OSINT Investigator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:02 AM UTC
• Version: 1.0.0

Overview

This OSINT skill is mostly transparent about its purpose, but it asks agents to collect sensitive personal information and credentials in ways that need careful review before installation.

Install only if you are comfortable with a Review-level OSINT tool. Avoid using it for private individuals without a clear lawful and ethical basis, do not paste real account passwords into chat, prefer separate low-privilege API tokens, review or disable PDF auto-installation, and validate targets before running any shell commands derived from user input.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:251

Finding

Plaintext Collection and Storage of Account Credentials and API Secrets

Content

View full analysis

/config/osint_config.json" os.makedirs(os.path.dirname(cfg_path), exist_ok=True) cfg = json.load(open(cfg_path)) if os.path.exists(cfg_path) else {"platforms": {}, "output": {}} # Example: save Twitter bearer token cfg["platforms"]["twitter"] = {"configured": True, "method": "api_key", "bearer_token": ""} # Example: enable PDF cfg["output"]["pdf_enabled"] = True cfg["output"]["pdf_output_dir"] = "~/Desktop" # Write back with open(cfg_path, "w") as f: json.dump(cfg, f, indent=2) os.chmod(cfg_path, 0o600) ``` ### Technical Analysis The Skill instructs the agent to request passwords and API keys directly through the conversation and then store them as plaintext JSON values. File mode `0600` reduces access by other local users, but it does not encrypt the secrets or prevent exposure through: - Conversation history and agent telemetry - Process compromise under the same user account - Backups or synchronization software - Accidental inclusion of the configuration in archives or support bundles - Later agent actions that read or disclose the file - Malware operating with the user's privileges The Skill supports storing passwords for Instagram, LinkedIn, and Facebook, even though collecting reusable account passwords is not a minimum-privilege requirement for public OSINT research. Recommending burner accounts reduces the consequence but does not correct the insecure secret-handling design. ### Attack Path 1. A user asks the Skill to configure a platform integration. 2. The Skill re ...[truncated 1088 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:319

Finding

API Keys Exposed Through URL Query Parameters

Content

View full analysis

?key=$SHODAN_KEY" curl -s "https://api.shodan.io/dns/resolve?hostnames=&key=$SHODAN_KEY" ``` ```bash curl -s "https://api.hunter.io/v2/domain-search?domain=&api_key=$HUNTER_KEY" curl -s "https://api.hunter.io/v2/email-verifier?email=&api_key=$HUNTER_KEY" ``` ```bash curl -s "https://maps.googleapis.com/maps/api/geocode/json?address=&key=$GMAPS_KEY" curl -s "https://maps.googleapis.com/maps/api/place/textsearch/json?query=&key=$GMAPS_KEY" curl -s "https://maps.googleapis.com/maps/api/streetview/metadata?location=&key=$GMAPS_KEY" ``` ### Technical Analysis The documented commands place API credentials directly in URL query parameters. Although HTTPS protects the request in transit, complete URLs may still be captured by: - API gateway and reverse-proxy logs - Provider access logs - Shell tracing or command auditing - Agent tool-call histories - Monitoring and observability systems - Error reports and debugging output - Process inspection on some operating systems This creates more opportunities for disclosure than header-based authentication. The risk is especially significant in an agent environment where generated commands and tool invocations may be retained for diagnostics. Some providers require query-parameter authentication. Where that is unavoidable, the Skill must explicitly treat the complete URL as sensitive and avoid exposing it in logs or reports. ### Attack Path 1. The Skill reads an API key from local configuration or an environment variable. 2. It constructs a URL containing the key as a query parameter. 3. The complete command or URL is recorded by agent telemetry, shell auditing, a proxy, or an API access log. 4. An attacker or unauthorized opera ...[truncated 497 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/generate_pdf.sh:8

Finding

Automatic Installation of an Unpinned Dependency Into the Host Python Environment

Content

View full analysis

/dev/null; then echo "📦 Installing fpdf2..." pip3 install fpdf2 -q --break-system-packages 2>/dev/null \ || pip3 install fpdf2 -q \ || pip3 install fpdf2 -q --user fi ``` ### Technical Analysis The PDF wrapper automatically installs the latest available `fpdf2` release when the `fpdf` import is missing. No exact version, package hash, trusted index configuration, lock file, or isolated environment is used. The first installation attempt uses `--break-system-packages`, which can modify a Python environment managed by the operating system. This exceeds the minimum privileges needed for optional PDF generation and may overwrite or conflict with system-managed dependencies. Package installation is a code-execution operation because Python packages may execute build backends or installation hooks. The effective code installed can change after the Skill has been reviewed. This is a supply-chain weakness rather than evidence that the current `fpdf2` package is malicious. ### Attack Path 1. A user enables or invokes PDF report generation on a host without an importable `fpdf` module. 2. The wrapper automatically connects to the configured Python package index. 3. `pip3` resolves an unpinned package version and its transitive dependencies. 4. A compromised index, dependency account, malicious mirror, configuration override, or future compromised release supplies attacker-controlled code. 5. Package build or installation logic executes with the privileges of the user running the Skill. 6. The package is subsequently imported by `generate_pdf.py`, providing another code-execution opportunity. ### Impact Assessment Malicious dependency code would run with the full privileges of the Skill process. I ...[truncated 495 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/social-platforms.md:96

Finding

Command Injection Risk From Unvalidated Target Substitution in Shell Commands

Content

View full analysis

/events/public | python3 -c " import sys, json for e in json.load(sys.stdin): p = e.get('payload', {}) for c in p.get('commits', []): a = c.get('author', {}) if a.get('email') and 'noreply' not in a['email']: print(a['name'], '-', a['email']) " 2>/dev/null | sort -u ``` Other documented substitution patterns include: ```bash whois dig ANY dig MX dig TXT nslookup host ``` ```bash curl -s https://ipinfo.io//json curl -s https://ip-api.com/json/ ``` ### Technical Analysis Investigation targets originate from user input, but the Skill does not require syntactic validation or safe argument handling before inserting them into shell commands. The GitHub command is particularly exposed because the URL is not quoted. If an agent replaces `` with text containing shell separators, redirection operators, command substitutions, or pipeline operators, the shell can interpret that text as syntax instead of URL data. Double-quoting other generated URLs is not a complete solution if substitutions preserve constructs such as `$(command)`. The robust design is to avoid generating shell command strings from user-controlled values and to invoke commands through structured argument arrays. The static warning describing the GitHub command as `curl | bash` is inaccurate. The response is piped into fixed Python JSON parsing code, not into a shell. Remote GitHub JSON is therefore not directly executed. The confirmed concern is unsafe interpolation of the user-provided handle into the shell command. ### Attack Path 1. An attacker requests investigation of a ...[truncated 1484 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims an operational OSINT investigation capability: researching people, domains, IPs, images, and other targets across multiple open sources and producing an intelligence report. However, this code only converts structured markdown into a formatted PDF using fpdf. It loads local config, parses markdown sections, infers confidence labels, optionally includes source URLs already present in the input, and writes a PDF to disk. There is no code for querying external services, gathering intelligence, performing lookups, or analyzing live public data. This is a materially different primary purpose, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a tool for conducting multi-source OSINT investigations across web search, social media, DNS/WHOIS, maps, public records, and similar sources. The actual code shown does none of that. It only ensures a PDF library is installed and runs another script, presumably to generate a PDF report. While PDF generation could be a supporting component of a larger OSINT tool, this specific code chunk’s primary behavior is report-generation setup, not open-source intelligence gathering or analysis. That is a materially different purpose from the declared description, so this chunk is a mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are extremely broad and include common requests like 'who is', 'look up', and 'investigate', which raises the chance of over-activation on ordinary conversations. In a skill that gathers sensitive personal and technical intelligence, accidental invocation can cause unnecessary data collection, privacy harm, or risky tool use without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is designed to collect highly sensitive personal information across many sources, but the opening description lacks strong up-front warnings about privacy, stalking, harassment, or doxxing risks. Because the skill context is large-scale intelligence gathering on people, missing front-loaded safeguards makes misuse materially more dangerous.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill claims to rely on public information but explicitly instructs the agent to collect and use platform credentials and paid API keys, including access behind login walls. This expands the skill from passive public-source research into authenticated scraping and secret handling, creating privacy, account-security, and compliance risks if credentials are mishandled or if protected content is accessed.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs the agent to solicit credentials conversationally and persist them to disk. This is dangerous because it normalizes plaintext secret collection in an untrusted interaction channel and creates durable sensitive artifacts that may be exfiltrated, reused, or accidentally disclosed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation presents a restrictive ethical boundary of using only public data, but elsewhere authorizes use of credentials to access content behind login walls. This contradiction can mislead operators into believing the workflow is low-risk while enabling behavior with greater privacy, legal, and account-security implications.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is a broad playbook for aggregating personal data, identity signals, and location clues across many platforms without authentication or contextual safeguards. In aggregate, this supports scalable profiling and deanonymization of individuals, substantially raising abuse potential beyond ordinary reference material.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document presents a structured reconnaissance flow that escalates from basic platform lookup to identity correlation, email harvesting, and photo-based geolocation. That stepwise narrative lowers the barrier for misuse and turns disparate public sources into an actionable targeting workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The image section gives operational instructions for reverse image search, EXIF extraction, and visual geolocation without warning about deanonymization or physical-safety risks. Those steps can directly enable identification of a person's whereabouts or residence from photos, which is especially dangerous in an investigative workflow.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

## Configuration & Authentication

Config is stored at: `<skill_dir>/config/osint_config.json` (chmod 600, auto-created on first save).

The agent configures everything **conversationally** — no terminal script needed. When the user says they want to add credentials, configure PDF output, or set up an API key, follow the flow below.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.

md

## Configuration & Authentication

Config is stored at: `<skill_dir>/config/osint_config.json` (chmod 600, auto-created on first save).

The agent configures everything **conversationally** — no terminal script needed. When the user says they want to add credentials, configure PDF output, or set up an API key, follow the flow below.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The configuration flow asks users to paste API keys and passwords directly into chat and then stores them locally, with only limited warning that passwords will be stored. Secrets shared in chat may be logged, inspected, or retained by surrounding systems, making this an unsafe secret-handling pattern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to write a persistent local config file containing secrets gathered conversationally. Persistent secret storage is not necessary for basic OSINT reporting and increases the blast radius of compromise by leaving API keys and passwords on disk where other tools, users, or later runs may access them.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

Then use it:

curl -s -H "Authorization: Bearer $BEARER"
"https://api.twitter.com/2/users/by/username/?user.fields=description,location,created_at,public_metrics"

text

### Twitter/X API v2 (when configured)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

Then use it:

curl -s -H "Authorization: Bearer $BEARER"
"https://api.twitter.com/2/users/by/username/?user.fields=description,location,created_at,public_metrics"

text

### Twitter/X API v2 (when configured)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

Then use it:

curl -s -H "Authorization: Bearer $BEARER"
"https://api.twitter.com/2/users/by/username/?user.fields=description,location,created_at,public_metrics"

text

### Twitter/X API v2 (when configured)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.

Then use it:

curl -s -H "Authorization: Bearer $BEARER"
"https://api.twitter.com/2/users/by/username/?user.fields=description,location,created_at,public_metrics"

text

### Twitter/X API v2 (when configured)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

Shodan API (when configured)

bash

curl -s "https://api.shodan.io/shodan/host/<ip>?key=$SHODAN_KEY"
curl -s "https://api.shodan.io/dns/resolve?hostnames=<domain>&key=$SHODAN_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

Shodan API (when configured)

bash

curl -s "https://api.shodan.io/shodan/host/<ip>?key=$SHODAN_KEY"
curl -s "https://api.shodan.io/dns/resolve?hostnames=<domain>&key=$SHODAN_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

Hunter.io API (when configured)

bash

curl -s "https://api.hunter.io/v2/domain-search?domain=<domain>&api_key=$HUNTER_KEY"
curl -s "https://api.hunter.io/v2/email-verifier?email=<email>&api_key=$HUNTER_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

Hunter.io API (when configured)

bash

curl -s "https://api.hunter.io/v2/domain-search?domain=<domain>&api_key=$HUNTER_KEY"
curl -s "https://api.hunter.io/v2/email-verifier?email=<email>&api_key=$HUNTER_KEY"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill includes self-installation behavior for PDF generation via pip, which is unrelated to core OSINT collection and expands the execution surface. Automatic package installation can introduce supply-chain risk, network egress, and unexpected code execution on the host environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 78% confidence

Finding

The line acknowledges investigations of private individuals without consent and only says to 'flag this before proceeding,' which leaves room for the agent to continue harmful surveillance-like activity after recognition. In an OSINT context focused on persons, weak gating around non-consensual targeting increases misuse risk substantially.

Content

Scanner excerpt · SKILL.md (reported line 389)May include surrounding context.

md

- Only use **publicly available** data — never attempt to access private systems
- Do not aggregate data in ways designed to facilitate stalking or harassment
- Respect robots.txt in spirit; use cached/archive versions where direct scraping is blocked
- If the target is clearly a private individual being investigated without consent, flag this before proceeding
- Instagram/LinkedIn/Facebook credentials: always recommend a burner/alt account — never the user's personal accounts

## Reference Files

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly instructs collection of sensitive personal data, behavioral indicators, and location clues from public profiles without any privacy, consent, or misuse guardrails. In an OSINT skill, omission of restrictions materially increases the chance of stalking, doxxing, or non-consensual profiling even if the data is technically public.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.