What it does. Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-osint-with-spiderfoot, or copy the skill folder into ~/.claude/skills/performing-osint-with-spiderfoot/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-osint-with-spiderfoot/SKILL.md

SKILL.md (verbatim)

name: performing-osint-with-spiderfoot
description: Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.
domain: cybersecurity
subdomain: threat-intelligence
tags:
- osint
- spiderfoot
- reconnaissance
- threat-intelligence
- attack-surface
- target-profiling
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1591
- T1592
- T1593
- T1589
- T1595

Performing OSINT with SpiderFoot

Overview

SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.

When to Use

• When conducting security assessments that involve performing osint with spiderfoot
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
• Python 3.8+ with requests library
• SpiderFoot server running on default port 5001
• Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules

Steps

1. Connect to SpiderFoot REST API or use CLI interface
2. Create a new scan with target specification (domain, IP, email, name)
3. Select scan modules by use case (all, footprint, investigate, passive)
4. Monitor scan progress via API polling
5. Retrieve and parse scan results by data element type
6. Extract key findings: subdomains, IPs, emails, leaked credentials
7. Generate structured OSINT intelligence report

Expected Output

JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.

Other files in this skill

• LICENSE
• SKILL.es.md
• references/api-reference.md
• scripts/agent.py

SKILL.es.md (verbatim)

name: performing-osint-with-spiderfoot description: Automate OSINT collection using SpiderFoot REST API and CLI for target profiling, module-based reconnaissance, and structured result analysis across 200+ data sources domain: cybersecurity subdomain: threat-intelligence tags: [osint, spiderfoot, reconnaissance, threat-intelligence, attack-surface, target-profiling] version: "1.0" author: mahipal license: Apache-2.0 language: es

Recolección de OSINT con SpiderFoot

Descripción General

SpiderFoot es una herramienta de automatización OSINT de código abierto con más de 200 módulos que se integra con fuentes de datos para inteligencia de amenazas y mapeo de superficie de ataque. Esta skill utiliza la API REST de SpiderFoot y la CLI (sf.py/spiderfoot-cli) para crear y gestionar escaneos, seleccionar módulos por caso de uso (footprint, investigate, passive), analizar resultados estructurados para dominios, IPs, direcciones de correo, credenciales filtradas y registros DNS, y generar perfiles de inteligencia del objetivo.

Prerrequisitos

• SpiderFoot 4.0+ instalado o cuenta SpiderFoot HX en la nube
• Python 3.8+ con la librería requests
• Servidor SpiderFoot ejecutándose en el puerto predeterminado 5001
• Opcional: Claves API para módulos de VirusTotal, Shodan, HaveIBeenPwned

Pasos

1. Conectar a la API REST de SpiderFoot o utilizar la interfaz CLI
2. Crear un nuevo escaneo con especificación del objetivo (dominio, IP, correo, nombre)
3. Seleccionar módulos de escaneo por caso de uso (all, footprint, investigate, passive)
4. Monitorear el progreso del escaneo mediante polling de la API
5. Recuperar y analizar resultados del escaneo por tipo de elemento de datos
6. Extraer hallazgos clave: subdominios, IPs, correos, credenciales filtradas
7. Generar reporte estructurado de inteligencia OSINT

Resultado Esperado

Reporte JSON que contiene hallazgos OSINT organizados por tipo de dato (dominios, IPs, correos, credenciales, registros DNS), atribución de módulo fuente, y resumen del perfil del objetivo con indicadores de riesgo.

references/api-reference.md (verbatim)

SpiderFoot OSINT API Reference

REST API Endpoints

List Modules

GET /api/modules
Response: [{"name": "sfp_dnsresolve", "descr": "...", "group": "Footprint", "provides": [...]}]

Start Scan

POST /api/startscan
Content-Type: application/x-www-form-urlencoded

scanname=my-scan&scantarget=example.com&usecase=footprint
Response: {"scanid": "abc123"}

Check Scan Status

GET /api/scanstatus/{scan_id}
Response: {"status": "RUNNING"}  # RUNNING, FINISHED, ABORTED, ERROR-FAILED

Get Scan Results

GET /api/scanresults/{scan_id}
Response: [{"type": "INTERNET_NAME", "data": "sub.example.com", "module": "sfp_dnsresolve", "source": "example.com"}]

Delete Scan

GET /api/scandelete/{scan_id}

List Scans

GET /api/scanlist

Scan Use Cases

Data Element Types

CLI Usage (sf.py)

# Start scan via CLI
python sf.py -s example.com -t INTERNET_NAME,IP_ADDRESS -m sfp_dnsresolve,sfp_portscan_tcp

# Passive footprint
python sf.py -s example.com -u passive

# List modules
python sf.py -M

Agent CLI Usage

python agent.py --target example.com --use-case footprint --output report.json
python agent.py --target 203.0.113.5 --use-case investigate --timeout 1200
python agent.py --list-modules --server http://spiderfoot:5001

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.