mcpField
P
performing-osint-with-spiderfoot

performing-osint-with-spiderfoot

github.com/mukul975Security35.2k111 installsUpdated 8w ago
Repository

About performing-osint-with-spiderfoot

A skill for using SpiderFoot to automate OSINT scans and turn results into structured target profiles. It is intended for security assessments, incident response, and scheduled audits, with workflows for scan setup, progress tracking, and result parsing.

Key features

  1. 01Create and manage SpiderFoot scans
  2. 02Choose modules by investigation type
  3. 03Track scan progress through the API
  4. 04Parse domains, IPs, emails, and DNS data
  5. 05Generate structured OSINT reports

Use cases

  1. 01Map an organization's external attack surface
  2. 02Investigate domains, IPs, or email addresses
  3. 03Review leaked credentials and DNS findings

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill performing-osint-with-spiderfoot

After installing, type/performing-osint-with-spiderfootin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
SKILL.es.md
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Performing OSINT with SpiderFoot

Overview

SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.

When to Use

  • When conducting security assessments that involve performing osint with spiderfoot
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
  • Python 3.8+ with requests library
  • SpiderFoot server running on default port 5001
  • Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules

Steps

  1. Connect to SpiderFoot REST API or use CLI interface
  2. Create a new scan with target specification (domain, IP, email, name)
  3. Select scan modules by use case (all, footprint, investigate, passive)
  4. Monitor scan progress via API polling
  5. Retrieve and parse scan results by data element type
  6. Extract key findings: subdomains, IPs, emails, leaked credentials
  7. Generate structured OSINT intelligence report

Expected Output

JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.

Comments

Markdown supported