⏳ This skill is pending AI review.
Scores will appear once the review pipeline completes.
exposure
Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers). Use when the user asks for an exposure check, security posture, email-spoofing or DMARC/SPF check, or "how exposed is this domain". No API key needed.
Choose how to use this skill
You do not need every option. Choose the path your AI client supports. The stable page stays the same; versioned files are immutable.
1. Native installer
This listing has no registered native installer command. Use the complete package or source fallback below, depending on what your client supports.
Do not guess an installer command or replace an existing version without reviewing the diff.
2. Complete package recommended
Download the ZIP when available. It includes SKILL.md plus the references, security notes and version metadata.
No complete ProSkills package is published for this listing yet.3. Prompt-only
Copy the prompt above when the agent can read the stable page or when you want to adopt the workflow without installing a skill.
Need only the instruction file?
Download SKILL.md only if your client requires a single file. The complete ZIP is safer for a full installation because it preserves the references and release context.
No path installs or executes anything by itself. Your agent still needs access to the project files. Before updating, compare the installed version and review the diff.
// RATINGS
Not yet listed on ClawHub or SkillsMP
// README
mcp-name: io.github.OpenOSINT/openosint
A real Claude Code session, nothing mocked: install the plugin and run a passive recon on example.com. Sharper MP4.
Quickstart
Needs uv. No API keys for the default flow.
Claude Code plugin (skills plus a passive MCP server):
/plugin marketplace add OpenOSINT/OpenOSINT
/plugin install openosint@openosint
/openosint:osint example.com
Any agent (Codex, Gemini CLI, Cursor and other Agent Skills clients):
npx skills add OpenOSINT/OpenOSINT
MCP server or pip (other clients):
claude mcp add openosint -- uvx --from openosint openosint-mcp
pip install openosint && openosint exposure example.com
OpenOSINT Cloud
The same engine as a hosted chat: ask about a domain, an IP address or a company. Every answer shows which public sources were checked, when, and a source on every claim. No install, no API keys.
What you can do
Real output, captured 2026-11-04 on v2.37.0 and trimmed. None of these commands needs an API key or an AI provider.
$ openosint exposure example.com
Grade: B Score: 88/100
Checks: email OK [passive] · registration OK [passive] · tls OK [touches target] · http_headers OK [touches target]
[LOW] DMARC has no aggregate report address (dmarc_no_rua)
[LOW] Strict-Transport-Security header missing (hsts_missing)
[INFO] Domain registered 31.2 years ago (domain_age)
$ openosint dns example.com
[DNS] NS: elliott.ns.cloudflare.com., hera.ns.cloudflare.com.
[DNS] SPF: v=spf1 -all
[DNS] DMARC: "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"
[DNS] DKIM not checked: selector probing is enumeration (needs --allow-active).
$ openosint rdap example.com
[+] Registrar: RESERVED-Internet Assigned Numbers Authority
[+] Registered: 1995-08-14T04:00:00Z
[+] Expires: 2027-08-13T04:00:00Z
[+] Name servers: elliott.ns.cloudflare.com, hera.ns.cloudflare.com
$ openosint ip 8.8.8.8
[+] Hostname: dns.google
[+] Org: AS15169 Google LLC
[+] City: Mountain View
$ openosint gdelt example.com
No geolocated coverage found for 'example.com'. Coverage: the last 15 min (...)
$ openosint gdelt ukraine
[+] White House, District Of Columbia, United States (38.8951, -77.0364) — 1 article(s)
The same commands are what the skill runs for an agent. All of them are in the CLI reference.
Why OpenOSINT
- Real tool executions. Tools are Python code; only their actual output reaches the model.
- Provenance. Every finding is shown with the tool call that produced it. AI summaries are leads to verify, not proof.
- Passive by default, with noise labels. Tools that touch the target or are noisy are not even offered to the agent until you opt in.
- Works with no keys.
exposure,dns,rdap,whois,ip,gdeltanddorksneed no account.
| Prompt-only OSINT skills | SpiderFoot | OpenOSINT | |
|---|---|---|---|
| What runs the lookups | Nothing: the skill is instructions, and the agent improvises | Its own 200+ modules | Python tools shipped with it |
| Breadth | Whatever the agent can reach | Much broader: 200+ modules and a correlation engine, per its README | A focused tool set |
| Built to be driven by an agent | Yes, that is the format | Web UI or CLI, per its README | Agent Skill, Claude Code plugin, MCP server, CLI and web UI |
| Passive/noisy labels, off by default | No | Not claimed here | Yes, per tool |
| License | Varies | MIT | MIT |
SpiderFoot is the better choice when you want a large standalone scanner. OpenOSINT is for agents that need a small set of real, labelled tools.
Tools
Level is the noise label: passive tools are on by default; anything else needs --allow-active. Per-tool docs: openosint.tech/tools.
| Tool | Source | Level | Key needed |
|---|---|---|---|
search_dns | dnspython (built-in) | passive | No |
search_rdap | RDAP (IANA bootstrap) | passive | No |
search_whois | python-whois | passive | No |
search_ip | ipinfo.io | passive | Optional |
search_ip2location | IP2Location API (sponsored) | passive | Required |
search_gdelt_geo | GDELT 15-minute GKG feed | passive | No |
generate_dorks | built-in | passive | No |
search_paste | psbdmp.ws | passive | No |
search_github | GitHub REST API | passive | Optional |
search_breach | HaveIBeenPwned API | passive | Required |
search_shodan | Shodan API | passive | Required |
search_censys | Censys API | passive | Required |
search_virustotal | VirusTotal API | passive | Required |
search_abuseipdb | AbuseIPDB v2 API | passive | Required |
search_dorks_live | Bright Data SERP API¹ | passive | Required |
search_footprint | Bright Data SERP API¹ | passive | Required |
scrape_url |
// HOW IT'S BUILT
// FILES
2 files shipped with this skill. Inline text is the catalog copy. The upstream link is the source repository.
skills/exposure/SKILL.md1.3 KB59a0b16de701upstream ↗
--- name: exposure description: Grade a domain's external exposure A-F with OpenOSINT (email authentication, TLS, domain registration, security headers). Use when the user asks for an exposure check, security posture, email-spoofing or DMARC/SPF check, or "how exposed is this domain". No API key needed. license: MIT compatibility: Needs uv (for `uvx`) and network access. argument-hint: "<domain>" --- # OpenOSINT: exposure report Domain: $ARGUMENTS (ask for one if empty). Only run this on domains the user owns or is authorized to assess. ```bash uvx --from openosint==2.38.0 openosint --json exposure DOMAIN ``` - The TLS and header checks connect to the domain on port 443. If the user wants no contact with the target, run `exposure DOMAIN --checks email,registration` instead (DNS and registry only; the result is not graded). - Optional: `--report PATH.html` writes a printable report; `--lookalikes` adds a DNS-only search for lookalike domains (not part of the grade). - Do not pass `--allow-active`. Report the grade, then each check's findings, each cited as `claim [exposure DOMAIN, <check>]`. The grade is a point-in-time summary, not a compliance result or a vulnerability scan. Findings are leads to verify, not proof. If the command fails or a check is skipped, say so; do not estimate a grade.README.mdupstream ↗
Contents are not inlined in the catalog. Open the upstream file.
Plain-text copy, no login: /skill-bundles/openosint-openosint-skills-exposure.md