Security audit
Security checks for vulnerabilities and agentic risk
This OSINT briefing skill uses disclosed public-intelligence sources and APIs, but users should treat target queries and scheduled monitoring as sensitive.
Install only if you are comfortable sending OSINT targets and search terms to third-party providers such as Tavily and Shodan, and only run it against assets or investigations you are authorized to research. Be careful with the optional cron examples because they create ongoing monitoring jobs and may forward reports outside your environment.
The skill is framed for 'any target' including companies, IPs, persons, and keywords, with examples such as competitor monitoring and threat-actor tracking, but without meaningful scope restrictions or exclusions. That makes it easy to use for invasive profiling, competitive surveillance, or collection on individuals without clear authorization boundaries.
The skill sends target identifiers and investigator queries to third-party services, but the documentation does not clearly disclose that this data leaves the local environment. Users may unknowingly expose sensitive investigation targets, internal watchlists, or customer names to Tavily and Shodan, creating privacy, confidentiality, and vendor-risk concerns.
This code posts search queries and the API key to Tavily, causing target-related intelligence requests to be transmitted off-platform. In an OSINT context this may be expected, but it is still security-relevant because investigation targets and search terms can be sensitive and may reveal monitoring activity.
def tavily_search(query: str, max_results: int = 5) -> list[dict]:
"""AI-optimized web search — returns full page content, not just snippets."""
r = requests.post(
"https://api.tavily.com/search",
json={
"api_key": os.environ["TAVILY_API_KEY"],
This code posts search queries and the API key to Tavily, causing target-related intelligence requests to be transmitted off-platform. In an OSINT context this may be expected, but it is still security-relevant because investigation targets and search terms can be sensitive and may reveal monitoring activity.
def tavily_search(query: str, max_results: int = 5) -> list[dict]:
"""AI-optimized web search — returns full page content, not just snippets."""
r = requests.post(
"https://api.tavily.com/search",
json={
"api_key": os.environ["TAVILY_API_KEY"],
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def tavily_search(query: str, max_results: int = 5) -> list[dict]:
"""AI-optimized web search — returns full page content, not just snippets."""
r = requests.post(
"https://api.tavily.com/search",
json={
"api_key": os.environ["TAVILY_API_KEY"],
"query": query,
The Shodan lookup sends a target IP or domain plus an API key to an external reconnaissance service, which can expose what assets are being investigated. For sensitive investigations, this may leak customer targets, incident-response focus areas, or internal interest in particular infrastructure.
return {"error": "SHODAN_API_KEY not set"}
try:
r = requests.get(
f"https://api.shodan.io/shodan/host/{ip_or_domain}",
params={"key": key},
timeout=10
)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Tavily free tier: 1,000 searches/month. Each run uses ~3–5 searches.
- Shodan free tier: limited to 1 result per query on some endpoints
- DNS recon requires `dig` installed: `sudo apt install dnsutils`
- WHOIS requires `whois` installed: `sudo apt install whois`
- For dark web mentions, pair with Tor proxy (Ahmia search via SOCKS5)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Tavily free tier: 1,000 searches/month. Each run uses ~3–5 searches.
- Shodan free tier: limited to 1 result per query on some endpoints
- DNS recon requires `dig` installed: `sudo apt install dnsutils`
- WHOIS requires `whois` installed: `sudo apt install whois`
- For dark web mentions, pair with Tor proxy (Ahmia search via SOCKS5)
The documentation expands the skill from ordinary web/DNS/WHOIS/Shodan OSINT into dark-web/Tor-assisted collection, which materially broadens the surveillance and legal-risk profile beyond the declared scope. Because this is presented as a simple note rather than a gated, high-risk capability with warnings and restrictions, it can enable misuse and increase operational and compliance risk.
No suspicious patterns detected.