v2.0.0 — Renamed, and actually deep

Every skill has a new name, and every skill has been rewritten.

Breaking: all 28 skills renamed

The old names were taxonomy labels. certificate-transparency only means something if you already know what certificate transparency is. The skills.sh listing shows nothing but the name, so the name was doing all the work and doing it badly.

The new names lead with the outcome but keep the searchable keyword inside, which makes them both more clickable and better for agent auto-invocation than the originals.

Old	New
osint-investigation	investigate-anything
person-osint	find-anyone
company-osint	x-ray-a-company
domain-osint	recon-a-domain-passively
username-osint	hunt-a-handle
email-osint	what-an-email-reveals
phone-osint	whose-number-is-this
geoint-photo	where-was-this-taken
social-media-osint	pattern-of-life-from-socials
osint-report	write-the-intel-brief
reverse-image-search	find-the-original-image
exif-metadata-analysis	secrets-in-file-metadata
whois-dns-recon	who-owns-this-domain
certificate-transparency	find-hidden-subdomains
wayback-archives	read-deleted-pages
google-dorking	google-like-a-spy
github-git-recon	secrets-in-git-history
chronolocation	geolocate-from-pixels
sockpuppet-opsec	investigate-without-getting-made
breach-data-analysis	what-leaked-about-you
crypto-blockchain-tracing	follow-the-crypto
flight-vessel-tracking	track-planes-and-ships
shodan-censys-recon	find-exposed-servers
paste-forum-monitoring	find-leaks-in-the-wild
media-verification	is-this-photo-real
people-search-engines	dig-through-data-brokers
corporate-registries	who-really-owns-it
link-analysis-graphing	graph-the-network

If you installed v1 by symlink, re-run ./install.sh — old symlinks under the previous names will linger otherwise.

Rewritten from outlines into actual skills

v1's skills were 37–69 lines: a paragraph of orientation, a few commands, a pivot list. Nothing wrong, but nothing a competent agent couldn't have guessed.

Every skill is now 200–250 lines and carries:

• a decision table for which source or tool to reach for, and the tradeoff
• how the source lies to you — the concrete failure modes, coverage gaps, and artefacts of how the tool works
• confidence grading tied to that technique's own evidence types
• a worked example that includes a dead end
• real commands, real output interpretation, and the legal or ToS line where one exists

Plus 52 reference/ files holding the lookup material: query cookbooks, a regional-indicator field guide for geolocation, a sun-position method sheet, registry catalogues by jurisdiction, address-format tables, DNS vendor fingerprints, an estimative-language reference.

New: the analytic tradecraft

v1 had techniques but no analysis. v2 adds source reliability grading, analysis of competing hypotheses, circular reporting, confirmation bias in its specifically-OSINT form, estimative probability language, and the discipline of separating observation from inference in a report.

Also

• Descriptions now carry the routing keywords the names used to, so auto-invocation still works
• CONTRIBUTING.md encodes the conventions: outcome-led naming, the length band, reference/ folders, mandatory failure-modes section
• Validator enforces length and checks that every reference link resolves

v1.0.0 — 28 OSINT skills

First release.

28 skills for open-source-intelligence work with AI coding agents.

• 10 investigation workflows you run by name: person, company, domain, username, email, phone, GEOINT photo, social media, a router, and a report compiler.
• 18 technique skills the agent triggers automatically: reverse image search, WHOIS/DNS, certificate transparency, wayback, google dorking, github recon, chronolocation, breach analysis, crypto tracing, flight/vessel tracking, shodan/censys, paste monitoring, media verification, people search, corporate registries, link analysis, and OPSEC.

Passive-first and ethics-gated — see ETHICS.md.

Install: git clone then ./install.sh, or npx skills@latest add useosint/osint-skills.