IdentityMonitoringAgent

An OSINT sentinel that monitors the public web for email exposure, username footprint, and identity leaks without API keys.

Security Scan

The skill's code and runtime instructions are coherent with its stated OSINT purpose: it calls holehe and sherlock and performs Google dork searches, and it does not request unrelated credentials or hidden endpoints.

Purpose & Capability

Name/description (email/username/identity monitoring) match the actual requirements: python3 plus the OSINT tools holehe and sherlock and a Google-search library are exactly what the skill needs.

Instruction Scope

SKILL.md and monitor.py instruct only to run holehe/sherlock and perform Google dork searches. The code does not read unrelated files, environment variables, or send results to any external endpoint beyond the standard network activity of the invoked tools and googlesearch.

Install Mechanism

There is no formal install spec (instruction-only). SKILL.md tells users to pip install holehe, sherlock-project, and googlesearch-python — expected for this functionality but this will install third-party packages on disk; verify those packages' provenance before installing.

Credentials

No environment variables, credentials, or config paths are requested. The skill does not attempt to access unrelated secrets or system config.

Persistence & Privilege

always is false and the skill does not request elevated or persistent platform privileges or modify other skills' configs. It runs on-demand and can be invoked by the agent as usual.

Assessment

This skill appears to do what it says: run holehe and sherlock and perform Google dorks to look for exposed emails/usernames. Before installing, consider: run it in an isolated environment (container/VM) because it will perform network scans and install third-party pip packages; review the holehe and sherlock projects for safety and licensing; avoid scanning targets you don't own or have permission to probe (legal/terms-of-service risk); be aware Google scraping may be rate-limited or flagged; the code invokes subprocesses based on user input (it uses list-form subprocess calls, which avoids shell interpolation, but still will perform network actions you trigger), so only provide targets you intend to scan. Finally, the skill's source/homepage is unknown — if you need stronger trust, obtain the upstream repository or a publisher with an audit trail before widespread use.

This agent acts as a digital investigator. It scans the public web and platform recovery flows to find where personal data might be exposed.

Setup

Install the necessary OSINT libraries in your LXC environment:

pip install holehe sherlock-project googlesearch-python

Local Testing

Before using the agent via the UI, verify the logic directly on your DGX Spark terminal:

Test Email Scanning

python3 monitor.py --tool scan_email --target [e-mail]

Test Username Tracking

python3 monitor.py --tool scan_username --target example_user

Test Web Dorking

python3 monitor.py --tool search_leaks --query "example_query"

Note: If registered_sites returns an empty list [], it indicates no hits were found on supported platforms or the service is temporarily rate-limited.

User Instructions

• "Check if the email [e-mail] is registered on any social platforms."
• "Find all social media accounts associated with the username 'example_user'."
• "Search the web for public mentions or leaks of the phone number 555-0123."

Tools

scan_email

Checks 120+ sites to see if an email is registered using forgotten password flows.

• Inputs: email (string)
• Call: python3 monitor.py --tool scan_email --target {{email}}

scan_username

Hunts for a specific username across 400+ social networks and platforms.

• Inputs: username (string)
• Call: python3 monitor.py --tool scan_username --target {{username}}

search_leaks

Uses advanced Google Dorks to find identifiers on leak sites, forums, and pastebins.

• Inputs: query (string)
• Call: python3 monitor.py --tool search_leaks --query "{{query}}"