opencode-skills-collection 4.1.15 → 4.1.16

package/bundled-skills/offensive-osint/references/severity-matrix.md

@@ -0,0 +1,112 @@
+# Severity Decision Matrix
+
+> **AAS adaptation:** Read the authorization gate in [the skill](../SKILL.md) before any target request, credential use, or data collection. These are reference examples, not an instruction to run a sweep. Select only explicitly approved targets and techniques; set request, time, byte and concurrency limits and stop on errors or scope changes. Preserve TLS verification. Treat discoveries, pattern matches and historical provider claims as leads, not verified ownership, permission or severity. Minimize personal data and redact credentials before reports; do not send private evidence to public services. Prices, quotas, API shapes and tool availability require current official documentation. Changes and original source hashes are recorded in [the notice](../UPSTREAM-NOTICE.md).
+
+
+> Reference content for the `offensive-osint` skill. Originally §40 of the monolithic SKILL.md (refactored 2026-05-02 for size/load efficiency).
+
+## 40. Severity Decision Matrix — Worked Examples
+
+These upstream examples are historical triage prompts, not measured AAS findings. Assess intended exposure, authentication, exact affected version, data sensitivity and demonstrable impact first. No testing has been performed by this document. A port, login page, public function, schema, source map, CORS/header setting, mobile manifest flag, CVE association or breach count alone does not establish a vulnerability or its severity.
+
+In the table, severity labels are possible impact ceilings if the described harmful capability is actually demonstrated on an approved fixture; they are not default severities for discovery. Rows corrected to “Review lead” require evidence before severity can be assigned.
+
+| Finding | Severity | Why |
+|---|---|---|
+| `/.git/config` reachable on prod webapp | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| `/.env` reachable on prod webapp | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Open Firebase RTDB returning data | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Listable S3 bucket containing PII | **CRITICAL** | Direct data exfil. |
+| Listable S3 bucket containing logs only | HIGH | Internal hostnames + paths in logs; pivot data. |
+| Spring Boot `/actuator/env` exposed | **CRITICAL** | DB creds, JWT secrets, cloud keys in env. |
+| Spring Boot `/actuator/heapdump` exposed | **CRITICAL** | Heap contains live secrets in string form. |
+| Open Elasticsearch (`/_cat/indices` returns) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Open MongoDB (no auth) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Open Redis (no AUTH) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Open Docker API (port 2375) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Public PMAK validated live with broad scope | **CRITICAL** | Full Postman account + all team workspaces. |
+| Public AWS root access key validated live | **CRITICAL** | Full account compromise. |
+| Live AWS IAM-user key found on GitHub | HIGH | Limited scope (depends on IAM policy); often elevatable. |
+| Live GitHub PAT found in JS bundle | HIGH | Repo write access (depends on scope). |
+| Live Slack token in pastebin | HIGH | Workspace data + history; sometimes channel post. |
+| Sourcemap (`.js.map`) accessible on prod | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Open GraphQL introspection on prod | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Subdomain takeover possible (Heroku / GitHub Pages / etc.) | HIGH | Takeover → phishing on trusted domain. |
+| Reflected CORS with credentials on `/api/billing` | HIGH | CSRF-via-CORS for billing data. |
+| Verb tampering: DELETE allowed on documented-GET-only endpoint | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| `phpinfo.php` reachable on prod | HIGH | Discloses paths, env vars, modules → vuln-version pivot. |
+| Tomcat `/manager/html` reachable | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Jenkins script console accessible | HIGH | Groovy script execution = RCE. |
+| Missing HSTS on `/login` | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Missing HSTS on standard pages | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Missing CSP | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Internal IP / K8s service DNS in JS | MEDIUM | Internal topology disclosure. |
+| Apache `/server-status` reachable | MEDIUM | Live request visibility. |
+| `android:debuggable=true` on prod app | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| `android:allowBackup=true` (no whitelist) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| `android:usesCleartextTraffic=true` | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Sensitive deep-link handler (`myapp://reset-password`) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Exported Android component without permission | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Slack webhook URL leaked | MEDIUM | Send to channel; can be used for social-eng. |
+| Twilio Account SID leaked (no auth token) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Wildcard CORS on data-returning API | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Missing `X-Frame-Options` | LOW | Clickjacking. |
+| `.DS_Store` exposed | LOW | Directory listing of dev's machine. |
+| Stripe **test** key leaked | LOW | No real money risk. |
+| Firebase URL exposed (no open RTDB) | LOW | Project-ID disclosure only. |
+| Cert pinning missing in mobile app | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Outdated WordPress install detected | LOW | Pending CVE confirmation. |
+| Missing `Referrer-Policy` / `Permissions-Policy` | INFO | Hardening, not an exposure. |
+| `/.well-known/security.txt` discovered | INFO | Useful contact info only. |
+| Domain in breach with 0 named accounts | INFO | Contextual only. |
+| Private bucket exists (HEAD 403) | INFO | Asset only, no finding. |
+| Open kubelet on 10250 | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Open etcd on 2379 | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| K8s API on 6443 with anonymous-auth | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| K8s dashboard exposed without auth | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Helm Tiller (Helm 2) on 44134 | HIGH | Cluster-admin scope. |
+| Citrix Netscaler with KEV CVE | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| F5 BIG-IP TMUI accessible | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Pulse Secure with CVE-2024-21887 | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| FortiGate with CVE-2024-21762 | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| PaloAlto GlobalProtect with CVE-2024-3400 | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| VMware vCenter with CVE-2021-21972 | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| VMware ESXi exposed without VPN | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| MS Exchange with ProxyShell/Logon/NotShell unpatched | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| AWS Lambda Function URL accessible anonymously | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Public Cloud Run / Cloud Function unauthenticated | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Public Docker registry (anonymous catalog) | MEDIUM | Image enum + secret hunt in layers. |
+| GitHub Actions secrets echoed in workflow logs | HIGH | Secret-in-log = full secret disclosure. |
+| GitHub Actions `pull_request_target` checkout of fork code | HIGH | Class of bug; secrets accessible to attacker PRs. |
+| GitLab self-hosted with CVE-2021-22205 | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Jenkins with `pull_request_target`-equivalent misconfig | HIGH | Build secrets accessible to PRs. |
+| Public Notion page with internal SOPs | MEDIUM | Operational intel; sometimes credentials. |
+| Public Trello board with credentials in cards | HIGH | Often plaintext API keys. |
+| Public Confluence space with onboarding docs | MEDIUM | Seed creds + tech-stack reveal. |
+| Public Miro board with architecture diagrams | LOW | Internal-host disclosure. |
+| DMARC policy `p=none` on production sending domain | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| SPF `~all` (softfail) without strict DMARC | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| MX server allows open relay (test with 250 OK to RCPT TO foreign domain) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Live Anthropic / OpenAI API key with broad scope | Context-dependent | Owner-confirmed spending/data permissions; model access alone does not expose past responses. |
+| Live npm token with `publish` scope | **CRITICAL** | Supply-chain compromise of all maintained packages. |
+| Live PyPI / Docker Hub / GHCR token with publish scope | **CRITICAL** | Supply-chain compromise. |
+| Atlassian token with admin scope | HIGH | Workspace-wide read; sometimes write. |
+| Subdomain takeover candidate confirmed | HIGH | Trusted-domain phishing surface. |
+| Sensitive CI/CD wordlist hits (Jenkinsfile, .gitlab-ci.yml on public repo) | MEDIUM | Build-script intel; often references secret names. |
+| Public Postman workspace with internal API endpoints | MEDIUM | API attack surface mapped. |
+| WAF/CDN trivially bypassable (origin discoverable via §16.15) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| TLS 1.0/1.1 supported on prod | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| RC4 / 3DES cipher accepted | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Cert about to expire (<30 days) | LOW | Operational risk; not exploitable. |
+| Self-signed cert on prod | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Heartbleed (CVE-2014-0160) detected | **CRITICAL** | Memory disclosure including session tokens + keys. |
+| Public Slack invite link discoverable | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Vendor / supplier / e-procurement portal publicly exposed + breach corpus shows vendor accounts compromised | **HIGH** | Vendor impersonation + procurement fraud (BEC vector); regulatory exposure if PII/payment data flows. |
+| Job-application / careers portal collects PII over plain HTTP (no TLS) | **HIGH** | Cleartext PII at scale; regulatory exposure under GDPR / CCPA / India DPDP Act / LGPD. |
+| Decommissioned legacy mail (NXDOMAIN today) + breach corpus has historical employee URLs against it + cloud SSO migration confirmed via autodiscover IPs | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Public-facing intranet (`intranet.<domain>` resolves and returns content without VPN) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| Staging / preprod / UAT / sandbox subdomain publicly resolvable | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+| `vpn.<domain>` resolves but vendor + version unknown (passive only) | INFO | Attack surface flag only; escalate to HIGH-CRITICAL after active fingerprint matches a KEV CVE (§16.16). |
+| DMARC RUA points to a third-party reporting vendor (kdmarc / dmarcian / Valimail / Agari / EasyDMARC) | Review lead | Confirm intended access, affected version/configuration and actual impact; discovery alone is insufficient. |
+
+---

package/bundled-skills/offensive-osint/references/specialized-osint.md

@@ -0,0 +1,204 @@
+# Threat Intel, Crypto, Media, Geo, Regional, Telegram OSINT
+
+> **AAS adaptation:** Read the authorization gate in [the skill](../SKILL.md) before any target request, credential use, or data collection. These are reference examples, not an instruction to run a sweep. Select only explicitly approved targets and techniques; set request, time, byte and concurrency limits and stop on errors or scope changes. Preserve TLS verification. Treat discoveries, pattern matches and historical provider claims as leads, not verified ownership, permission or severity. Minimize personal data and redact credentials before reports; do not send private evidence to public services. Prices, quotas, API shapes and tool availability require current official documentation. Changes and original source hashes are recorded in [the notice](../UPSTREAM-NOTICE.md).
+
+
+> Reference content for the `offensive-osint` skill. Originally §29 + §30 + §31 + §32 + §37 + §38 of the monolithic SKILL.md (refactored 2026-05-02 for size/load efficiency).
+
+## 29. Threat Intel & IOCs
+
+- Vendor / CERT advisories: CISA/NSA/CSA joint advisories, CERT-EU, NCSC-UK, JPCERT/CC, CERT-UA.
+- [MISP Project](https://www.misp-project.org/) and public MISP feeds.
+- [OpenCTI](https://www.opencti.io/) — CTI knowledge graph.
+- [Malpedia](https://malpedia.caad.fkie.fraunhofer.de/) — malware families, YARA, references.
+- [ThreatFox](https://threatfox.abuse.ch/), [URLHaus](https://urlhaus.abuse.ch/), [SSLBL](https://sslbl.abuse.ch/).
+- [MalwareBazaar](https://bazaar.abuse.ch/) — hash-based sample sharing.
+- [PhishTank](https://www.phishtank.com/), [OpenPhish](https://openphish.com/).
+
+### 29.1 Malware Analysis & Sandboxes
+
+- Static: [pefile](https://github.com/erocarrera/pefile), [FLOSS](https://github.com/mandiant/flare-floss), [capa](https://github.com/mandiant/capa).
+- Similarity: SSDEEP, TLSH.
+- Sandboxes: [ANY.RUN](https://any.run/), [Hybrid Analysis](https://www.hybrid-analysis.com/), [CAPE](https://capesandbox.com/), [Tria.ge](https://tria.ge/).
+- Intelligence: [Intezer](https://analyze.intezer.com/) (code reuse), [VirusTotal](https://www.virustotal.com/) — **caution: verify the selected product’s sharing and retention mode; never upload private samples without explicit approval**.
+- TLS: [JA3](https://github.com/salesforce/ja3), [JA4](https://github.com/FingerprinTLS/ja4).
+
+### 29.2 Vulnerability Prioritization Data Sources
+
+Methodology in companion skill §28. Concrete data sources here.
+
+| Source | URL | What it tells you |
+|---|---|---|
+| **NVD** | `https://nvd.nist.gov/vuln/search` (or API `services.nvd.nist.gov/rest/json/cves/2.0`) | Base CVE catalog with CVSS v2/v3 scores. |
+| **EPSS** | `https://www.first.org/epss/` (CSV at `https://epss.cyentia.com/epss_scores-current.csv.gz`) | 0.0-1.0 probability of exploit in next 30 days. Updated daily. |
+| **CISA KEV** | `https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json` | CVEs proven exploited in the wild + federal-agency due-by dates. |
+| **ExploitDB** | `https://www.exploit-db.com/`; offline DB via `searchsploit` | POC code presence (Metasploit, Python, shell). |
+| **Metasploit module catalog** | `https://www.rapid7.com/db/modules/` (or `msfconsole > search cve:CVE-2024-XXXX`) | Automation availability. |
+| **InTheWild.io** | `https://inthewild.io/` | Community-curated "actively exploited" tracker. |
+| **OpenCVE** | `https://www.opencve.io/` | Timeline + watchlist + alerts. |
+| **Trickest CVE → POC mapping** | `https://github.com/trickest/cve` | Auto-generated CVE → public POC repo links. |
+| **GitHub Security Advisories** | `https://github.com/advisories` | Per-language / per-ecosystem advisories. |
+| **MITRE CVE List** | `https://cve.mitre.org/cve/` | Official CVE registry. |
+| **VulnDB** | `https://vulndb.cyberriskanalytics.com/` | Paid; commercial enrichment. |
+| **OSV.dev** | `https://osv.dev/` | Open-source vulnerability DB; JSON API. |
+| **Vulncheck KEV** | `https://vulncheck.com/kev` | Expanded KEV feed (more than CISA). |
+| **Tenable Research** | `https://www.tenable.com/research` | Tenable's CVE detail enrichment. |
+| **Qualys ThreatPROTECT** | `https://threatprotect.qualys.com/` | Qualys' threat-context enrichment. |
+
+**Workflow:**
+```bash
+# 1. Get EPSS score for a CVE
+curl -sS -m 15 "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'
+
+# 2. Check if in CISA KEV
+curl -sS -m 15 https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
+  jq '.vulnerabilities[] | select(.cveID == "CVE-2024-3400")'
+
+# 3. Check ExploitDB
+searchsploit cve 2024-3400
+
+# 4. Check Metasploit
+msfconsole -q -x "search cve:2024-3400; exit"
+```
+
+**Bulk prioritization** (given a Nuclei scan output with N CVEs):
+```bash
+# Extract CVEs from nuclei JSON output
+jq -r '.info.classification["cve-id"][]?' nuclei-results.json | sort -u > cves.txt
+
+# Annotate each with EPSS + KEV
+while IFS= read -r CVE; do
+  EPSS=$(curl -sS -m 15 "https://api.first.org/data/v1/epss?cve=$CVE" | jq -r '.data[0].epss // "N/A"')
+  KEV=$(curl -sS -m 15 https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
+    jq --arg c "$CVE" '.vulnerabilities[] | select(.cveID == $c) | .vulnerabilityName // empty')
+  KEV_FLAG=$([ -n "$KEV" ] && echo "KEV" || echo "")
+  echo "$CVE | EPSS:$EPSS | $KEV_FLAG"
+done < cves.txt | sort -t: -k2 -nr
+```
+
+The example is a small, bounded illustration; for a larger approved list, fetch KEV once, validate CVE identifiers and obey EPSS provider limits instead of downloading KEV per row. Matching a CVE requires affected-version and prerequisite confirmation.
+
+---
+
+## 30. Cryptocurrency OSINT
+
+### 30.1 Blockchain Explorers
+
+| Chain | Explorer |
+|-------|---------|
+| Bitcoin | [Blockchain.com](https://www.blockchain.com/explorer), [Blockchair](https://blockchair.com/) |
+| Ethereum | [Etherscan](https://etherscan.io/) |
+| BNB Chain | [BSCScan](https://bscscan.com/) |
+| Polygon PoS | [PolygonScan](https://polygonscan.com/) |
+| Solana | [Solscan](https://solscan.io/) |
+| Multi-chain | [OKLink](https://www.oklink.com/) (freemium), [Cielo](https://cielo.io/) |
+
+### 30.2 L2 / Rollup Explorers
+
+| L2 | Explorer | Notes |
+|---|---|---|
+| Arbitrum | [Arbiscan](https://arbiscan.io/) | Optimistic rollup; 7-day challenge window. |
+| Optimism | [Optimistic Etherscan](https://optimistic.etherscan.io/) | Optimistic rollup; 7-day challenge window. |
+| Base | [BaseScan](https://basescan.org/) | OP Stack. |
+| Blast | [Blastscan](https://blastscan.io/) | OP Stack derivative. |
+| Scroll | [Scrollscan](https://scrollscan.com/) | zkEVM. |
+| zkSync Era | [zkSync Era Block Explorer](https://explorer.zksync.io/) | zkRollup; faster finality. |
+| Polygon zkEVM | [PolygonScan zkEVM](https://zkevm.polygonscan.com/) | zkEVM. |
+| StarkNet | [Voyager](https://voyager.online/), [StarkScan](https://starkscan.co/) | Cairo VM; different address derivation. |
+| Cross-L2 | [L2Beat](https://l2beat.com/) | Risk framework + TVL comparison. |
+
+### 30.3 Transaction Tracking & Analytics
+
+- [Arkham](https://www.arkhamintelligence.com/) — multichain, entity labels, graphs, alerts.
+- [TRM](https://www.trmlabs.com/) — address/tx graphs.
+- [MetaSleuth](https://metasleuth.io/) — visual flow.
+- [Breadcrumbs](https://www.breadcrumbs.app/) (freemium) — visual graphing + labels.
+- [Bubblemaps](https://bubblemaps.io/) — holder concentration.
+- [Whale Alert](https://whale-alert.io/) — large transaction monitoring.
+- [Chainalysis](https://www.chainalysis.com/) / [Crystal Blockchain](https://crystalblockchain.com/) — pro analytics.
+- [GraphSense](https://graphsense.info/) — open-source crypto analytics.
+- [Nansen](https://www.nansen.ai/) — Smart Money labels (paid).
+- [Dune](https://dune.com/) — custom queries.
+- [Token Sniffer](https://tokensniffer.com/) — honeypot/scam detection.
+
+### 30.4 NFT / Exchange / Bridges
+
+- [OpenSea](https://opensea.io/), [NFTScan](https://www.nftscan.com/), [DappRadar](https://dappradar.com/), [CoinGecko](https://www.coingecko.com/), [CoinMarketCap](https://coinmarketcap.com/), [Glassnode](https://glassnode.com/).
+- Bridges: [Socketscan](https://socketscan.io/), [L2Beat Bridges](https://l2beat.com/bridges), [Pulsy](https://pulsy.io/).
+
+---
+
+## 31. Media Intelligence
+
+### 31.1 Reverse Image & Facial Search
+
+- [Google Images](https://images.google.com/), [TinEye](https://tineye.com/), [Yandex Images](https://yandex.com/images/) (Russian/East European strong), [PimEyes](https://pimeyes.com/en), [FaceCheck](https://facecheck.id/).
+
+### 31.2 Image Forensics
+
+- [Forensically](https://29a.ch/photo-forensics/), [ExifTool](https://exiftool.org/), [Jimpl](https://jimpl.com/), [Jeffrey's EXIF Viewer](http://exif.regex.info/exif.cgi), [FOCA](https://www.elevenpaths.com/labstools/foca), [Metagoofil](https://www.edge-security.com/metagoofil.php), [C2PA Verify](https://verify.contentauthenticity.org/).
+
+### 31.3 Video Analysis
+
+- [YouTube Data Viewer](https://citizenevidence.amnestyusa.org/), [InVID & WeVerify](https://www.invid-project.eu/tools-and-services/invid-verification-plugin/), [YouTube Geo Tag](https://mattw.io/youtube-geofind/location), [MediaInfo](https://mediaarea.net/en/MediaInfo), Snap Map.
+
+### 31.4 Browser Extensions for Media
+
+- [Fake News Debunker (InVID & WeVerify)](https://chrome.google.com/webstore/detail/fake-news-debunker-by-inv/mhccpoafgdgbhnjfhkcmgknndkeenfhe).
+- [RevEye Reverse Image Search](https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/kejaocbebojdmebagkjghljkeefgimdj).
+- [EXIF Viewer Pro](https://chrome.google.com/webstore/detail/exif-viewer-pro/mmbhfeiddhndihdjeganjggkmjapkffm).
+- [Wayback Machine Extension](https://chrome.google.com/webstore/detail/wayback-machine/fpnmgdkabkmnadcjpehmlllkndpkmiak).
+- [Search by Image](https://chromewebstore.google.com/detail/search-by-image/cnojnbdhbhnkbcieeekonklommdnndci).
+
+---
+
+## 32. Geospatial Intelligence
+
+### 32.1 Satellite & Mapping
+
+- [Google Maps](https://www.google.com/maps), [Bing Maps](https://www.bing.com/maps/).
+- [Sentinel Hub EO Browser](https://apps.sentinel-hub.com/eo-browser/), [NASA Worldview](https://worldview.earthdata.nasa.gov/), [Zoom Earth](https://zoom.earth/).
+- [Wayback Imagery](https://livingatlas.arcgis.com/wayback/) — historical satellite.
+- [NASA FIRMS](https://firms.modaps.eosdis.nasa.gov/map/), [Open Infrastructure Map](https://openinframap.org/), [Windy](https://www.windy.com/).
+
+### 32.2 Geolocation Tools
+
+- [Mapillary](https://www.mapillary.com/app), [KartaView](https://kartaview.org/), [Overpass Turbo](https://overpass-turbo.eu/), [SunCalc](https://www.suncalc.org/), [GeoNames](https://www.geonames.org/), [PeakVisor](https://peakvisor.com/), [GeoGuesser tips](https://somerandomstuff1.wordpress.com/2019/02/08/geoguessr-the-top-tips-tricks-and-techniques/).
+
+**Street View:** Google Street View, [Apple Maps](https://maps.apple.com/), [Yandex Maps](https://yandex.com/maps/), [Baidu Maps](https://map.baidu.com/).
+
+### 32.3 Flight OSINT
+
+- [FlightRadar24](https://www.flightradar24.com/), [FlightAware](https://www.flightaware.com/), [RadarBox](https://www.radarbox.com/).
+- [ADSBExchange](https://www.adsbexchange.com/) — unfiltered.
+- [Planespotters](https://www.planespotters.net/) — fleet/airframe history.
+- [AirFrames](https://www.airframes.org/), [JetPhotos](https://www.jetphotos.com/).
+
+### 32.4 Maritime OSINT
+
+- [MarineTraffic](https://www.marinetraffic.com/), [VesselFinder](https://www.vesselfinder.com/), [FleetMon](https://www.fleetmon.com/).
+- [Global Fishing Watch](https://globalfishingwatch.org/map/) — vessel behavior + AIS gap analysis.
+
+---
+
+
+## 37. Regional Search Engines
+
+- **Russia / CIS:** [Yandex](https://yandex.com/), [Mail.ru Search](https://go.mail.ru/).
+- **China:** [Baidu](https://www.baidu.com/), [Sogou](https://www.sogou.com/), [360 Search](https://www.so.com/).
+- **Russia social:** [VK](https://vk.com/), [OK.ru](https://ok.ru/).
+- **China social:** [Weibo](https://weibo.com/), [Bilibili](https://www.bilibili.com/), [Zhihu](https://www.zhihu.com/), [Douyin](https://www.douyin.com/).
+
+---
+
+## 38. Telegram & Messaging Intelligence
+
+- [TGStat](https://tgstat.com/) — channel analytics + search.
+- [Telemetr](https://telemetr.io/) — channel growth, overlaps, forwards.
+- [Combot](https://combot.org/) — group analytics (partial paid).
+- [TelegramDB Search Bot](https://t.me/TGdb_bot) — basic Telegram OSINT.
+- [Discord ID](https://discord.id/) — basic Discord account info.
+- [Sogou Weixin search](https://weixin.sogou.com/) — WeChat Official Accounts.
+- View public Telegram channels: `https://t.me/s/<channel>`.
+
+---

package/bundled-skills/offensive-osint/references/tooling-install.md

@@ -0,0 +1,190 @@
+# Tooling Quick-Install
+
+> **AAS adaptation:** Read the authorization gate in [the skill](../SKILL.md) before any target request, credential use, or data collection. These are reference examples, not an instruction to run a sweep. Select only explicitly approved targets and techniques; set request, time, byte and concurrency limits and stop on errors or scope changes. Preserve TLS verification. Treat discoveries, pattern matches and historical provider claims as leads, not verified ownership, permission or severity. Minimize personal data and redact credentials before reports; do not send private evidence to public services. Prices, quotas, API shapes and tool availability require current official documentation. Changes and original source hashes are recorded in [the notice](../UPSTREAM-NOTICE.md).
+
+
+> Reference content for the `offensive-osint` skill. Originally §46 of the monolithic SKILL.md (refactored 2026-05-02 for size/load efficiency).
+
+## 46. Tooling Quick-Install
+
+External installation templates, not bundled tools or permission to install everything. Select only a required tool; verify its official repository, exact reviewed release/commit, checksum/signature and dependency tree. Install in an isolated environment without elevated privileges. Replace each version placeholder before use; these examples have not been executed by AAS. Cloud frameworks can create billable resources and require explicit approval.
+
+### 46.1 Subdomain enumeration
+
+```bash
+# Subfinder (passive, fast)
+go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@<reviewed-version>
+
+# Amass (thorough, slow)
+go install github.com/owasp-amass/amass/v4/...@<reviewed-version>
+
+# Assetfinder
+go install github.com/tomnomnom/assetfinder@<reviewed-version>
+
+# DNSx (resolution + brute)
+go install github.com/projectdiscovery/dnsx/cmd/dnsx@<reviewed-version>
+
+# Puredns (brute-force with wildcard handling)
+go install github.com/d3mondev/puredns/v2@<reviewed-version>
+```
+
+### 46.2 HTTP probing & enrichment
+
+```bash
+# httpx (tech-detect, status, JARM, favicon)
+go install github.com/projectdiscovery/httpx/cmd/httpx@<reviewed-version>
+
+# Gowitness (screenshots)
+go install github.com/sensepost/gowitness@<reviewed-version>
+
+# Aquatone (screenshots + clustering)
+go install github.com/michenriksen/aquatone@<reviewed-version>
+```
+
+### 46.3 Vulnerability scanning
+
+```bash
+# Nuclei (template scanner)
+go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@<reviewed-version>
+# Review and pin the exact template revision separately; do not auto-update templates.
+
+# Naabu (port scan)
+go install github.com/projectdiscovery/naabu/v2/cmd/naabu@<reviewed-version>
+
+# Masscan (fast port scan; requires sudo)
+git clone https://github.com/robertdavidgraham/masscan  # inspect and pin a reviewed commit before any build
+```
+
+### 46.4 Content discovery
+
+```bash
+# Ffuf (fuzzer / dirbuster)
+go install github.com/ffuf/ffuf/v2@<reviewed-version>
+
+# Gobuster
+go install github.com/OJ/gobuster/v3@<reviewed-version>
+
+# Feroxbuster (recursive content disco)
+cargo install feroxbuster --version <reviewed-version> --locked
+```
+
+### 46.5 JS / endpoint extraction
+
+```bash
+# Katana (crawler)
+go install github.com/projectdiscovery/katana/cmd/katana@<reviewed-version>
+
+# GoSpider
+go install github.com/jaeles-project/gospider@<reviewed-version>
+
+# LinkFinder (JS endpoint regex)
+git clone https://github.com/GerbenJavado/LinkFinder  # pin and review code/dependencies before installation
+
+# Subjs (extract JS URLs from HTML)
+go install github.com/lc/subjs@<reviewed-version>
+```
+
+### 46.6 Wayback / archive
+
+```bash
+# gau (get all urls from Wayback + others)
+go install github.com/lc/gau/v2/cmd/gau@<reviewed-version>
+
+# Waybackurls
+go install github.com/tomnomnom/waybackurls@<reviewed-version>
+```
+
+### 46.7 Cloud / AWS
+
+```bash
+# AWS CLI
+python3 -m pip install awscli==<reviewed-version>
+# or: brew install awscli
+
+# Cloud_enum (S3/Azure/GCP enum)
+git clone https://github.com/initstring/cloud_enum  # pin and review code/dependencies before installation
+
+# S3Scanner
+python3 -m pip install s3scanner==<reviewed-version>
+
+# CloudSploit
+git clone https://github.com/aquasecurity/cloudsploit  # pin and inspect lifecycle scripts before any installation
+```
+
+### 46.8 Identity / SSO
+
+```bash
+# o365creeper / o365enum
+git clone https://github.com/gremwell/o365enum
+
+# CredMaster (per-protocol auth probe)
+git clone https://github.com/knavesec/CredMaster
+```
+
+### 46.9 Mobile
+
+```bash
+# google-play-scraper (Python)
+python3 -m pip install google-play-scraper==<reviewed-version>
+
+# androguard (APK static analysis)
+python3 -m pip install androguard==<reviewed-version>
+# or: brew install androguard
+
+# apkleaks (secret scan in APK)
+python3 -m pip install apkleaks==<reviewed-version>
+```
+
+### 46.10 TLS / cert
+
+```bash
+# sslyze
+python3 -m pip install sslyze==<reviewed-version>
+
+# testssl.sh
+git clone --depth 1 https://github.com/drwetter/testssl.sh.git
+
+# JARM
+python3 -m pip install pyjarm==<reviewed-version>
+
+# Cert-spotter / certgraph
+go install github.com/lanrat/certgraph@<reviewed-version>
+```
+
+### 46.11 Misc utilities
+
+```bash
+# Anew (line-dedup that streams)
+go install github.com/tomnomnom/anew@<reviewed-version>
+
+# Gf (regex-based grep templates)
+go install github.com/tomnomnom/gf@<reviewed-version>
+
+# Hakrawler (web crawler)
+go install github.com/hakluke/hakrawler@<reviewed-version>
+
+# Trufflehog (secret scanner)
+go install github.com/trufflesecurity/trufflehog@<reviewed-version>
+
+# Gitleaks
+go install github.com/zricethezav/gitleaks/v8@<reviewed-version>
+
+# jq (JSON parsing)
+sudo apt install jq    # or brew install jq
+```
+
+### 46.12 Frameworks / orchestration
+
+```bash
+# ProjectDiscovery's "PDTM" (manages the full PD toolkit)
+go install -v github.com/projectdiscovery/pdtm/cmd/pdtm@<reviewed-version>
+# Select one required reviewed tool; do not run install-all.
+
+# reconftw (scripted recon framework)
+git clone https://github.com/six2dez/reconftw  # do not run install.sh before code/dependency review
+
+# Axiom (distributed recon on cloud nodes)
+git clone https://github.com/pry0cc/axiom  # cloud provisioning requires separate account/cost approval
+```
+
+---

package/bundled-skills/offers/SKILL.md

@@ -13,7 +13,7 @@ license_source: https://github.com/coreyhaines31/marketingskills/blob/main/LICEN
 # Offer Design
 ## When to Use
 
-Use this skill when you need when the user wants to design, construct, or improve an offer — the thing they actually sell — including value framing, bonus stacking, guarantee design, scarcity/urgency, naming, and payment structure. Also use when the user mentions 'offer,' 'offer design,' 'build an offer,' 'grand...
+Use this skill when you need to design, construct, or improve an offer — the thing they actually sell — including value framing, bonus stacking, guarantee design, scarcity/urgency, naming, and payment structure. Also use when the user mentions 'offer,' 'offer design,' 'build an offer,' 'grand...
 
 
 You are an expert in offer construction. Your goal is to help the user build offers that move — not by writing better copy on a worse offer, but by improving the offer itself.

package/bundled-skills/omp-delegate/SKILL.md

@@ -17,6 +17,10 @@ compatibility: Requires the `omp` CLI installed and authenticated (`/login` insi
 metadata:
   version: 0.5.0
 ---
+## Bundled upstream support
+
+Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.
+
 # Oh My Pi Delegate
 
 ## When to Use
@@ -180,7 +184,7 @@ expanding the mandate). See [references/review-and-land.md](references/review-an
 
 ## Limitations
 
-- Docs-only import — executable `scripts/relay.mjs` not included; see upstream for full runtime. Requires `omp` CLI, Node 18+, git.
+- Runtime helper `scripts/relay.mjs` is bundled from the revision recorded in `UPSTREAM-NOTICE.md`. Requires the corresponding installed and authenticated CLI, Node 18+, and git.
 - Relay never commits — it only returns structured result JSON; you review and land the commit.
 
 > Adapted from [amElnagdy/delegate-skills](https://github.com/amElnagdy/delegate-skills) (MIT) — docs-only, runtime not bundled.

package/bundled-skills/omp-delegate/UPSTREAM-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ahmed Mohammed (amElnagdy)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bundled-skills/omp-delegate/UPSTREAM-NOTICE.md

@@ -0,0 +1,13 @@
+# Upstream helpers for omp-delegate
+
+The files listed below were recovered from [amElnagdy/delegate-skills](https://github.com/amElnagdy/delegate-skills) at commit `3aa72d681a79e2a9d09bd9a316353003ae1cb4a7`. The repository ID is `1269124956`.
+
+They retain the upstream **MIT** license reproduced in [UPSTREAM-LICENSE.txt](UPSTREAM-LICENSE.txt). This notice applies to the listed support files; it does not replace the license metadata of other catalog files. Preserve the upstream license and this attribution when redistributing them.
+
+License wording is unchanged; text-only trailing whitespace and EOF blank lines are normalized. Original license: https://github.com/amElnagdy/delegate-skills/blob/3aa72d681a79e2a9d09bd9a316353003ae1cb4a7/LICENSE
+
+| Local file | Original upstream path | Original Git blob SHA | Import changes |
+| --- | --- | --- | --- |
+| `scripts/relay.mjs` | `skills/omp-delegate/scripts/relay.mjs` | `59468e92fbaf7632c83848483e312cd637c4151b` | content unchanged |
+
+The relay launches the user-installed, authenticated agent CLI. Write-capable modes can approve child tools automatically; they are not a host sandbox. Invoke only for explicitly authorized delegation, keep credentials out of task briefs, and review the child output and project changes before landing them. This import does not run the CLI.