Metadata

name: osint-investigator
description: Investigate public online footprints using open-source intelligence techniques. Use when a user wants to research a username, email, person, company, domain, IP, phone number, location, image, or other public target using publicly available information; correlate findings; validate profile candidates; enrich results with web search; capture public profile links and profile images; run optional defensive HIBP email checks when configured; or export structured JSON and reports.

OSINT Investigator

Use this skill for broad public-footprint OSINT.

Supported target types include:

username / handle
email address
person / alias
organisation / company
domain / website
IP address
phone number
location / address
image

Read as needed:

references/target-types.md for classification
references/workflow.md for investigation flow
references/modules.md for module selection
references/osint-sources.md for source categories
references/platforms.md for target platforms and search ideas
references/platform-validation.md for platform-specific validation rules
references/profile-media.md for profile image handling
references/scoring.md for confidence logic
references/aggregation.md for overall scoring and result merging
references/variants.md for handle-variant generation
references/tooling.md for lightweight discovery helpers
references/breach-checks.md for optional defensive breach lookup behavior
references/apis.md for optional API enrichment
references/configuration.md for HIBP API key setup
references/report-format.md for structured reporting
references/safety.md for acceptable-use boundaries
references/output.md for response structure

Use scripts when helpful:

scripts/generate_variants.py for plausible username variants
scripts/check_profiles.py for first-pass platform checks with platform-aware validation
scripts/check_hibp.py for optional Have I Been Pwned email checks
scripts/check_domain.py for lightweight domain enrichment
scripts/check_ip.py for lightweight IP enrichment
scripts/aggregate_results.py to merge findings into a scored summary
scripts/export_json.py for structured JSON output
scripts/build_report.py for compact report generation from structured results

Use web_search and web_fetch to confirm weak findings, enrich strong ones, and gather public evidence when helper-script results alone are ambiguous.

Core behavior

Focus on public data only.
Prefer lightweight verification over aggressive scraping.
A 200 HTTP status is not enough to confirm a profile.
Separate facts from guesses.
Report confidence, not certainty.
Keep results structured and easy to audit.
Prefer a smaller set of verified findings over a noisy wall of guesses.
Run only the modules relevant to the target.

Workflow

Classify the target using references/target-types.md.
Normalize the input.
Select relevant modules using references/modules.md.
Run lightweight helper scripts where useful.
Use targeted web search to confirm or enrich weak and likely matches.
Capture final links and public profile image URLs when available.
If an email is provided and HIBP is configured, run a defensive breach check.
For domains or IPs, run the relevant lightweight helper.
Record exact matches, likely matches, weak matches, no-results, and not-verifiable results.
Compare public signals across findings.
Aggregate the findings into a scored summary using scripts/aggregate_results.py and references/aggregation.md.
Return a concise human summary or a structured report depending on the request.
Export JSON if requested.

Output rules

Always distinguish between:

confirmed public match
likely match
weak/uncertain match
not verifiable
no evidence found

Include final links for meaningful findings. Include profile image links only when they are publicly exposed and easy to extract. If HIBP is used, report breach results as defensive exposure information, not identity proof. If using domain/IP helpers, treat them as enrichment, not full attribution.

Do not overclaim identity resolution. If evidence is thin, say so clearly. If evidence conflicts, say so clearly. Lead with the strongest public evidence first. Prefer the compact format by default; use an extended report only when the user asks for depth.

Safety

Read references/safety.md when the request could drift into harassment, private-person targeting, or invasive tracking.

Do not help with:

credential theft
account takeover
bypassing access controls
doxxing
stalking or targeted harassment
collecting non-public personal data
invasive private-person targeting

Style

concise
factual
audit-friendly
explicit about uncertainty

Investigator