[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVMP0X0SCK8W4HCNH0EQ76":3,"skill-same:01M6EVMP0X0SCK8W4HCNH0EQ76":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":86,"commitSha":87,"skillDirectory":88,"forksCount":14,"repositoryHtmlUrl":89,"repositoryHomepageUrl":90,"ownerHtmlUrl":91,"ownerBlogUrl":6,"ownerDescription":92,"updatedAt":93,"install":94,"resources":107},"01M6EVMP0X0SCK8W4HCNH0EQ76","performing-ai-driven-osint-correlation",null,"Use AI and LLM-based reasoning to correlate findings across multiple OSINT sources—username enumeration, email lookups, social media profiles, domain records, breach databases, and dark-web mentions—into unified intelligence profiles with confidence scoring and link analysis.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ai-driven-osint-correlation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"osint","correlation","performing ai driven osint correlation","driven","url analysis","cybersecurity","sources","de","across","map","scoring","social","confidence scoring","databases","cm","aml","Media","dark-web","analysis","threat-intelligence","2026-11-10 10:12:30",false,"---\nname: performing-ai-driven-osint-correlation\ndescription: Use AI and LLM-based reasoning to correlate findings across multiple\n  OSINT sources—username enumeration, email lookups, social media profiles, domain\n  records, breach databases, and dark-web mentions—into unified intelligence profiles\n  with confidence scoring and link analysis.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- osint\n- ai-correlation\n- threat-intelligence\n- reconnaissance\n- link-analysis\n- target-profiling\n- sherlock\n- theharvester\n- spiderfoot\n- maltego\nversion: '1.0'\nauthor: juliosuas\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0051\n- AML.T0054\n- AML.T0056\nnist_ai_rmf:\n- MEASURE-2.7\n- MEASURE-2.5\n- GOVERN-6.1\n- MAP-5.1\nd3fend_techniques:\n- Identifier Analysis\n- URL Analysis\n- Identifier Reputation Analysis\n- User Behavior Analysis\n- Content Validation\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1591\n- T1592\n- T1593\n- T1589\n- T1595\n---\n\n# Performing AI-Driven OSINT Correlation\n\n## When to Use\n\n- You have collected raw OSINT data from multiple tools and sources but need to identify connections, contradictions, and patterns across them.\n- You need to build a unified intelligence profile for a target entity (person, organization, or infrastructure) from fragmented data.\n- Traditional manual correlation is too slow or error-prone for the volume of data collected.\n- You want confidence-scored assessments of identity linkage across platforms rather than simple keyword matching.\n\n## Prerequisites\n\n- Python 3.10+ with `requests`, `json`, and `csv` libraries\n- [Sherlock](https:\u002F\u002Fgithub.com\u002Fsherlock-project\u002Fsherlock) installed (`pip install sherlock-project`)\n- [theHarvester](https:\u002F\u002Fgithub.com\u002Flaramies\u002FtheHarvester) installed (`pip install theHarvester`)\n- [SpiderFoot](https:\u002F\u002Fgithub.com\u002Fsmicallef\u002Fspiderfoot) 4.0+ running on localhost:5001\n- Access to an LLM API (OpenAI, Anthropic, or local model via Ollama)\n- Optional: Maltego CE for graph visualization of correlation results\n- Optional: API keys for Shodan, VirusTotal, HaveIBeenPwned, Hunter.io\n\n## Workflow\n\n### Legal & Ethical Requirements\n\n- Obtain documented written authorization before any investigation\n- Establish lawful basis for data processing (law enforcement, corporate policy, etc.)\n- Define PII retention limits and data handling procedures\n- Comply with local privacy regulations (GDPR, CCPA, etc.)\n\n### Phase 1 — Multi-Source OSINT Collection\n\n0. **Create the working directory for all OSINT outputs:**\n\n   ```bash\n   mkdir -p \u002Ftmp\u002Fosint\n   ```\n\n1. **Enumerate usernames across platforms with Sherlock:**\n\n   ```bash\n   sherlock \"targetusername\" --output \u002Ftmp\u002Fosint\u002Fsherlock-results.txt --csv\n   ```\n\n2. **Harvest emails, subdomains, and hosts with theHarvester:**\n\n   ```bash\n   theHarvester -d targetdomain.com -b all -f \u002Ftmp\u002Fosint\u002Fharvester-results.json\n   ```\n\n3. **Run a SpiderFoot passive scan via REST API:**\n\n   ```bash\n   curl -s http:\u002F\u002Flocalhost:5001\u002Fapi\u002Fscan\u002Fstart \\\n     -d \"scanname=target-recon&scantarget=targetdomain.com&usecase=passive\" \\\n     | jq '.scanid'\n   ```\n\n4. **Export SpiderFoot results when scan completes:**\n\n   ```bash\n   SCAN_ID=\"\u003Cscanid_from_step_3>\"\n   curl -s \"http:\u002F\u002Flocalhost:5001\u002Fapi\u002Fscan\u002F${SCAN_ID}\u002Fresults?type=all\" \\\n     -o \u002Ftmp\u002Fosint\u002Fspiderfoot-results.json\n   ```\n\n5. **Query breach databases for email exposure (example with HIBP API):**\n\n   ```bash\n   curl -s -H \"hibp-api-key: ${HIBP_KEY}\" \\\n     -H \"User-Agent: OSINT-Correlation-Skill\" \\\n     \"https:\u002F\u002Fhaveibeenpwned.com\u002Fapi\u002Fv3\u002Fbreachedaccount\u002Ftarget@example.com\" \\\n     -o \u002Ftmp\u002Fosint\u002Fbreach-results.json\n   ```\n\n### Phase 2 — Data Normalization\n\n6. **Normalize all collected data into a common schema.** Create a unified JSON structure that tags each finding with its source, timestamp, and data type:\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Fnormalize.py \u003C\u003C 'EOF'\n   import json, csv, sys, os\n   from datetime import datetime\n\n   findings = []\n\n   # Normalize Sherlock CSV results\n   sherlock_path = \"\u002Ftmp\u002Fosint\u002Fsherlock-results.txt\"\n   if os.path.exists(sherlock_path):\n       with open(sherlock_path) as f:\n           for row in csv.DictReader(f):\n               findings.append({\n                   \"source\": \"sherlock\",\n                   \"type\": \"social_profile\",\n                   \"platform\": row.get(\"name\", \"\"),\n                   \"url\": row.get(\"url_user\", \"\"),\n                   \"username\": row.get(\"username\", \"\"),\n                   \"status\": row.get(\"status\", \"\"),\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n\n   # Normalize theHarvester JSON results\n   harvester_path = \"\u002Ftmp\u002Fosint\u002Fharvester-results.json\"\n   if os.path.exists(harvester_path):\n       with open(harvester_path) as f:\n           data = json.load(f)\n           for email in data.get(\"emails\", []):\n               findings.append({\n                   \"source\": \"theHarvester\",\n                   \"type\": \"email\",\n                   \"value\": email,\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n           for host in data.get(\"hosts\", []):\n               findings.append({\n                   \"source\": \"theHarvester\",\n                   \"type\": \"hostname\",\n                   \"value\": host,\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n\n   # Normalize SpiderFoot results\n   sf_path = \"\u002Ftmp\u002Fosint\u002Fspiderfoot-results.json\"\n   if os.path.exists(sf_path):\n       with open(sf_path) as f:\n           for item in json.load(f):\n               findings.append({\n                   \"source\": \"spiderfoot\",\n                   \"type\": item.get(\"type\", \"unknown\"),\n                   \"value\": item.get(\"data\", \"\"),\n                   \"module\": item.get(\"module\", \"\"),\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fnormalized-findings.json\", \"w\") as f:\n       json.dump(findings, f, indent=2)\n\n   print(f\"Normalized {len(findings)} findings from {len(set(f['source'] for f in findings))} sources\")\n   EOF\n   python3 \u002Ftmp\u002Fosint\u002Fnormalize.py\n   ```\n\n### Phase 3 — AI-Driven Correlation\n\n7. **Send normalized findings to an LLM for cross-source correlation analysis:**\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Fcorrelate.py \u003C\u003C 'PYEOF'\n   import json, os\n   from openai import OpenAI  # or anthropic, ollama, etc.\n\n   client = OpenAI(api_key=os.environ[\"OPENAI_API_KEY\"])\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fnormalized-findings.json\") as f:\n       findings = json.load(f)\n\n   correlation_prompt = f\"\"\"You are an OSINT analyst. Analyze these findings collected\n   from multiple sources and produce a correlation report.\n\n   For each identity or entity you detect:\n   1. List all linked accounts\u002Fprofiles with the evidence connecting them.\n   2. Assign a confidence score (0.0-1.0) for each linkage based on:\n      - Exact username match across platforms (high)\n      - Similar usernames with shared metadata (medium)\n      - Same email in breach data and registration (high)\n      - Co-occurring infrastructure (IP, domain) (medium)\n      - Temporal correlation of account creation dates (low-medium)\n   3. Identify contradictions or potential false positives.\n   4. Flag high-risk exposures (breached credentials, PII leaks, infrastructure overlaps).\n   5. Produce a structured JSON report.\n\n   Raw findings:\n   {json.dumps(findings[:500], indent=2)}\n   \"\"\"\n\n   response = client.chat.completions.create(\n       model=\"gpt-4o\",\n       messages=[\n           {\"role\": \"system\", \"content\": \"You are an expert OSINT analyst specializing in identity correlation and link analysis.\"},\n           {\"role\": \"user\", \"content\": correlation_prompt}\n       ],\n       temperature=0.1,\n       response_format={\"type\": \"json_object\"}\n   )\n\n   report = json.loads(response.choices[0].message.content)\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\", \"w\") as f:\n       json.dump(report, f, indent=2)\n\n   print(json.dumps(report, indent=2))\n   PYEOF\n   python3 \u002Ftmp\u002Fosint\u002Fcorrelate.py\n   ```\n\n8. **Perform entity resolution — deduplicate and merge related identities:**\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Fresolve.py \u003C\u003C 'PYEOF'\n   import json\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\") as f:\n       report = json.load(f)\n\n   # Extract entities and build a link graph\n   entities = report.get(\"entities\", [])\n   print(f\"Identified {len(entities)} distinct entities\")\n   for entity in entities:\n       name = entity.get(\"identifier\", \"unknown\")\n       confidence = entity.get(\"confidence\", 0)\n       links = entity.get(\"linked_accounts\", [])\n       risk = entity.get(\"risk_level\", \"unknown\")\n       print(f\"  [{confidence:.0%}] {name} — {len(links)} linked accounts — risk: {risk}\")\n   PYEOF\n   python3 \u002Ftmp\u002Fosint\u002Fresolve.py\n   ```\n\n### Phase 4 — Reporting and Visualization\n\n9. **Generate a final intelligence profile in Markdown:**\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Freport.py \u003C\u003C 'PYEOF'\n   import json\n   from datetime import datetime\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\") as f:\n       report = json.load(f)\n\n   md = f\"# OSINT Correlation Report\\n\\n\"\n   md += f\"**Generated:** {datetime.utcnow().isoformat()}Z\\n\\n\"\n   md += \"## Entity Profiles\\n\\n\"\n\n   for entity in report.get(\"entities\", []):\n       eid = entity.get(\"identifier\", \"Unknown\")\n       conf = entity.get(\"confidence\", 0)\n       md += f\"### {eid} (Confidence: {conf:.0%})\\n\\n\"\n       md += \"| Source | Platform | Evidence |\\n|--------|----------|----------|\\n\"\n       for link in entity.get(\"linked_accounts\", []):\n           md += f\"| {link.get('source','')} | {link.get('platform','')} | {link.get('evidence','')} |\\n\"\n       md += f\"\\n**Risk Level:** {entity.get('risk_level', 'N\u002FA')}\\n\\n\"\n       for flag in entity.get(\"flags\", []):\n           md += f\"- ⚠️ {flag}\\n\"\n       md += \"\\n\"\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fintelligence-profile.md\", \"w\") as f:\n       f.write(md)\n\n   print(\"Report written to \u002Ftmp\u002Fosint\u002Fintelligence-profile.md\")\n   PYEOF\n   python3 \u002Ftmp\u002Fosint\u002Freport.py\n   ```\n\n10. **Optional — Import correlation graph into Maltego for visualization:**\n\n    ```bash\n    # Export entities as Maltego-compatible CSV for manual import\n    cat > \u002Ftmp\u002Fosint\u002Fmaltego_export.py \u003C\u003C 'PYEOF'\n    import json, csv\n\n    with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\") as f:\n        report = json.load(f)\n\n    with open(\"\u002Ftmp\u002Fosint\u002Fmaltego-import.csv\", \"w\", newline=\"\") as f:\n        writer = csv.writer(f)\n        writer.writerow([\"Entity Type\", \"Value\", \"Linked To\", \"Link Label\", \"Confidence\"])\n        for entity in report.get(\"entities\", []):\n            for link in entity.get(\"linked_accounts\", []):\n                writer.writerow([\n                    link.get(\"type\", \"Alias\"),\n                    link.get(\"value\", \"\"),\n                    entity.get(\"identifier\", \"\"),\n                    link.get(\"evidence\", \"\"),\n                    link.get(\"confidence\", \"\")\n                ])\n\n    print(\"Maltego CSV exported to \u002Ftmp\u002Fosint\u002Fmaltego-import.csv\")\n    PYEOF\n    python3 \u002Ftmp\u002Fosint\u002Fmaltego_export.py\n    ```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Cross-Source Correlation | Matching identifiers (usernames, emails, IPs) across independent OSINT sources to establish entity linkage |\n| Confidence Scoring | Assigning probabilistic confidence (0.0–1.0) to each linkage based on evidence strength and corroboration |\n| Entity Resolution | Deduplicating and merging records that refer to the same real-world entity across fragmented datasets |\n| False Positive Detection | Using AI reasoning to identify coincidental matches versus genuine identity links |\n| Multi-Vector Intelligence | Combining findings from social media, DNS, breach data, and infrastructure into a single threat picture |\n| Link Analysis | Graph-based examination of relationships between entities, accounts, and infrastructure |\n\n## Tools & Systems\n\n| Tool | Role in Workflow |\n|------|-----------------|\n| Sherlock | Username enumeration across 400+ social platforms |\n| theHarvester | Email, subdomain, and host discovery from public sources |\n| SpiderFoot | Automated OSINT collection across 200+ modules |\n| Maltego | Graph-based visualization of entity relationships |\n| LLM API (GPT-4, Claude, Ollama) | Cross-source reasoning, pattern detection, and confidence scoring |\n| HaveIBeenPwned | Breach exposure and credential leak detection |\n\n## Common Scenarios\n\n- **Threat Actor Attribution:** Correlate a suspicious username found in a phishing campaign with social media profiles, domain registrations, and breach data to build an attribution profile.\n- **Attack Surface Mapping:** Link discovered subdomains, emails, and employee social accounts to understand an organization's full external exposure.\n- **Insider Threat Investigation:** Cross-reference an employee's known accounts with dark web marketplace activity and breach databases.\n- **Brand Impersonation Detection:** Identify accounts across platforms mimicking a target brand by correlating registration patterns, naming conventions, and temporal signals.\n\n## Output Format\n\nThe final output is a structured JSON correlation report and a Markdown intelligence profile containing:\n\n```json\n{\n  \"meta\": {\n    \"target\": \"targetdomain.com\",\n    \"sources_used\": [\"sherlock\", \"theHarvester\", \"spiderfoot\", \"hibp\"],\n    \"total_findings\": 247,\n    \"generated_at\": \"2025-01-15T14:30:00Z\"\n  },\n  \"entities\": [\n    {\n      \"identifier\": \"john.target\",\n      \"confidence\": 0.92,\n      \"linked_accounts\": [\n        {\n          \"source\": \"sherlock\",\n          \"platform\": \"GitHub\",\n          \"value\": \"john.target\",\n          \"evidence\": \"Exact username match, bio references targetdomain.com\",\n          \"confidence\": 0.95\n        }\n      ],\n      \"risk_level\": \"high\",\n      \"flags\": [\n        \"Credentials exposed in 2 breaches (2022, 2023)\",\n        \"Admin email for targetdomain.com found in public WHOIS\"\n      ]\n    }\n  ],\n  \"contradictions\": [],\n  \"recommendations\": []\n}\n```\n\n## Verification\n\n- Confirm that each linked account has been independently verified against at least two sources before assigning confidence > 0.8.\n- Cross-check AI-generated correlations manually for a random sample (10–20%) to validate accuracy.\n- Verify that no false positives from common usernames (e.g., \"admin\", \"test\") inflated entity profiles.\n- Ensure breach data timestamps are current and from reputable aggregators.\n- Validate that the final report does not include stale or retracted OSINT data.\n","# Performing AI-Driven OSINT Correlation\n\n## When to Use\n\n- You have collected raw OSINT data from multiple tools and sources but need to identify connections, contradictions, and patterns across them.\n- You need to build a unified intelligence profile for a target entity (person, organization, or infrastructure) from fragmented data.\n- Traditional manual correlation is too slow or error-prone for the volume of data collected.\n- You want confidence-scored assessments of identity linkage across platforms rather than simple keyword matching.\n\n## Prerequisites\n\n- Python 3.10+ with `requests`, `json`, and `csv` libraries\n- [Sherlock](https:\u002F\u002Fgithub.com\u002Fsherlock-project\u002Fsherlock) installed (`pip install sherlock-project`)\n- [theHarvester](https:\u002F\u002Fgithub.com\u002Flaramies\u002FtheHarvester) installed (`pip install theHarvester`)\n- [SpiderFoot](https:\u002F\u002Fgithub.com\u002Fsmicallef\u002Fspiderfoot) 4.0+ running on localhost:5001\n- Access to an LLM API (OpenAI, Anthropic, or local model via Ollama)\n- Optional: Maltego CE for graph visualization of correlation results\n- Optional: API keys for Shodan, VirusTotal, HaveIBeenPwned, Hunter.io\n\n## Workflow\n\n### Legal & Ethical Requirements\n\n- Obtain documented written authorization before any investigation\n- Establish lawful basis for data processing (law enforcement, corporate policy, etc.)\n- Define PII retention limits and data handling procedures\n- Comply with local privacy regulations (GDPR, CCPA, etc.)\n\n### Phase 1 — Multi-Source OSINT Collection\n\n0. **Create the working directory for all OSINT outputs:**\n\n   ```bash\n   mkdir -p \u002Ftmp\u002Fosint\n   ```\n\n1. **Enumerate usernames across platforms with Sherlock:**\n\n   ```bash\n   sherlock \"targetusername\" --output \u002Ftmp\u002Fosint\u002Fsherlock-results.txt --csv\n   ```\n\n2. **Harvest emails, subdomains, and hosts with theHarvester:**\n\n   ```bash\n   theHarvester -d targetdomain.com -b all -f \u002Ftmp\u002Fosint\u002Fharvester-results.json\n   ```\n\n3. **Run a SpiderFoot passive scan via REST API:**\n\n   ```bash\n   curl -s http:\u002F\u002Flocalhost:5001\u002Fapi\u002Fscan\u002Fstart \\\n     -d \"scanname=target-recon&scantarget=targetdomain.com&usecase=passive\" \\\n     | jq '.scanid'\n   ```\n\n4. **Export SpiderFoot results when scan completes:**\n\n   ```bash\n   SCAN_ID=\"\u003Cscanid_from_step_3>\"\n   curl -s \"http:\u002F\u002Flocalhost:5001\u002Fapi\u002Fscan\u002F${SCAN_ID}\u002Fresults?type=all\" \\\n     -o \u002Ftmp\u002Fosint\u002Fspiderfoot-results.json\n   ```\n\n5. **Query breach databases for email exposure (example with HIBP API):**\n\n   ```bash\n   curl -s -H \"hibp-api-key: ${HIBP_KEY}\" \\\n     -H \"User-Agent: OSINT-Correlation-Skill\" \\\n     \"https:\u002F\u002Fhaveibeenpwned.com\u002Fapi\u002Fv3\u002Fbreachedaccount\u002Ftarget@example.com\" \\\n     -o \u002Ftmp\u002Fosint\u002Fbreach-results.json\n   ```\n\n### Phase 2 — Data Normalization\n\n6. **Normalize all collected data into a common schema.** Create a unified JSON structure that tags each finding with its source, timestamp, and data type:\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Fnormalize.py \u003C\u003C 'EOF'\n   import json, csv, sys, os\n   from datetime import datetime\n\n   findings = []\n\n   # Normalize Sherlock CSV results\n   sherlock_path = \"\u002Ftmp\u002Fosint\u002Fsherlock-results.txt\"\n   if os.path.exists(sherlock_path):\n       with open(sherlock_path) as f:\n           for row in csv.DictReader(f):\n               findings.append({\n                   \"source\": \"sherlock\",\n                   \"type\": \"social_profile\",\n                   \"platform\": row.get(\"name\", \"\"),\n                   \"url\": row.get(\"url_user\", \"\"),\n                   \"username\": row.get(\"username\", \"\"),\n                   \"status\": row.get(\"status\", \"\"),\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n\n   # Normalize theHarvester JSON results\n   harvester_path = \"\u002Ftmp\u002Fosint\u002Fharvester-results.json\"\n   if os.path.exists(harvester_path):\n       with open(harvester_path) as f:\n           data = json.load(f)\n           for email in data.get(\"emails\", []):\n               findings.append({\n                   \"source\": \"theHarvester\",\n                   \"type\": \"email\",\n                   \"value\": email,\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n           for host in data.get(\"hosts\", []):\n               findings.append({\n                   \"source\": \"theHarvester\",\n                   \"type\": \"hostname\",\n                   \"value\": host,\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n\n   # Normalize SpiderFoot results\n   sf_path = \"\u002Ftmp\u002Fosint\u002Fspiderfoot-results.json\"\n   if os.path.exists(sf_path):\n       with open(sf_path) as f:\n           for item in json.load(f):\n               findings.append({\n                   \"source\": \"spiderfoot\",\n                   \"type\": item.get(\"type\", \"unknown\"),\n                   \"value\": item.get(\"data\", \"\"),\n                   \"module\": item.get(\"module\", \"\"),\n                   \"collected_at\": datetime.utcnow().isoformat()\n               })\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fnormalized-findings.json\", \"w\") as f:\n       json.dump(findings, f, indent=2)\n\n   print(f\"Normalized {len(findings)} findings from {len(set(f['source'] for f in findings))} sources\")\n   EOF\n   python3 \u002Ftmp\u002Fosint\u002Fnormalize.py\n   ```\n\n### Phase 3 — AI-Driven Correlation\n\n7. **Send normalized findings to an LLM for cross-source correlation analysis:**\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Fcorrelate.py \u003C\u003C 'PYEOF'\n   import json, os\n   from openai import OpenAI  # or anthropic, ollama, etc.\n\n   client = OpenAI(api_key=os.environ[\"OPENAI_API_KEY\"])\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fnormalized-findings.json\") as f:\n       findings = json.load(f)\n\n   correlation_prompt = f\"\"\"You are an OSINT analyst. Analyze these findings collected\n   from multiple sources and produce a correlation report.\n\n   For each identity or entity you detect:\n   1. List all linked accounts\u002Fprofiles with the evidence connecting them.\n   2. Assign a confidence score (0.0-1.0) for each linkage based on:\n      - Exact username match across platforms (high)\n      - Similar usernames with shared metadata (medium)\n      - Same email in breach data and registration (high)\n      - Co-occurring infrastructure (IP, domain) (medium)\n      - Temporal correlation of account creation dates (low-medium)\n   3. Identify contradictions or potential false positives.\n   4. Flag high-risk exposures (breached credentials, PII leaks, infrastructure overlaps).\n   5. Produce a structured JSON report.\n\n   Raw findings:\n   {json.dumps(findings[:500], indent=2)}\n   \"\"\"\n\n   response = client.chat.completions.create(\n       model=\"gpt-4o\",\n       messages=[\n           {\"role\": \"system\", \"content\": \"You are an expert OSINT analyst specializing in identity correlation and link analysis.\"},\n           {\"role\": \"user\", \"content\": correlation_prompt}\n       ],\n       temperature=0.1,\n       response_format={\"type\": \"json_object\"}\n   )\n\n   report = json.loads(response.choices[0].message.content)\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\", \"w\") as f:\n       json.dump(report, f, indent=2)\n\n   print(json.dumps(report, indent=2))\n   PYEOF\n   python3 \u002Ftmp\u002Fosint\u002Fcorrelate.py\n   ```\n\n8. **Perform entity resolution — deduplicate and merge related identities:**\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Fresolve.py \u003C\u003C 'PYEOF'\n   import json\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\") as f:\n       report = json.load(f)\n\n   # Extract entities and build a link graph\n   entities = report.get(\"entities\", [])\n   print(f\"Identified {len(entities)} distinct entities\")\n   for entity in entities:\n       name = entity.get(\"identifier\", \"unknown\")\n       confidence = entity.get(\"confidence\", 0)\n       links = entity.get(\"linked_accounts\", [])\n       risk = entity.get(\"risk_level\", \"unknown\")\n       print(f\"  [{confidence:.0%}] {name} — {len(links)} linked accounts — risk: {risk}\")\n   PYEOF\n   python3 \u002Ftmp\u002Fosint\u002Fresolve.py\n   ```\n\n### Phase 4 — Reporting and Visualization\n\n9. **Generate a final intelligence profile in Markdown:**\n\n   ```bash\n   cat > \u002Ftmp\u002Fosint\u002Freport.py \u003C\u003C 'PYEOF'\n   import json\n   from datetime import datetime\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\") as f:\n       report = json.load(f)\n\n   md = f\"# OSINT Correlation Report\\n\\n\"\n   md += f\"**Generated:** {datetime.utcnow().isoformat()}Z\\n\\n\"\n   md += \"## Entity Profiles\\n\\n\"\n\n   for entity in report.get(\"entities\", []):\n       eid = entity.get(\"identifier\", \"Unknown\")\n       conf = entity.get(\"confidence\", 0)\n       md += f\"### {eid} (Confidence: {conf:.0%})\\n\\n\"\n       md += \"| Source | Platform | Evidence |\\n|--------|----------|----------|\\n\"\n       for link in entity.get(\"linked_accounts\", []):\n           md += f\"| {link.get('source','')} | {link.get('platform','')} | {link.get('evidence','')} |\\n\"\n       md += f\"\\n**Risk Level:** {entity.get('risk_level', 'N\u002FA')}\\n\\n\"\n       for flag in entity.get(\"flags\", []):\n           md += f\"- ⚠️ {flag}\\n\"\n       md += \"\\n\"\n\n   with open(\"\u002Ftmp\u002Fosint\u002Fintelligence-profile.md\", \"w\") as f:\n       f.write(md)\n\n   print(\"Report written to \u002Ftmp\u002Fosint\u002Fintelligence-profile.md\")\n   PYEOF\n   python3 \u002Ftmp\u002Fosint\u002Freport.py\n   ```\n\n10. **Optional — Import correlation graph into Maltego for visualization:**\n\n    ```bash\n    # Export entities as Maltego-compatible CSV for manual import\n    cat > \u002Ftmp\u002Fosint\u002Fmaltego_export.py \u003C\u003C 'PYEOF'\n    import json, csv\n\n    with open(\"\u002Ftmp\u002Fosint\u002Fcorrelation-report.json\") as f:\n        report = json.load(f)\n\n    with open(\"\u002Ftmp\u002Fosint\u002Fmaltego-import.csv\", \"w\", newline=\"\") as f:\n        writer = csv.writer(f)\n        writer.writerow([\"Entity Type\", \"Value\", \"Linked To\", \"Link Label\", \"Confidence\"])\n        for entity in report.get(\"entities\", []):\n            for link in entity.get(\"linked_accounts\", []):\n                writer.writerow([\n                    link.get(\"type\", \"Alias\"),\n                    link.get(\"value\", \"\"),\n                    entity.get(\"identifier\", \"\"),\n                    link.get(\"evidence\", \"\"),\n                    link.get(\"confidence\", \"\")\n                ])\n\n    print(\"Maltego CSV exported to \u002Ftmp\u002Fosint\u002Fmaltego-import.csv\")\n    PYEOF\n    python3 \u002Ftmp\u002Fosint\u002Fmaltego_export.py\n    ```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Cross-Source Correlation | Matching identifiers (usernames, emails, IPs) across independent OSINT sources to establish entity linkage |\n| Confidence Scoring | Assigning probabilistic confidence (0.0–1.0) to each linkage based on evidence strength and corroboration |\n| Entity Resolution | Deduplicating and merging records that refer to the same real-world entity across fragmented datasets |\n| False Positive Detection | Using AI reasoning to identify coincidental matches versus genuine identity links |\n| Multi-Vector Intelligence | Combining findings from social media, DNS, breach data, and infrastructure into a single threat picture |\n| Link Analysis | Graph-based examination of relationships between entities, accounts, and infrastructure |\n\n## Tools & Systems\n\n| Tool | Role in Workflow |\n|------|-----------------|\n| Sherlock | Username enumeration across 400+ social platforms |\n| theHarvester | Email, subdomain, and host discovery from public sources |\n| SpiderFoot | Automated OSINT collection across 200+ modules |\n| Maltego | Graph-based visualization of entity relationships |\n| LLM API (GPT-4, Claude, Ollama) | Cross-source reasoning, pattern detection, and confidence scoring |\n| HaveIBeenPwned | Breach exposure and credential leak detection |\n\n## Common Scenarios\n\n- **Threat Actor Attribution:** Correlate a suspicious username found in a phishing campaign with social media profiles, domain registrations, and breach data to build an attribution profile.\n- **Attack Surface Mapping:** Link discovered subdomains, emails, and employee social accounts to understand an organization's full external exposure.\n- **Insider Threat Investigation:** Cross-reference an employee's known accounts with dark web marketplace activity and breach databases.\n- **Brand Impersonation Detection:** Identify accounts across platforms mimicking a target brand by correlating registration patterns, naming conventions, and temporal signals.\n\n## Output Format\n\nThe final output is a structured JSON correlation report and a Markdown intelligence profile containing:\n\n```json\n{\n  \"meta\": {\n    \"target\": \"targetdomain.com\",\n    \"sources_used\": [\"sherlock\", \"theHarvester\", \"spiderfoot\", \"hibp\"],\n    \"total_findings\": 247,\n    \"generated_at\": \"2025-01-15T14:30:00Z\"\n  },\n  \"entities\": [\n    {\n      \"identifier\": \"john.target\",\n      \"confidence\": 0.92,\n      \"linked_accounts\": [\n        {\n          \"source\": \"sherlock\",\n          \"platform\": \"GitHub\",\n          \"value\": \"john.target\",\n          \"evidence\": \"Exact username match, bio references targetdomain.com\",\n          \"confidence\": 0.95\n        }\n      ],\n      \"risk_level\": \"high\",\n      \"flags\": [\n        \"Credentials exposed in 2 breaches (2022, 2023)\",\n        \"Admin email for targetdomain.com found in public WHOIS\"\n      ]\n    }\n  ],\n  \"contradictions\": [],\n  \"recommendations\": []\n}\n```\n\n## Verification\n\n- Confirm that each linked account has been independently verified against at least two sources before assigning confidence > 0.8.\n- Cross-check AI-generated correlations manually for a random sample (10–20%) to validate accuracy.\n- Verify that no false positives from common usernames (e.g., \"admin\", \"test\") inflated entity profiles.\n- Ensure breach data timestamps are current and from reputable aggregators.\n- Validate that the final report does not include stale or retracted OSINT data.\n",{"name":5,"tags":49,"author":58,"domain":29,"license":15,"version":59,"nist_csf":60,"subdomain":43,"description":7,"nist_ai_rmf":65,"mitre_attack":70,"atlas_techniques":76,"d3fend_techniques":80},[24,50,43,51,52,53,54,55,56,57],"ai-correlation","reconnaissance","link-analysis","target-profiling","sherlock","theharvester","spiderfoot","maltego","juliosuas","1.0",[61,62,63,64],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[66,67,68,69],"MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1",[71,72,73,74,75],"T1591","T1592","T1593","T1589","T1595",[77,78,79],"AML.T0051","AML.T0054","AML.T0056",[81,82,83,84,85],"Identifier Analysis","URL Analysis","Identifier Reputation Analysis","User Behavior Analysis","Content Validation","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-ai-driven-osint-correlation","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":95,"prompt":105,"zipAvailable":106},[96,99,102],{"tool":97,"command":98},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-ai-driven-osint-correlation",{"tool":100,"command":101},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-ai-driven-osint-correlation",{"tool":103,"command":104},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-ai-driven-osint-correlation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ai-driven-osint-correlation\u002FSKILL.md",true,[108,113,119],{"path":109,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ai-driven-osint-correlation\u002FLICENSE",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fapi-reference.md","REFERENCE","参考文档",5068,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ai-driven-osint-correlation\u002Freferences\u002Fapi-reference.md",{"path":120,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fagent.py","SCRIPT","脚本",15667,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ai-driven-osint-correlation\u002Fscripts\u002Fagent.py",[126,167,176,185,207,232],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":147,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[133,136,139,142],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":168,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[171,172,173,174],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"skillNo":177,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":184,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[180,181,182,183],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},[128,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[192,193,194,195,196,197,198,199,200,201,202,203,204,205,206],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[213],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,218,219,220,42,221,222,223,224,159,160,225,226,227,228,229,230,231],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":130,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":248,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[238,241,244,245],{"categoryNo":239,"categoryName":240,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":242,"categoryName":243,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":246,"categoryName":247,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000036","内容创作者",[249,250,251,252,253,254,255,256,156,257,159,160,161,258,259,260,261,262,206,263],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]