Skills

In the author's own words, from each skill's SKILL.md.

• dig-through-data-brokers

  Use people-search aggregators and primary public records to find addresses, phone numbers, relatives, age and background on a person, and to audit and remove your own exposure. Covers Spokeo, BeenVerified, Whitepages, TruePeopleSearch, FastPeopleSearch, That'sThem, Radaris, Intelius and Pipl, plus voter files and county court and property records. Use when running a people search or reverse addre…

  skills/dig-through-data-brokers/SKILL.md on GitHub (opens in a new tab)

• find-anyone

  Build a sourced, corroborated profile of a named individual from public records, social platforms, professional networks, court and property filings, licensing boards, patents, papers and obituaries — anchoring the name to a second selector first so you never fuse two people into one dossier. Use when asked to find, identify, background-check or profile a person, verify someone's claimed employme…

  skills/find-anyone/SKILL.md on GitHub (opens in a new tab)

• find-exposed-servers

  Find internet-exposed hosts, ports, services and devices using third-party internet-scan data instead of touching the target. Covers Shodan and Censys query syntax, service banners, favicon-hash and TLS-certificate pivots, origin-IP discovery behind Cloudflare or a CDN, and exposed databases, dashboards, cameras and ICS devices. Use when asked what a company has exposed to the internet, to check…

  skills/find-exposed-servers/SKILL.md on GitHub (opens in a new tab)

• find-hidden-subdomains

  Enumerate an organisation's subdomains and sibling domains from Certificate Transparency logs and passive DNS, without sending traffic to the target. Covers crt.sh and CT log queries, certificate SAN fields, subfinder and amass, and newly issued TLS certificates. Use when looking for staging, dev, admin or VPN hosts, mapping the full hostname footprint of a domain, or spotting infrastructure a co…

  skills/find-hidden-subdomains/SKILL.md on GitHub (opens in a new tab)

• find-leaks-in-the-wild

  Find leaked or mentioned selectors circulating in pastes, leak forums, Telegram channels and dump markets, and judge whether a claimed leak is genuine or a recycled combolist. Covers paste aggregators, site: searches over paste hosts, channel indexes and leak-search services. Use when checking whether a name, email, domain or credential is circulating, verifying a breach claim made against your o…

  skills/find-leaks-in-the-wild/SKILL.md on GitHub (opens in a new tab)

• find-the-original-image

  Reverse image search across Yandex, Google Lens, Bing Visual Search, TinEye and Baidu to find where a picture came from and who published it first. Use when reverse image searching, identifying a photo, face, logo, product, uniform or building, tracing a profile picture or avatar, finding the oldest copy of an image, checking whether a photo is stock or a repost, or reverse-searching a video by k…

  skills/find-the-original-image/SKILL.md on GitHub (opens in a new tab)

• follow-the-crypto

  Trace cryptocurrency addresses and transactions on public blockchains using block explorers including Etherscan, Blockchair, mempool.space and Blockscout. Covers common-input clustering, ENS resolution, exchange deposit addresses, mixers, CoinJoin, Tornado-style pools, cross-chain bridges, and OFAC sanctions screening. Use when following a Bitcoin or Ethereum wallet, investigating where a ransom…

  skills/follow-the-crypto/SKILL.md on GitHub (opens in a new tab)

• geolocate-from-pixels

  Geolocate and chronolocate a photo or video from visual evidence alone — plate and phone number formats, road markings, utility poles, bollards, signage typefaces, architecture and vegetation for place; shadow direction and length with SunCalc for time and date. Use when asked where or when a picture was taken, to verify a claimed location without GPS or EXIF, or to match a scene against Google E…

  skills/geolocate-from-pixels/SKILL.md on GitHub (opens in a new tab)

• google-like-a-spy

  Craft advanced search-engine queries and Google dorks to surface hidden files, documents and mentions. Covers site:, filetype:, inurl:, intitle:, intext: and before:/after: operators, verbatim search, exposed directory listings, config files, backups and open S3 buckets, and the operator differences between Google, Bing, DuckDuckGo and Yandex. Use when building a Google dork, hunting a leaked doc…

  skills/google-like-a-spy/SKILL.md on GitHub (opens in a new tab)

• graph-the-network

  Build an entity-relationship link-analysis graph of an investigation — nodes, typed edges carrying source and confidence, aliases, and temporal validity — to expose shared infrastructure, bridging nodes and the real principal behind a frontman. Covers Maltego, Neo4j and Cypher, Gephi, centrality and community detection, and entity resolution. Use when an investigation has outgrown a list and need…

  skills/graph-the-network/SKILL.md on GitHub (opens in a new tab)

• hunt-a-handle

  Enumerate a username across hundreds of platforms with sherlock, maigret and WhatsMyName, then correlate and confirm which accounts genuinely belong to the same person. Use for username OSINT and handle enumeration, "find all accounts for this username", cross-platform account correlation, nickname and screen-name pivots, or turning a handle into a real name. Applies to fraud and synthetic-identi…

  skills/hunt-a-handle/SKILL.md on GitHub (opens in a new tab)

• investigate-anything

  Start-here router and tradecraft baseline for any investigation into a person, company, domain, image or selector. Sets authorised scope, turns a vague request into an answerable intelligence question, writes a collection plan, picks the right workflow for the starting selector, and applies source grading and competing-hypothesis discipline. Use for "investigate this person or company", "do OSINT…

  skills/investigate-anything/SKILL.md on GitHub (opens in a new tab)

• investigate-without-getting-made

  Investigator OPSEC — threat-model who might notice you, control your attribution surface across IP, ASN, browser and TLS fingerprint, timing and logged-in accounts, separate research identity from real identity, build and age a sockpuppet research persona, and choose between VPN, residential proxy and Tor. Use when setting up a research account, avoiding tipping off a subject, worrying about Link…

  skills/investigate-without-getting-made/SKILL.md on GitHub (opens in a new tab)

• is-this-photo-real

  Verify whether an image or video is authentic, original and correctly captioned — provenance checks, error level analysis, noise and JPEG compression analysis, clone and copy-move detection, lighting and shadow consistency, C2PA Content Credentials, deepfake and AI-generation tells, and the honest limits of AI-detector tools. Use when fact-checking a photo or video, checking for a deepfake or AI-…

  skills/is-this-photo-real/SKILL.md on GitHub (opens in a new tab)

• pattern-of-life-from-socials

  Deep-dive a subject's social media presence — profile metadata, follower and mutual network, content analysis, and posting-time pattern of life across Instagram, Facebook, X/Twitter, TikTok, LinkedIn, Reddit, Telegram and Discord. Use when profiling a social account, mapping someone's associates, inferring a subject's timezone or routine from their posts, or archiving a profile before it is delet…

  skills/pattern-of-life-from-socials/SKILL.md on GitHub (opens in a new tab)

• read-deleted-pages

  Recover deleted, edited or historical web content using the Wayback Machine and its CDX API, archive.today, Common Crawl and Memento/Timetravel. Use when a page is deleted, changed or 404s, checking what a site used to say, finding old team or staff pages, prior pricing, removed posts, pre-redaction wording or old contact details, enumerating every archived URL for a domain, or preserving evidenc…

  skills/read-deleted-pages/SKILL.md on GitHub (opens in a new tab)

• recon-a-domain-passively

  End-to-end passive reconnaissance for a domain, website or IP — builds an asset inventory covering registration, DNS, subdomains, infrastructure, tech stack, history and ownership without sending a single packet to the target. Use when asked to research or profile a domain or website, map what an organisation runs, or investigate a suspicious site without alerting its operator. Applies to vendor…

  skills/recon-a-domain-passively/SKILL.md on GitHub (opens in a new tab)

• secrets-in-file-metadata

  Extract and interpret embedded file metadata with exiftool — EXIF GPS coordinates, camera make, model and serial, DateTimeOriginal and CreateDate timestamps, XMP and IPTC fields, and Office and PDF properties such as Author, Company, LastModifiedBy, template paths and revision counts. Use when reading EXIF from a photo, checking who really wrote a document, dating a file, fingerprinting a camera…

  skills/secrets-in-file-metadata/SKILL.md on GitHub (opens in a new tab)

• secrets-in-git-history

  Mine GitHub, GitLab and git history for identities, infrastructure and leaked credentials using commit author emails, GitHub code search, the commit .patch endpoint, trufflehog, gitleaks, git log pickaxe and full-ref history scans. Use when investigating a developer or organisation on GitHub, finding leaked API keys, AWS keys or tokens in code, enumerating org members and their personal repos, or…

  skills/secrets-in-git-history/SKILL.md on GitHub (opens in a new tab)

• track-planes-and-ships

  Track aircraft and vessels from public ADS-B and AIS broadcasts using ADS-B Exchange, Flightradar24, FlightAware, MarineTraffic, VesselFinder and Equasis. Use when following a tail number or flight, looking up an ICAO 24-bit hex code, registration or callsign, tracing a ship by IMO number or MMSI, checking a flag of convenience or port-call history, finding who owns a private jet or vessel, or an…

  skills/track-planes-and-ships/SKILL.md on GitHub (opens in a new tab)

• useosint

  Entry point for open-source intelligence, investigation and verification work. Routes any identifier — a name, phone number, email address, username, domain, company, photo, crypto address, tail number or IMO — to the right investigation workflow, after setting an authorised scope. Use when asked to investigate, research, verify, vet, check out, look up, background-check, trace, attribute or find…

  skills/useosint/SKILL.md on GitHub (opens in a new tab)

• what-an-email-reveals

  Investigate an email address — MX and syntactic validation, Gravatar lookup, corporate email-format inference, breach exposure, and full mail-header analysis covering the Received chain, Message-ID and SPF, DKIM and DMARC results. Use for email OSINT, verifying whether an address exists, finding accounts registered to it, guessing a company's email format, or tracing where a suspicious message ac…

  skills/what-an-email-reveals/SKILL.md on GitHub (opens in a new tab)

• what-leaked-about-you

  Check and interpret data-breach exposure for an email, username, phone or name using Have I Been Pwned, the Pwned Passwords k-anonymity range API, DeHashed, IntelX and Snusbase. Use when checking breach or leak exposure, finding which services an account was registered with, interpreting a combolist or credential dump, assessing credential compromise, or auditing your own leaked personal data. Ap…

  skills/what-leaked-about-you/SKILL.md on GitHub (opens in a new tab)

• where-was-this-taken

  End-to-end workflow to establish where and when a photo or video was captured and whether it is authentic — evidentiary handling, metadata extraction, reverse image search for provenance, visual geolocation, chronolocation from shadows, and manipulation checks, ending in a location finding with a stated confidence radius. Use when asked to verify where an image was taken, confirm or refute a clai…

  skills/where-was-this-taken/SKILL.md on GitHub (opens in a new tab)

• who-owns-this-domain

  Establish who registered and who operates a domain using WHOIS, RDAP and DNS. Use when running a whois lookup, querying RDAP, digging A, AAAA, MX, NS, TXT, SOA or CAA records, reading SPF includes, DKIM selectors or DMARC rua addresses, finding the registrar, registrant or nameservers, doing reverse DNS, PTR, ASN or netblock lookups, or hunting historical WHOIS and passive DNS. Applies to phishin…

  skills/who-owns-this-domain/SKILL.md on GitHub (opens in a new tab)

• who-really-owns-it

  Research companies, directors, shareholders and ultimate beneficial ownership in official corporate registries, filings and offshore datasets — OpenCorporates, UK Companies House and the PSC register, SEC EDGAR, US Secretary of State registries, EU business registers, GLEIF LEI records, OpenOwnership, OpenSanctions and the ICIJ Offshore Leaks database. Use when asked who owns or controls a compan…

  skills/who-really-owns-it/SKILL.md on GitHub (opens in a new tab)

• whose-number-is-this

  Investigate a phone number — E.164 normalisation with libphonenumber, phoneinfoga scanning, carrier and line-type identification, VoIP and burner detection, messaging-app registration checks, and reverse-lookup and caller-ID sources. Use for phone OSINT and reverse phone lookup, "who owns this number", identifying a burner or VoIP number, or checking whether a number is registered on WhatsApp, Te…

  skills/whose-number-is-this/SKILL.md on GitHub (opens in a new tab)

• write-the-intel-brief

  Turn findings into a defensible intelligence product — BLUF key judgements, standardised estimative probability language, per-claim sourcing with timestamps and archived copies, separated observation, inference and assessment, documented negative findings and gaps, chain of custody and hashing, and redaction of uninvolved parties. Use when writing an intelligence report, due-diligence memo, evide…

  skills/write-the-intel-brief/SKILL.md on GitHub (opens in a new tab)

• x-ray-a-company

  Corporate due-diligence workflow — resolve a brand or website to its registered legal entity, map group structure and beneficial ownership, profile officers and directors, enumerate the digital estate, and screen litigation, insolvency, procurement, sanctions, PEP and adverse media. Use when asked to check out, vet or research a company, verify a supplier or counterparty before signing or paying,…

  skills/x-ray-a-company/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• Wazaby tw93 🥷 Engineering habits you already know, turned into skills AI assistants like Claude Code, Codex and Cursor can run. 7.3k stars · 8 skills
• appllama-skillsby Appllama A builder, not just a researcher. Agent skills that turn top-grossing app patterns into native-quality mobile screens. 2.9k stars · 2 skills
• FDEOpsby suboss87 Forward deployed engineering skills for AI coding agents. 965 stars · 30 skills
• ponytailby DietrichGebert Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote. 164k stars · 6 skills
• taste-skillby Leonxlnx Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages 97.3k stars · 13 skills
• archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more. 84.1k stars · 2 skills