---
name: osint-autopilot
description: End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generated findings, and a consolidated multi-tab .xlsx deliverable. Stops ONLY for Stage 6 (active exploitation) arming and out-of-scope sibling assets. Use whenever asked to "run OSINT / recon / attack-surface" on a target — do NOT deliver a thin passive first pass.
version: 1.0
sources: asm_reference_impl, community
triggers:
  - run OSINT
  - run recon
  - run the full recon pipeline
  - attack surface on
  - OSINT autopilot
  - full external recon
  - end to end recon
  - recon to completion
  - consolidated OSINT workbook
---

# OSINT Autopilot

Purpose: eliminate the "thin first pass, then user pushes for more" failure. When the user says *run OSINT/recon on `<domain>`* (authorized), execute the whole pipeline to completion and hand back the consolidated workbook — no stopping to ask except the two hard gates below.

Read the companion `osint-methodology` skill for the framework; this skill is the executable runbook. Feedback memory `osint-full-pipeline-default` governs the default.

## Hard gates (the ONLY reasons to stop and ask)

1. **Authorization** — if not already asserted, ask the one scope question, then proceed. (Here it's typically already signed.)
2. **Stage 6 (active exploitation)** — BOLA/IDOR, credential replay, injection confirmation. Never run under autopilot; present the ranked target queue and wait for arming.
3. **Out-of-scope siblings** — a newly-discovered sibling domain/brand (e.g. `<company>.io` when scope was `.com`). Flag; don't scan until confirmed.

Everything in Stages 1–5 runs without pausing for questions.

## Run sequence

Let `S = ~/.claude/skills/osint-autopilot/scripts`.

### 1. Deterministic recon (Stages 1–3 + harvest + breach + ports)

```
bash $S/recon_pipeline.sh <domain>
```

Creates `~/Research/engagements/<domain>/` and populates evidence (DNS/WHOIS/RDAP/email-sec, subdomain union via subfinder+certspotter+crt.sh, dig-resolve, HTTP probe, identity fabric, /version disclosure, S3 takeover check, gau+wayback+JS harvest, HudsonRock breach, bounded public-IP port scan), hashes everything, and splits responsive hosts into `buckets/bucket-NN`.

Host notes baked in: uses `dig`/`curl` (ProjectDiscovery `dnsx`/`httpx` segfault on this M1 — cgo m1cpu); nmap is time-capped at 10 min so it can't stall.

### 2. Multi-agent per-host fan-out (Stage 4 exposure)

Read `buckets/COUNT` and the `buckets/bucket-*` paths, then launch the workflow (`ffuf` must be on PATH — `go install github.com/ffuf/ffuf/v2@latest` if missing):

```
Workflow({ scriptPath: "<S>/host_enum.workflow.js",
  args: { domain:"<domain>", engDir:"~/Research/engagements/<domain>" (absolute),
          ffuf:"<gopath>/bin/ffuf", wordlist:"<S>/wordlist.txt",
          buckets:[ absolute bucket-00 … bucket-NN ] } })
```

**Pass `args` as a real JSON object, NOT a stringified one** — the harness hands `args` to the script verbatim; a string makes `args.domain`/`args.buckets` undefined and only the synthesize agent runs. The script fails loudly if args are malformed. `engDir` must be absolute. `buckets` = absolute paths of every `buckets/bucket-*` file (read `buckets/COUNT`).

It fans out ffuf content-discovery + JS/endpoint analysis per bucket (agentType general-purpose), then synthesizes a ranked BOLA/IDOR target queue. Save `synthesis` to `evidence/stage6-content/SYNTHESIS.md`.
Optional screenshots: `gowitness scan file -f <urls> --screenshot-path evidence/stage6-screens --write-db` (Chrome required).

### 3. Verify headlines yourself (do NOT trust agent output blindly)

Re-curl every CONFIRMED-worthy claim before reporting it: exposed secrets (fetch the JS/vars file), `/version` disclosures, Cognito/Auth0 config, any "unauth admin 200". Downgrade anything you can't reproduce.

### 4. Auto-findings + workbook

`build_xlsx.py` requires the `openpyxl` pip package (`pip install -r $S/requirements.txt` if missing).

```
python3 $S/findings_gen.py <domain>     # evidence -> findings/findings.csv (rules engine)
python3 $S/build_xlsx.py  <domain>      # findings.csv + evidence -> <domain>-osint-consolidated.xlsx
```

`findings_gen.py` encodes the rubric (non-prod exposure, CDN/WAF-bypass origins, internal-IP leak, DMARC/SPF, /version disclosure, JS secrets, S3 takeover, identity fabric, breach severity, WordPress, port exposure). Hand-add any nuanced findings the rules miss by editing `findings.csv`, then re-run `build_xlsx.py`.

### 5. Report

Give the consolidated `.xlsx` path + a short severity summary, then present the two open gates (Stage 6 queue + any out-of-scope siblings). Offer passive CVE mapping against disclosed versions as a next step.

## Deliverable

`~/Research/engagements/<domain>/`:

- `<domain>-osint-consolidated.xlsx` — 9–10 tabs (Summary, Findings, Subdomains, Live Hosts, API Endpoints, Secrets, Ports, Internal-IP-Leak, Screenshots)
- `findings/findings.csv` · `evidence/**` (+ `.sha256`) · `evidence/stage6-content/SYNTHESIS.md` · `run-log.jsonl`

## Time budget

Small org (<100 hosts): ~15–25 min wall-clock. Medium (100–1K): ~30–60 min, dominated by the fan-out workflow and gau harvest.

## Scale note

The fan-out is ~1 agent per 18 hosts. Keep total agents ≤15 (default guideline); for >270 responsive hosts, raise bucket size in `recon_pipeline.sh` (`split -l`) rather than agent count.