conducting-external-reconnaissance-with-osint
by mukul975conducting-external-reconnaissance-with-osint skill for passive external footprinting, attack surface mapping, and Security Audit prep using public sources like DNS, crt.sh, Shodan, GitHub, and leak data. Built for authorized reconnaissance with clear scope control, source separation, and practical findings.
This skill scores 74/100, which means it is acceptable to list but best framed as a moderately strong, domain-specific OSINT utility rather than a turnkey one-click workflow. Directory users get a clearly scoped passive reconnaissance skill with enough implementation detail to judge fit, but they should expect some setup and source-specific knowledge.
- Explicit triggerability for OSINT reconnaissance, external footprinting, and passive attack-surface mapping.
- Substantial operational content: multiple headings, workflow guidance, and an API reference covering crt.sh, DNS, Shodan, email security, and GitHub leak checks.
- Includes a runnable script and CLI example, which improves agent leverage and reduces guesswork versus a generic prompt.
- Requires external APIs and tokens for some functions (for example Shodan and GitHub), so adoption depends on user credentials and environment setup.
- The repository appears to favor breadth over end-to-end orchestration; users may still need to assemble or adapt parts of the workflow for their specific assessment.
Overview of conducting-external-reconnaissance-with-osint skill
What this skill does
The conducting-external-reconnaissance-with-osint skill helps an AI produce a passive, OSINT-based view of an organization’s external footprint. It is designed for authorized security work: attack surface mapping, pre-engagement research, and Security Audit preparation without directly probing target systems.
Who should use it
Use the conducting-external-reconnaissance-with-osint skill if you need a structured way to collect and organize public-source findings from DNS, certificate transparency, search engines, social platforms, code repositories, and leak sources. It is a strong fit for penetration testers, red teamers, and security auditors who want a reconnaissance-first workflow.
Why it is different
The main value is workflow discipline: it focuses on passive collection, source separation, and turning scattered public signals into a target profile. That makes the conducting-external-reconnaissance-with-osint guide more useful than a generic “do OSINT” prompt because it supports safer scope control and more consistent output.
Fit and limits
This is not for invasive scanning, exploitation, or surveillance. If your goal is active validation, vuln discovery, or endpoint testing, this skill will feel incomplete by design. The conducting-external-reconnaissance-with-osint for Security Audit use case is strongest when you need an external baseline before deeper assessment.
How to Use conducting-external-reconnaissance-with-osint skill
Install and first check
For conducting-external-reconnaissance-with-osint install, add the skill with:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-external-reconnaissance-with-osint
Then read skills/conducting-external-reconnaissance-with-osint/SKILL.md first, followed by references/api-reference.md and scripts/agent.py to understand the supported data sources and execution flow.
What to provide in your prompt
Strong conducting-external-reconnaissance-with-osint usage starts with a clear target, permission context, and output format. Give:
- the domain or organization name
- whether the work is for audit, red team prep, or asset inventory
- allowed sources or exclusions
- expected deliverable, such as a findings table, JSON, or executive summary
Example input: “Use conducting-external-reconnaissance-with-osint to build a passive external footprint for example.com for a Security Audit. Focus on subdomains, DNS, email security, leaked credentials, and GitHub exposure. Return concise findings with source notes and confidence.”
Suggested workflow
A practical conducting-external-reconnaissance-with-osint usage pattern is: define scope, collect passive sources, normalize findings, then summarize by risk relevance. The repository’s script and reference file show a simple research flow built around DNS, crt.sh, Shodan, email posture, web tech fingerprints, and GitHub leak checks.
What to read first in the repo
Start with SKILL.md for activation intent and constraints, then references/api-reference.md for function-level behavior, and finally scripts/agent.py if you want to mirror the collection order or adapt it into your own tooling. The conducting-external-reconnaissance-with-osint guide is easier to apply when you understand which data sources are built in and which are optional.
conducting-external-reconnaissance-with-osint skill FAQ
Is this only for cybersecurity professionals?
It is most useful for authorized practitioners, but beginners can use it if they stay inside a legitimate assessment scope. The skill is directional, not magical: better scope and better source selection produce better output.
How is it different from a generic OSINT prompt?
A generic prompt may list public sources, but conducting-external-reconnaissance-with-osint gives you a more repeatable reconnaissance workflow. That matters when you need consistent findings, source traceability, and a safer boundary between passive research and active testing.
Does it require special tooling?
Not necessarily. The skill can guide a manual or AI-assisted workflow, while the included script references point to common Python dependencies and external APIs. If you already run Shodan or DNS-based workflows, this skill should fit easily into that ecosystem.
When should I not use it?
Do not use it for stalking, harassment, or work outside authorization. It is also the wrong choice if you need live exploitation testing, authenticated app testing, or endpoint verification rather than external footprinting.
How to Improve conducting-external-reconnaissance-with-osint skill
Give narrower scope and better constraints
The biggest quality gain comes from specifying exactly what “external reconnaissance” means for your case. For example, ask for only passive sources, or ask for a prioritized attack-surface summary with subdomain confidence levels and source attribution. That makes conducting-external-reconnaissance-with-osint skill output more actionable.
Provide context the skill cannot infer
The skill works better when you state the organization name, domain variants, known subsidiaries, and any exclusions. If you already know the target uses a cloud provider, email platform, or brand alias, include it. Those details reduce false negatives and improve source matching.
Ask for decision-ready output
Instead of “summarize recon,” request a format that supports action: discovered assets, source used, why it matters, and next safe validation step. For conducting-external-reconnaissance-with-osint usage, that usually means fewer raw lists and more prioritized findings.
Iterate from findings, not from scratch
After the first pass, refine the prompt around misses: missing subdomains, noisy GitHub results, unclear email posture, or too much low-confidence data. A good conducting-external-reconnaissance-with-osint guide workflow is iterative: collect, rank, then rerun with tighter source filters or a narrower domain scope.