[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F9TJS53WMZFWWGWJNYVZQM":3,"skill-same:01M6F9TJS53WMZFWWGWJNYVZQM":140},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":113,"commitSha":114,"skillDirectory":115,"forksCount":116,"repositoryHtmlUrl":117,"repositoryHomepageUrl":6,"ownerHtmlUrl":118,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":119,"install":120,"resources":133},"01M6F9TJS53WMZFWWGWJNYVZQM","osint-methodology",null,"Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-osint-methodology\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"osint","methodology","osint methodology","team","2026","open source intelligence","tenant","relevant","time","upgrade","translation","mobile","bug","campaign","testing","open","prioritization","m365","Budget","attack-surface","CISA","APK","open source","2026-11-10 10:12:30",false,"---\nname: osint-methodology\ndescription: Comprehensive OSINT methodology for external red-team operations and\n  authorized attack-surface assessments.\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: community, public_research\nversion: 2.3\ntriggers:\n- external recon\n- external red team\n- red team external\n- attack surface management\n- attack surface mapping\n- ASM\n- perimeter recon\n- target reconnaissance\n- bug bounty recon\n- asset discovery\n- footprint\n- attack path\n- identity fabric\n- SSO discovery\n- IdP fingerprinting\n- tenant fingerprinting\n- M365 enumeration\n- Microsoft 365 recon\n- API discovery\n- GraphQL introspection\n- mobile recon\n- APK analysis\n- cloud bucket enumeration\n- bucket enum\n- breach correlation\n- secret leak hunt\n- origin discovery\n- CDN bypass\n- WAF bypass\n- vulnerability prioritization\n- CVE prioritization\n- EPSS\n- CISA KEV\n- phishing infrastructure\n- pretext development\n- bug bounty submission\n- responsible disclosure\n- client report\n- exec summary\n- risk translation\n- confidence upgrade\n- time budget\n- engagement profile\n- asset triage\n- detection-aware probing\n- back-off strategy\n- persona rotation\n- OSINT methodology\n- open source intelligence\n- target profiling\n- data correlation\n- OSINT workflow\n- intelligence collection\n- OSINT campaign\n- recon methodology\n- threat actor investigation\n- attribution\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# OSINT methodology for authorized surface review\n\n## When to Use\n\nUse for scoped organizational attack-surface research, evidence correlation and\nassessment reports. Defensive inventory and source analysis are valid uses.\nPersonal investigations need a legitimate, clearly scoped purpose and privacy\nlimits; do not collect private identifiers, credentials or location histories as\nan automatic extension of an infrastructure engagement. Exploitation, phishing\nexecution, persistence and account intrusion are outside this methodology.\n\n## Authorization and collection plan\n\nRecord exact assets, approved sources\u002Fqueries, allowed active techniques, window,\nrate limits, data minimization, retention and stop conditions. The root mandatory\nper-command confirmation gate remains binding; an asserted engagement or a\n`--deep` flag does not waive it. Ownership evidence is distinct from permission.\nDiscovery of a subsidiary, vendor, employee profile or historical origin does not\nexpand scope. Use approved engagement accounts and egress; do not rotate personas,\nTLS fingerprints or proxies to evade blocks or platform controls.\n\nStart with approved local inventories and public documentation. Separate passive\nthird-party queries from requests to the target: HTTP HEAD, DNS resolution, TLS\nhandshakes, screenshots and API calls can all generate traffic\u002Flogs and may send\nsensitive query information to the provider. Check cost, terms and authorization.\nStop at rate limits, WAF challenges, explicit denial or owner contact; document\nand consult the lead before resuming, without switching identity to bypass them.\n\n## Workflow\n\n1. Define the research question and known seed identities with sources\u002Fdates.\n2. Collect only relevant authorized evidence and record acquisition method.\n3. Represent assets and relationships as typed, timestamped observations.\n4. Corroborate each specific claim using independent sources and alternatives.\n5. Prioritize by verified exposure, business context and uncertainty, not hostname\n   keywords, email role or a fixed numeric “interest score”.\n6. Draft findings and recommended next steps; submit\u002Fcontact\u002Fpublish only when\n   specifically authorized. Preserve unresolved leads as hypotheses.\n\n## Evidence record example\n\n```json\n{\n  \"asset_key\": \"domain:example.org\",\n  \"claim\": \"appears in a certificate SAN\",\n  \"source\": \"approved CT record reference\",\n  \"observed_at\": \"2026-10-23T10:00:00Z\",\n  \"confidence\": \"directly observed record; present ownership unverified\",\n  \"scope_status\": \"candidate, active testing not approved\",\n  \"alternatives\": [\"historic deployment\", \"shared hosting\"],\n  \"limitations\": [\"not evidence of a live service or vulnerability\"]\n}\n```\n\nConfidence attaches to the precise claim. A resolved domain, an HTTP response,\na matched photo or three copied search results does not confirm ownership,\nattribution, exploitation or a person's identity. Counts of signals are not a\nuniversal proof rule. Distinguish source independence, direct observation and\ninference; record counterevidence and possible stale\u002Fspoofed data.\n\n## Data handling\n\nStore restricted evidence and redacted working copies separately. Record source,\nUTC time, tool version, full content hash and any truncation or normalization.\nHashes bind bytes, not truth, legal admissibility or replayability. Do not submit\nprivate URLs, artifacts, PII or secrets to public archives, sandboxes or external\nmodels without explicit data-sharing approval. A local model is not automatically\nprivate: check logging, telemetry, access and storage. Do not acquire stolen dumps\nor validate found credentials merely to increase confidence; stop and notify via\nthe approved owner channel, with redaction.\n\nRead [technical interpretation guidance](references\u002Fdetails.md) before classifying\nidentity, cloud, media, blockchain or vulnerability data.\n\n## Limitations and provenance\n\nDocs-only adaptation of\n[elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter),\nwith upstream MIT attribution retained. No scanner engine, corpus, CLI `--deep`\nmode, test evidence or third-party credentials are bundled. Referenced external\nservices may require permission, payment, accounts and version-specific APIs.\nDo not install from moving snippets or assume a companion skill is present.\nNo enumeration completeness, current compromise, court-grade evidence, attribution\ncertainty or guaranteed bounty follows from this workflow.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# OSINT methodology for authorized surface review\n\n## When to Use\n\nUse for scoped organizational attack-surface research, evidence correlation and\nassessment reports. Defensive inventory and source analysis are valid uses.\nPersonal investigations need a legitimate, clearly scoped purpose and privacy\nlimits; do not collect private identifiers, credentials or location histories as\nan automatic extension of an infrastructure engagement. Exploitation, phishing\nexecution, persistence and account intrusion are outside this methodology.\n\n## Authorization and collection plan\n\nRecord exact assets, approved sources\u002Fqueries, allowed active techniques, window,\nrate limits, data minimization, retention and stop conditions. The root mandatory\nper-command confirmation gate remains binding; an asserted engagement or a\n`--deep` flag does not waive it. Ownership evidence is distinct from permission.\nDiscovery of a subsidiary, vendor, employee profile or historical origin does not\nexpand scope. Use approved engagement accounts and egress; do not rotate personas,\nTLS fingerprints or proxies to evade blocks or platform controls.\n\nStart with approved local inventories and public documentation. Separate passive\nthird-party queries from requests to the target: HTTP HEAD, DNS resolution, TLS\nhandshakes, screenshots and API calls can all generate traffic\u002Flogs and may send\nsensitive query information to the provider. Check cost, terms and authorization.\nStop at rate limits, WAF challenges, explicit denial or owner contact; document\nand consult the lead before resuming, without switching identity to bypass them.\n\n## Workflow\n\n1. Define the research question and known seed identities with sources\u002Fdates.\n2. Collect only relevant authorized evidence and record acquisition method.\n3. Represent assets and relationships as typed, timestamped observations.\n4. Corroborate each specific claim using independent sources and alternatives.\n5. Prioritize by verified exposure, business context and uncertainty, not hostname\n   keywords, email role or a fixed numeric “interest score”.\n6. Draft findings and recommended next steps; submit\u002Fcontact\u002Fpublish only when\n   specifically authorized. Preserve unresolved leads as hypotheses.\n\n## Evidence record example\n\n```json\n{\n  \"asset_key\": \"domain:example.org\",\n  \"claim\": \"appears in a certificate SAN\",\n  \"source\": \"approved CT record reference\",\n  \"observed_at\": \"2026-10-23T10:00:00Z\",\n  \"confidence\": \"directly observed record; present ownership unverified\",\n  \"scope_status\": \"candidate, active testing not approved\",\n  \"alternatives\": [\"historic deployment\", \"shared hosting\"],\n  \"limitations\": [\"not evidence of a live service or vulnerability\"]\n}\n```\n\nConfidence attaches to the precise claim. A resolved domain, an HTTP response,\na matched photo or three copied search results does not confirm ownership,\nattribution, exploitation or a person's identity. Counts of signals are not a\nuniversal proof rule. Distinguish source independence, direct observation and\ninference; record counterevidence and possible stale\u002Fspoofed data.\n\n## Data handling\n\nStore restricted evidence and redacted working copies separately. Record source,\nUTC time, tool version, full content hash and any truncation or normalization.\nHashes bind bytes, not truth, legal admissibility or replayability. Do not submit\nprivate URLs, artifacts, PII or secrets to public archives, sandboxes or external\nmodels without explicit data-sharing approval. A local model is not automatically\nprivate: check logging, telemetry, access and storage. Do not acquire stolen dumps\nor validate found credentials merely to increase confidence; stop and notify via\nthe approved owner channel, with redaction.\n\nRead [technical interpretation guidance](references\u002Fdetails.md) before classifying\nidentity, cloud, media, blockchain or vulnerability data.\n\n## Limitations and provenance\n\nDocs-only adaptation of\n[elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter),\nwith upstream MIT attribution retained. No scanner engine, corpus, CLI `--deep`\nmode, test evidence or third-party credentials are bundled. Referenced external\nservices may require permission, payment, accounts and version-specific APIs.\nDo not install from moving snippets or assume a companion skill is present.\nNo enumeration completeness, current compromise, court-grade evidence, attribution\ncertainty or guaranteed bounty follows from this workflow.\n",{"name":5,"risk":46,"source":47,"license":14,"sources":48,"version":49,"category":50,"triggers":51,"date_added":108,"description":7,"source_repo":109,"source_type":110,"compatibility":111,"license_source":112},"offensive","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","community, public_research",2.3,"security",[52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,23,100,101,102,103,104,105,106,107],"external recon","external red team","red team external","attack surface management","attack surface mapping","ASM","perimeter recon","target reconnaissance","bug bounty recon","asset discovery","footprint","attack path","identity fabric","SSO discovery","IdP fingerprinting","tenant fingerprinting","M365 enumeration","Microsoft 365 recon","API discovery","GraphQL introspection","mobile recon","APK analysis","cloud bucket enumeration","bucket enum","breach correlation","secret leak hunt","origin discovery","CDN bypass","WAF bypass","vulnerability prioritization","CVE prioritization","EPSS","CISA KEV","phishing infrastructure","pretext development","bug bounty submission","responsible disclosure","client report","exec summary","risk translation","confidence upgrade","time budget","engagement profile","asset triage","detection-aware probing","back-off strategy","persona rotation","OSINT methodology","target profiling","data correlation","OSINT workflow","intelligence collection","OSINT campaign","recon methodology","threat actor investigation","attribution","2026-09-20","elementalsouls\u002FClaude-BugHunter","community","Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","main","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-osint-methodology",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-13 14:20:47",{"source":8,"skillName":5,"commands":121,"prompt":131,"zipAvailable":132},[122,125,128],{"tool":123,"command":124},"npx","npx skills add boisenoise\u002Fskills-collections --skill osint-methodology",{"tool":126,"command":127},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill osint-methodology",{"tool":129,"command":130},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill osint-methodology","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-osint-methodology\u002FSKILL.md",true,[134],{"path":135,"resourceType":136,"resourceTypeDesc":137,"sizeBytes":138,"sourceHtmlUrl":139},"references\u002Fdetails.md","REFERENCE","参考文档",8978,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-osint-methodology\u002Freferences\u002Fdetails.md",[141,170,196,222,241,264],{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":145,"licenseFileUrl":146,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":41},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,22],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","only","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":145,"licenseFileUrl":174,"sourceHtmlUrl":175,"categories":176,"keywords":182,"publishedAt":41},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[177],{"categoryNo":178,"categoryName":179,"taxonomyType":180,"taxonomyTypeDesc":181},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[172,183,184,185,153,154,186,158,36,187,21,188,189,190,191,165,192,193,194,195,22],"MCP","cli","github","license","credentials","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":145,"licenseFileUrl":200,"sourceHtmlUrl":201,"categories":202,"keywords":208,"publishedAt":41},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[203],{"categoryNo":204,"categoryName":205,"taxonomyType":206,"taxonomyTypeDesc":207},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[198,185,153,186,209,210,211,212,213,214,165,215,216,217,193,218,219,220,221,195,172,22],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":145,"licenseFileUrl":226,"sourceHtmlUrl":227,"categories":228,"keywords":229,"publishedAt":41},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[230,231,232,185,153,186,233,234,209,235,36,236,237,238,213,165,239,240,195,172,22],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":145,"licenseFileUrl":245,"sourceHtmlUrl":246,"categories":247,"keywords":248,"publishedAt":41},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[249,250,185,251,153,252,186,253,254,255,256,257,165,258,259,260,261,262,263,195],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":265,"name":266,"nameZh":6,"description":267,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":145,"licenseFileUrl":268,"sourceHtmlUrl":269,"categories":270,"keywords":271,"publishedAt":41},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[272,273,274,185,153,186,275,276,212,277,278,165,279,280,281,282,283,284,285,195],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]