OSINT Investigator

Deep OSINT (Open Source Intelligence) investigations. Use when the user wants to research, find, or investigate any person, place, organisation, username, do...

This skill appears to do what it says (wide-ranging OSINT), but several inconsistencies raise red flags: it expects system tools (whois, dig, exiftool, curl) and multiple API keys but declares none; and its included PDF script will pip-install a package at runtime. Before installing or enabling it: 1) Ask the author for an explicit manifest of required binaries and environment variables (API keys) and why each is needed. 2) If you must run it, do so in a sandboxed environment with restricted network access and no sensitive credentials present. 3) Review the generate_pdf.py script and consider removing or pinning the pip-auto-install behavior (or preinstall fpdf2 in a controlled way). 4) Consider limiting or disabling autonomous invocation until you confirm the exact external services it will call and the credentials it will use. 5) Ensure you have legal authority to perform OSINT on the intended targets and avoid collecting or retaining data you shouldn't.

Type: OpenClaw Skill Name: osint-investigator Version: 1.0.0 The skill is classified as suspicious due to several high-risk capabilities and potential vulnerabilities, despite its stated benign purpose of OSINT. Key indicators include the extensive use of shell commands (`whois`, `dig`, `curl`, `exiftool`) in `SKILL.md` which, if user input is not properly sanitized by the agent, could lead to shell injection and arbitrary command execution. Additionally, the `scripts/generate_pdf.sh` script attempts to install `fpdf2` using `pip3 install --break-system-packages`, a powerful command that modifies the system Python environment and could be abused if the package name were manipulated. The skill also stores sensitive API keys and user credentials (including passwords for social media platforms) in `config/osint_config.json`, which, while protected by `chmod 600`, still represents a local data exposure risk. There is no evidence of intentional malicious behavior, but these capabilities and vulnerabilities pose significant security risks.