skills.rest
ever-just
ever-justCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

programmatic-osint-sources

Catalogs keyless and free-tier OSINT APIs for enriching emails, domains, phones, and identities.

3|1|Updated Apr 8, 2026
Search Tags:#subdomain enumeration#threat intelligence#enrichment#osint#email lookup#api catalog#breach data
One-click install
npx skills add https://github.com/ever-just/agentskills --skill programmatic-osint-sources-ever-just
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: programmatic-osint-sources
Source: https://github.com/ever-just/agentskills/tree/main/skills/programmatic-osint-sources
Command: npx skills add https://github.com/ever-just/agentskills --skill programmatic-osint-sources-ever-just

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Turning a single identifier (email, domain, username, phone, company, or IP) into rich machine-readable intelligence usually requires knowing which of hundreds of OSINT sources accept programmatic queries, which need no API key, and what each endpoint actually returns. This Skill provides a verified catalog of those sources so an agent can script enrichment lookups instead of improvising web searches. ## Core Features & Use Cases - Keyless-first source catalog: Hundreds of endpoints tagged by auth level (keyless, free-key, free-tier, paid, shaky) with concrete curl examples and honest ToS/freshness caveats. - Nine category references: Breach exposure, infrastructure recon, developer identity, contact enrichment, public records, presence oracles, phone/messaging, market signals, and Claude connector/MCP alternatives. - Waterfall chaining guidance: Pre-built lookup chains such as company name to canonical domain to subdomains to contributor emails to verified contacts. - Use Case: Given a target company domain, pull subdomains from Cert Spotter, find developer emails via GitHub commits, verify them with Abstract, and enrich the people through Apollo or People Data Labs. ## Quick Start Ask the agent to enrich an email address or enumerate subdomains for a domain using the keyless OSINT sources in this catalog.

Frequently Asked Questions about programmatic-osint-sources

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if an email appeared in a data breach for free?▼

Use keyless breach APIs like XposedOrNot, Hudson Rock Cavalier, or LeakCheck's public endpoint with a single curl call. They return breach names, exposure categories, and risk scores without signup, while Have I Been Pwned requires a paid key for per-email lookups.

How to find subdomains of a domain using free APIs?▼

Query certificate transparency logs through Cert Spotter or crt.sh, which return de-duped subdomain lists from CT-logged certificates with no authentication. HackerTarget and Common Crawl's index offer additional keyless subdomain enumeration as fallbacks.

What free APIs reverse-lookup a person from an email address?▼

Enrich.so and People Data Labs offer free-key reverse email enrichment returning name, title, and employment history. Keyless options include GitHub commit search, Duolingo's users API, ORCID for researchers, and Wikidata for cross-linked identities.

Can I use these OSINT endpoints for bulk scraping?▼

No. Many keyless endpoints like Duolingo, X syndication, and LinkedIn Voyager are undocumented or explicitly forbid automation, carrying rate limits, account bans, or legal risk. They suit low-volume investigative pivots only, and each catalog entry flags its ToS constraints.

Why do some OSINT API lookups fail or return empty results?▼

Free tiers churn frequently: endpoints get retired, quotas shrink, and enterprise-skewed B2B databases miss small companies. The catalog tags degraded sources as shaky or dropped and recommends re-verifying endpoints and falling back to keyless recipes for small targets.

How do I get OSINT data through Claude connectors instead of curl?▼

The connectors reference maps each data category to available Claude connectors or MCP servers, prioritized by free, no-account, and low-lift options. Live-tested options include Lusha for contacts, Phoenix HG for firmographics, and Exa or Firecrawl for web data.

Related Skills

Explore More Data & Analytics Skills→
CodeAlive-AICodeAlive-AI
3

lead-enrichment

Enrich partial lead records into complete contact and company profiles.

Official
Intermediate
aimentor606aimentor606

account-research

Compile a research dossier on a company or individual before outreach.

Community
Intermediate
ozenalp22ozenalp22

webrecon

Coordinate six Chrome agents to audit website tech stacks, APIs, and SEO.

Community
Advanced
polymerdaopolymerdao
1

polymer-pay-stableenrich-apollo

Search and enrich people and organizations via the Polymer Pay proxy.

Official
Intermediate