OSINT Skills - Setup Guide¶
Source: skills.sh (285.8K combined installs) GitHub: useosint/osint-skills Category: Open-Source Intelligence First Seen: August 13, 2026 sweep Quality Tier: 🟢 Production (verification) / 🟡 Beta (advanced techniques)
The largest OSINT skill cluster on skills.sh - 57 skills covering the full investigation lifecycle. Flagships center on media verification (is this photo real, find the original image) and safe investigation practice (investigate without getting made, what leaked about you). The long tail adds domain recon, people search, breach analysis, geolocation, and intel-brief writing. Directly useful for brand protection, competitor research, and due diligence.
Installation¶
npx skills add useosint/osint-skills
Core Skills¶
| Skill | Installs | Use For |
|---|---|---|
| is-this-photo-real | 58.0K | Detecting AI-generated or manipulated images |
| investigate-without-getting-made | 58.0K | OPSEC-safe investigation methodology |
| what-leaked-about-you | 57.6K | Personal data-exposure audits |
| find-the-original-image | 56.3K | Reverse image provenance tracing |
| x-ray-a-company | 1.8K | Corporate structure and exposure mapping |
| read-deleted-pages | 1.8K | Wayback/archive recovery of removed content |
| find-exposed-servers / find-hidden-subdomains / recon-a-domain-passively / who-owns-this-domain | 1.6-1.8K | Domain and infrastructure reconnaissance |
| secrets-in-git-history / secrets-in-file-metadata | 1.6-1.7K | Credential and metadata leak hunting |
| dig-through-data-brokers / find-anyone / whose-number-is-this | 1.6-1.7K | People and data-broker research |
| follow-the-crypto | 1.6K | Blockchain transaction tracing |
| geolocate-from-pixels / where-was-this-taken / track-planes-and-ships | 1.6K | GEOINT: photos, flights, vessels |
| hunt-a-handle / pattern-of-life-from-socials / what-an-email-reveals | 1.6K | Identity and social-graph analysis |
| write-the-intel-brief / investigate-anything / google-like-a-spy | 1.5-1.6K | Synthesis and search technique |
| (31 more) | ~600 each | Breach data, registries, wayback, Shodan, dorking, link analysis |
Prerequisites¶
- No API keys for most skills; some advanced workflows benefit from Shodan/VPN access
- Operate within legal boundaries - these are investigative patterns, not intrusion tools
CorpusIQ Use Cases¶
- Competitor intelligence -
x-ray-a-company+recon-a-domain-passivelyfeed the competitive-intelligence brief workflow - Brand protection -
find-leaks-in-the-wild,find-exposed-servers, andsecrets-in-git-historyas periodic risk scans for corpusiq.io - Lead verification -
who-really-owns-itandwhose-number-is-thisvalidate inbound leads before outreach spend - Content verification -
is-this-photo-realas a gate for UGC-sourced claims in daily reports
Integration with CorpusIQ¶
CorpusIQ is the connector layer that lets AI assistants read the systems a business already runs on - accounting, payments, CRM, email, files and analytics - and answer with the source named. It is read-only by design: it retrieves data and never writes to, or acts in, a connected system, which is what makes it safe to point at live accounts.
This page is part of the CorpusIQ directory, the reference we maintain for the MCP server and agent-skill ecosystem. Run alongside CorpusIQ, a third-party server like this one can be combined with a company's own business data in a single answer.
Limitations / Verification¶
- Flagship verification skills are procedural (technique-based), not automated detectors - they guide an agent through manual checks
- Verify by running
is-this-photo-realworkflow on a known AI image and confirming the workflow flags it