Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Unclecheng-li/DeepSec --skill osint-recongit clone --depth 1 https://github.com/Unclecheng-li/DeepSecWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/unclecheng-li/deepsec/osint-recon)<a href="https://agentmods.dev/skills/unclecheng-li/deepsec/osint-recon"><img src="https://agentmods.dev/badge/skills/unclecheng-li/deepsec/osint-recon.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.02398 |
| Opus 5 | $0.00021 | $0.01199 |
| Sonnet 5 | $0.00008 | $0.00480 |
| Haiku 4.5 | $0.00004 | $0.00240 |
Grade A, and why
osint-recon scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
r = requests.get(f"https://crt.sh/?q=%.{domain}&output=json") This is a copy
100% identical to osint-recon — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OSINT 开源情报收集知识库
针对信息收集/侦察/社会工程场景的实战知识库，提供四维信息收集模型（服务器信息 → 网站信息 → 域名信息 → 人员信息），以及具体的工具使用方法和数据提取技巧。
与 recon Skill 的区别：
recon→ 技术层面侦察（端口扫描、DNS、目录枚举）— 基础版osint-recon→ 全维度侦察（服务器 + 网站 + 域名 + 人员/社会工程）— 深度版
核心原则
- 四维度全覆盖 — 服务器/网站/域名三个维度始终执行，人员维度按条件触发
- 从页面提取一切可提取的信息 — 不只看 HTTP 头，还要看 HTML 内容、JS 文件、注释
- 先被动后主动 — 先看响应头、DNS、WHOIS（被动），再做端口扫描/目录枚举（主动）
- 维度完成度自检 — 每轮检查哪些维度已完成 ✅，哪些未完成 ❌，全部完成后才允许 [DONE]
- 外部链接即线索 — 页面上的每个外部链接都可能是信息来源
- 结构化输出 — 所有发现汇总为 Markdown 报告
四维信息收集模型
维度一：服务器信息
| 检查项 | 工具/方法 | 说明 |
|---|---|---|
| 开放端口 & 服务版本 | MCP nmap / python_execute + socket |
全端口扫描或常见端口（21/22/80/443/3306/6379/8080/8443） |
| 真实 IP 探测 | DNS 历史记录 / 全局 Ping / 邮件头提取 | CDN 后的源站 IP — SecurityTrails/DNSHistory/全局Ping |
| 操作系统指纹 | TTL 推断 + nmap OS 检测 | Linux TTL≈64, Windows TTL≈128, Unix TTL≈255 |
| 中间件版本 | 响应头 Server + 错误页 + 特征文件 | Apache/Nginx/IIS/Tomcat 版本识别 |
| 数据库识别 | 端口探测 + 错误信息 + 特征行为 | MySQL(3306)/Redis(6379)/MongoDB(27017)/MSSQL(1433) |
维度二：网站信息
| 检查项 | 工具/方法 | 说明 |
|---|---|---|
| 网站架构 | 响应头 + 页面特征 + JS 库 | OS + 中间件 + 数据库 + 语言 + 框架 → 完整技术栈 |
| Web 指纹 | fetch + 响应特征匹配 |
CMS 类型、前端框架、JS 库、模板引擎 |
| WAF 检测 | wafw00f 逻辑 + 响应特征 | 拦截页面/特殊响应头/异常状态码 |
| 敏感目录 & 敏感文件 | python_execute + 常见路径字典 |
/admin /backup /config /api /robots.txt /sitemap.xml |
| 源码泄露 | 检查常见泄露路径 | .git/.svn/.DS_Store/.env/web.config/备份文件(.bak/.swp/.old) |
| 旁站查询 | 同 IP 反查域名 | 站长工具/微步在线/crt.sh 同 IP 查询 |
| C 段查询 | 同网段存活主机扫描 | nmap -sn 扫描 /24 网段 |
维度三：域名信息
| 检查项 | 工具/方法 | 说明 |
|---|---|---|
| WHOIS 注册信息 | python_execute + whois API/命令 |
注册人/注册商/NS 服务器/注册日期/到期日期 |
| ICP 备案信息 | 工信部备案查询 API | 仅中国大陆域名需查，境外域名无备案 |
| 子域名发现 | crt.sh + 爆破 + 搜索引擎 + DNS 区域传送 | 多方法交叉验证，确保覆盖全面 |
| DNS 记录全量 | python_execute + dnspython/socket |
A/CNAME/MX/TXT/NS/SPF/SOA 全量查询 |
| 证书透明度日志 | crt.sh / Censys / certspotter | 发现历史证书、子域名、关联域名 |
维度四：人员信息 ⚡ 条件触发
⚠️ 此维度仅在以下条件之一满足时才执行：
- 用户命令中明确提及"社会工程/社工/人员信息/作者追踪/人物画像"等
- 目标网站有明确作者信息（meta author、about 页面、联系方式）
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 162 lines · 42 tokens per session scan A 4cc79b76ccd9
osint-recon is a skill published in the GitHub repository Unclecheng-li/DeepSec (400 stars, last pushed 14d ago), licensed MIT. It adds 42 tokens to every session and 2,398 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). It is 100% identical to osint-recon, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
final-report
Final engagement report generation — executive summary, technical report, findings aggregation, attack path narrative, detection gap matrix, remediation roadmap.
exploit-reporting
Exploitation finding documentation — initial access reports, exploit chain documentation, CVSS v4.0 scoring, shell/credential inventory, detection gap analysis.
ti-ioc-extraction
Automated IOC extraction from threat reports, logs, and unstructured text — parse hashes, IPs, domains, URLs, email addresses, and CVEs. Covers regex-based extraction, defanging/refanging, bulk hash lookup, IOC deduplication, YARA rule generation from IOCs, and STIX/TAXII formatting for sharing.
m365-mailbox-compromise
Microsoft 365 mailbox compromise chain — OAuth consent phishing, delegate access abuse, mail rule persistence, and token theft via device code phishing. Full kill chain from initial access to persistent email collection.
web
Web application exploitation — the primary category skill for all web-based attacks. This is a routing skill: read this first to identify the attack type, then load the appropriate specialized sub-skill for detailed procedures. Covers 11 technique areas across injection, file access, authentication, and API…
pentest-task-tree
Iterative PTT (Penetration Testing Tree) session reasoning — build, update, and traverse a live numbered task tree to drive LLM-guided pentest decisions across a full session.