Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fb0sh/pentester/osint-reconnpx skills add fb0sh/pentester --skill osint-recongit clone --depth 1 https://github.com/fb0sh/pentesterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fb0sh/pentester/osint-recon)<a href="https://agentmods.dev/skills/fb0sh/pentester/osint-recon"><img src="https://agentmods.dev/badge/skills/fb0sh/pentester/osint-recon.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.02428 |
| Opus 5 | $0.00034 | $0.01214 |
| Sonnet 5 | $0.00014 | $0.00486 |
| Haiku 4.5 | $0.00007 | $0.00243 |
Grade A, and why
osint-recon scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
r = requests.get(f"https://crt.sh/?q=%.{domain}&output=json") How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OSINT 开源情报收集知识库
针对信息收集/侦察/社会工程场景的实战知识库，提供四维信息收集模型（服务器信息 → 网站信息 → 域名信息 → 人员信息），以及具体的工具使用方法和数据提取技巧。
与 recon Skill 的区别：
recon→ 技术层面侦察（端口扫描、DNS、目录枚举）— 基础版osint-recon→ 全维度侦察（服务器 + 网站 + 域名 + 人员/社会工程）— 深度版
核心原则
- 四维度全覆盖 — 服务器/网站/域名三个维度始终执行，人员维度按条件触发
- 从页面提取一切可提取的信息 — 不只看 HTTP 头，还要看 HTML 内容、JS 文件、注释
- 先被动后主动 — 先看响应头、DNS、WHOIS（被动），再做端口扫描/目录枚举（主动）
- 维度完成度自检 — 每轮检查哪些维度已完成 ✅，哪些未完成 ❌，全部完成后才允许 [DONE]
- 外部链接即线索 — 页面上的每个外部链接都可能是信息来源
- 结构化输出 — 所有发现汇总为 Markdown 报告
四维信息收集模型
维度一：服务器信息
| 检查项 | 工具/方法 | 说明 |
|---|---|---|
| 开放端口 & 服务版本 | MCP nmap / python_execute + socket |
全端口扫描或常见端口（21/22/80/443/3306/6379/8080/8443） |
| 真实 IP 探测 | DNS 历史记录 / 全局 Ping / 邮件头提取 | CDN 后的源站 IP — SecurityTrails/DNSHistory/全局Ping |
| 操作系统指纹 | TTL 推断 + nmap OS 检测 | Linux TTL≈64, Windows TTL≈128, Unix TTL≈255 |
| 中间件版本 | 响应头 Server + 错误页 + 特征文件 | Apache/Nginx/IIS/Tomcat 版本识别 |
| 数据库识别 | 端口探测 + 错误信息 + 特征行为 | MySQL(3306)/Redis(6379)/MongoDB(27017)/MSSQL(1433) |
维度二：网站信息
| 检查项 | 工具/方法 | 说明 |
|---|---|---|
| 网站架构 | 响应头 + 页面特征 + JS 库 | OS + 中间件 + 数据库 + 语言 + 框架 → 完整技术栈 |
| Web 指纹 | fetch + 响应特征匹配 |
CMS 类型、前端框架、JS 库、模板引擎 |
| WAF 检测 | wafw00f 逻辑 + 响应特征 | 拦截页面/特殊响应头/异常状态码 |
| 敏感目录 & 敏感文件 | python_execute + 常见路径字典 |
/admin /backup /config /api /robots.txt /sitemap.xml |
| 源码泄露 | 检查常见泄露路径 | .git/.svn/.DS_Store/.env/web.config/备份文件(.bak/.swp/.old) |
| 旁站查询 | 同 IP 反查域名 | 站长工具/微步在线/crt.sh 同 IP 查询 |
| C 段查询 | 同网段存活主机扫描 | nmap -sn 扫描 /24 网段 |
维度三：域名信息
| 检查项 | 工具/方法 | 说明 |
|---|---|---|
| WHOIS 注册信息 | python_execute + whois API/命令 |
注册人/注册商/NS 服务器/注册日期/到期日期 |
| ICP 备案信息 | 工信部备案查询 API | 仅中国大陆域名需查，境外域名无备案 |
| 子域名发现 | crt.sh + 爆破 + 搜索引擎 + DNS 区域传送 | 多方法交叉验证，确保覆盖全面 |
| DNS 记录全量 | python_execute + dnspython/socket |
A/CNAME/MX/TXT/NS/SPF/SOA 全量查询 |
| 证书透明度日志 | crt.sh / Censys / certspotter | 发现历史证书、子域名、关联域名 |
维度四：人员信息 ⚡ 条件触发
⚠️ 此维度仅在以下条件之一满足时才执行：
- 用户命令中明确提及"社会工程/社工/人员信息/作者追踪/人物画像"等
- 目标网站有明确作者信息（meta author、about 页面、联系方式）
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 165 lines · 69 tokens per session scan A 8d873adbd7c6
osint-recon is a skill published in the GitHub repository fb0sh/pentester (23 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 2,428 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
transilience-report-style
Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.
firewall-review
Evidence-safe firewall ruleset audit reference specification — 22 documented detector patterns (17 vendor-agnostic plus 5 FortiGate-specific), a 15-check semantic catalogue, CIS Fortinet FortiGate Benchmark guidance, a custom customer-policy benchmark, and consolidated network-team Excel profiles including grouped…
pentest-engagement
Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mode (a list of IPs/CIDRs, e.g. 1500…
attack-path-stitcher
Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.
coordination
Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.
dfir
Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks, or performing threat hunting on provided evidence files.