are missing synonyms and slight overlap risk with general security skills.

DimensionReasoningScore

Specificity

Enumerates many concrete capability areas ('domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows') — comprehensive and specific rather than vague.

5 / 5

Completeness

Clearly answers both what ('Comprehensive OSINT methodology skill... Covers...') and when via an explicit 'Use when...' clause with multiple concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural triggers ('performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map'), but a few common practitioner terms (e.g. 'dox', 'people lookup', 'breach check') are absent.

4 / 5

Distinctiveness Conflict Risk

The offensive-security/red-team/bug-bounty OSINT niche is clearly distinct, with minor overlap risk against a broader security-recon or general research skill.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

SnailSploit/Claude-Red

Path

Skills/recon/offensive-osint/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.