Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HezaoHezao/poirot --skill osint-investigationgit clone --depth 1 https://github.com/HezaoHezao/poirotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hezaohezao/poirot/osint-investigation)<a href="https://agentmods.dev/skills/hezaohezao/poirot/osint-investigation"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/osint-investigation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hezaohezao/poirot/osint-investigation"><img src="https://agentmods.dev/badge/skills/hezaohezao/poirot/osint-investigation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.01443 |
| Opus 5.5 | $0.00008 | $0.00577 |
| Sonnet 5.5 | $0.00004 | $0.00289 |
| Haiku 4.5 | $0.00002 | $0.00144 |
Grade D, and why
osint-investigation scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -s -X POST "https://api.usaspending.gov/api/v2/search/spending_by_award/" -d '{"filters":{...}}' Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s "https://efts.sec.gov/LATEST/search-index?q=%22Company+Name%22" | python3 -c "..." Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| **SEC EDGAR** | US public company filings (10-K, 10-Q, 8-K, 13F) | `curl` to `https://efts.sec.gov/LATEST/search-index?q=...` | How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OSINT Investigation — Public Records Cross-Reference
Investigative framework for public-records OSINT: government contracts, corporate filings, lobbying, sanctions, offshore leaks, property records, court records, web archives, knowledge bases, and global news. Resolve entities across heterogeneous sources, build cross-links with explicit confidence, and produce structured evidence chains.
Python stdlib only. Zero install. Most sources work with no API key.
When to Use
Use when the user asks for:
- "follow the money" — government contracts, lobbying → legislation, sanctions
- Corporate due diligence — who controls company X, where incorporated, board members, filings
- Sanctions screening — is entity X on OFAC SDN, ICIJ offshore leaks
- Property ownership — find recorded deeds/mortgages by name or address
- Litigation history — find federal + state court opinions
- Multi-source entity resolution where naming varies (LLC suffixes, abbreviations)
- Evidence-chain construction with explicit confidence levels
- "what's been said about X" — international news + Wikipedia + Wayback Machine
Core Sources
Corporate & Financial
| Source | What | Access |
|---|---|---|
| SEC EDGAR | US public company filings (10-K, 10-Q, 8-K, 13F) | curl to https://efts.sec.gov/LATEST/search-index?q=... |
| USAspending.gov | Federal contracts and grants | curl to https://api.usaspending.gov/api/v2/... |
| Senate Lobbying | Lobbying Disclosure Act filings | curl to https://lda.senate.gov/api/v1/... |
| OFAC SDN | Sanctions list | curl to https://www.treasury.gov/ofac/... |
| ICIJ Offshore Leaks | Panama Papers, Paradise Papers, etc. | browse_page to https://offshoreleaks.icij.org/... |
| OpenCorporates | Corporate registry (optional free token) | curl to https://api.opencorporates.com/... |
Property & Courts
| Source | What | Access |
|---|---|---|
| NYC ACRIS | NYC property records (deeds, mortgages) | browse_page to https://a836-acris.nyc.gov/... |
| CourtListener | Federal + state court opinions | curl to https://www.courtlistener.com/api/... |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 166 lines · 19 tokens per session scan D 8caa6aaa6ef7
osint-investigation is a skill published in the GitHub repository HezaoHezao/poirot (257 stars, last pushed 3mo ago), licensed MIT. It adds 19 tokens to every session and 1,443 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 3 findings (sends data to an external url, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bmad-correct-course
Assess the impact of a significant change during sprint execution across the PRD, epics, architecture, and UX documents, and produce a sprint change proposal. Use when the user says "correct course" or "propose sprint change".
bmad-spec
Condense any input — an idea, brief, PRD, transcript, or mixed notes — into a short spec: one kernel file plus supporting files that downstream skills build from. Also updates and validates existing specs. Use when the user says "create a spec", "distill this into a spec", "validate this spec", or "update the spec".
bmad-product-brief
Create, update, or validate a product brief. Use when the user wants help producing, editing, or validating a brief.
bmad-deep-recon
Research a topic to support a decision, three ways: draft a research prompt for the user to run in their own tool (ChatGPT, Gemini, Grok, Perplexity, …), turn a finished research report into a short summary with cited sources that other skills can use directly, or run the research here with parallel web searches.…
bmad-ticket
Create and manage tickets — initiatives, epics, stories, bugs. Use when the user says "create a new initiative", "slice this initiative", "split this epic up", "break this into stories", "incept this epic", "make a ticket", "refine this ticket", "what's ready", "status of a story", "publish ticket changes", "validate…
bmad-eval
Runs the evals of a BMad skill through the agent harness the user works in and reports what they show: baseline against the bare model, variant against a stripped or prior version, quality against a rubric, and trigger accuracy of the description with an optional optimization loop. Use when the user asks to evaluate…