CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

ctf-osint

Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./ctf-osint/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, dense quick-reference with strong executable commands and good pivot guidance, written at an appropriately terse altitude. Its critical weakness is that every one of the four referenced detail files is missing from the bundle, which undermines the entire progressive-disclosure design.

Suggestions

Ship the four referenced detail files (social-media.md, geolocation-and-media.md, web-and-dns.md, tools-mcp.md) alongside SKILL.md, or move them into a references/ directory and update the links — as written, every "See X.md" pointer resolves to a missing file.

Trim knowledge Claude already has: the hex-length → hash-type table ("40 hex chars -> SHA-1") and the duplicated resource list in "Additional Resources" (which repeats the per-section pointers) can be cut or merged into the topic files.

Add a short "how to approach an unknown OSINT challenge" ordering (e.g., metadata/EXIF first, then reverse image search, then geolocation cross-referencing) so the reference catalog has a default investigation sequence.

DimensionReasoningScore

Conciseness

Reference-style one-liners with "See X.md" pointers assume Claude's competence and include no concept tutorials; e.g. "Snowflake timestamps: `(id >> 22) + 1288834974657` = Unix ms." Minor over-explanation remains: the String Identification hex-length→hash table ("40 hex chars -> SHA-1") is knowledge Claude already has, and the "Additional Resources" bullets largely duplicate the per-section "See X.md" pointers. Anchor 4, not 5, due to these trimmable spots.

4 / 5

Actionability

Abundant copy-paste-ready commands and endpoints ("dig +short -t txt target.com", "shodan search \"hostname:target.com\"", "exiftool image.jpg", "curl \"http://ip-api.com/json/103.150.68.150\""). A few sections give only pattern descriptions with pointers (Telegram: "interact via /start"; FEC: "FEC.gov for committee receipts"), leaving minor gaps that keep it below anchor 5.

4 / 5

Workflow Clarity

As a lookup/reference skill it needs no sequential workflow: "Quick Start Commands" plus per-topic sections make locating the right technique unambiguous, and "When to Pivot" gives explicit routing to sibling skills. Not 5 because there is no overall methodology ordering for approaching an unknown OSINT challenge (e.g., metadata → reverse image → geolocation progression).

4 / 5

Progressive Disclosure

The design is good — a lean overview with clearly signaled, one-level-deep references ([social-media.md](social-media.md), [geolocation-and-media.md](geolocation-and-media.md), [web-and-dns.md](web-and-dns.md), [tools-mcp.md](tools-mcp.md)) — but none of these four referenced files exist in the skill bundle, so the disclosure chain is broken and navigation fails at the first hop. Good structure, broken references → anchor 3 rather than 4.

3 / 5

Total

15

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit "Use when..." clause and a rich list of concrete, natural trigger phrases. The main gaps are the missing "OSINT" acronym — the most common term users would say — and a slightly generic lead verb.

DimensionReasoningScore

Specificity

The lead verb "Provides open source intelligence techniques" is generic, but the description enumerates many concrete capability areas ("username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings"), matching the anchor for several specific actions with minor gaps. It falls short of anchor 5 because these are domains/topics rather than fully stated actions, and well above anchor 3's 1-2 concrete actions.

4 / 5

Completeness

Explicitly answers both: what ("Provides open source intelligence techniques for CTF challenges") and when ("Use when gathering information from public sources, social media, geolocation, DNS records...") with concrete trigger phrases. Matches anchor 5 exactly.

5 / 5

Trigger Term Quality

Good natural keyword coverage ("social media", "reverse image search", "Google dorking", "Tor relays", "hashes and coordinates"), but the most natural term users would say for this domain — "OSINT" — is absent. Fits anchor 4 (good coverage, a few natural terms missing) rather than anchor 5's comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

"for CTF challenges" scopes a clear niche with distinct triggers (Tor relays, FEC filings, Google dorking), but "gathering information from public sources" is broad and could overlap with general web-research or sibling ctf-* skills. Minor overlap risk fits anchor 4 rather than anchor 5's minimal conflict risk.

4 / 5

Total

17

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

relative_links

Relative link issues: 31 missing

Warning

Total

14

/

16

Passed

Repository

ljagiello/ctf-skills

Path

ctf-osint/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.