A 4,600-line brain transplant for offensive recon in Claude

What it does

claude-osint is a pair of markdown skill files for Anthropic’s Claude skills system. One file, osint-methodology, instills strategic discipline: asset-graph mapping, time budgeting, severity rubrics, and report templates. The other, offensive-osint, loads the tactical reference—probe paths, secret regexes, cloud exposure checks, and sector-specific fingerprints. Together they prime the model to behave like a senior recon analyst during authorized engagements, staying in scope and citing proper escalation paths.

The interesting bit

The project treats the LLM as a reasoning partner rather than a script runner. The heavy lifting is curation, not code: roughly 4,600 lines of structured tradecraft across two markdown files, plus a pair of small stdlib Python helpers (secret_scan.py and h1_reference.py). It auto-triggers when relevant recon phrases appear, so Claude shifts into recon mode without explicit prompting.

Key highlights

• Covers 12 domains, from subdomain enumeration and identity-fabric mapping to ICS/SCADA and supply-chain leaks.
• Includes 48 secret-regex patterns, 80+ dorks, 9 read-only credential validators, and 27 attack-path templates.
• Ships with a stdlib-only secret scanner and a HackerOne disclosed-reports reference agent that needs no API key.
• Provides 4 end-to-end engagement walk-throughs and a 32-prompt self-evaluation test suite.
• Claims ~85–90% practitioner coverage for the recon phase of authorized engagements.

Caveats

• The 96.9% “PASS” rate and coverage claims come from the project’s own 32-prompt smoke test, not independent validation.
• It is fundamentally curated documentation for Claude’s proprietary skills system; the two Python scripts are helpers, not a standalone recon engine.

Verdict

Worth a look if you run bug-bounty or red-team recon through Claude and want the model to stop hallucinating tool flags. Skip it if you need a standalone CLI recon framework or do not use Claude’s skill system.