osintkit 0.5.0__tar.gz → 0.7.0__tar.gz

{osintkit-0.5.0 → osintkit-0.7.0}/CHANGELOG.md

@@ -6,6 +6,21 @@ All notable changes are recorded here. The format follows
 
 ## Unreleased
 
+## 0.7.0 — 2026-11-02
+
+### Added
+
+- `xposed_analytics`: dated, typed, verified breach membership and pastes, keyless
+- post-synthesis self-check listing any claimed breach, date, host, or account URL absent from
+  the supplied data
+
+## 0.6.0 — 2026-11-02
+
+### Added
+
+- `infostealer` collector for Hudson Rock stealer logs across email, username, and domain
+- any stealer infection forces a high risk floor and a rotate-everything recommendation
+
 ## 0.5.0 — 2026-11-02
 
 ### Added

{osintkit-0.5.0 → osintkit-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: osintkit
-Version: 0.5.0
+Version: 0.7.0
 Summary: Public-data OSINT aggregator for emails, usernames, domains, and companies
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/osintkit
 Project-URL: Issues, https://github.com/sjdsjadjajdjsa/osintkit/issues
@@ -93,8 +93,10 @@ Any OpenAI-compatible endpoint works. `init --provider ollama` needs no key for
 `--provider`, `--base-url`, and `--model` cover everything else. The preset table, key variables,
 and precedence order are in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
 
-Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts GitHub from 60 to
-5000 requests/hour. Everything else needs no credentials.
+Optional keys: a Have I Been Pwned subscription (`--hibp-key` on init, or `HIBP_API_KEY`) adds
+per-account breach and paste membership; `GITHUB_TOKEN` lifts GitHub from 60 to 5000
+requests/hour. Both stay local — the key is yours, and every user of the tool brings their own.
+Everything else needs no credentials.
 
 ## Commands
 
@@ -138,10 +140,14 @@ the model fail.
   and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
 - **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
   posture, and WHOIS, marked as derived.
+- **Info-stealer logs.** Hudson Rock reports machines infected by stealers that saved
+  credentials, with dates and hostnames; one infection forces a high risk floor.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
 - **Validated output.** Strict JSON schema, one repair round-trip, then a clean failure.
+- **Self-checked claims.** Every breach, date, host, and account URL is compared back to the
+  collected data; anything unsupported is called out.
 
 ## Collectors
 
@@ -159,6 +165,9 @@ against the public HIBP and XposedOrNot catalogues for date, exposed fields, and
 the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
 `HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
 
+Stealer logs matter more than most breaches: the credentials were live on an infected machine,
+not just leaked years ago. They are queried for every target type, keyless.
+
 Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
 millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
 machine.

{osintkit-0.5.0 → osintkit-0.7.0}/README.md

@@ -61,8 +61,10 @@ Any OpenAI-compatible endpoint works. `init --provider ollama` needs no key for
 `--provider`, `--base-url`, and `--model` cover everything else. The preset table, key variables,
 and precedence order are in [docs/REFERENCE.md](docs/REFERENCE.md#providers).
 
-Optional keys: `HIBP_API_KEY` turns on Have I Been Pwned, `GITHUB_TOKEN` lifts GitHub from 60 to
-5000 requests/hour. Everything else needs no credentials.
+Optional keys: a Have I Been Pwned subscription (`--hibp-key` on init, or `HIBP_API_KEY`) adds
+per-account breach and paste membership; `GITHUB_TOKEN` lifts GitHub from 60 to 5000
+requests/hour. Both stay local — the key is yours, and every user of the tool brings their own.
+Everything else needs no credentials.
 
 ## Commands
 
@@ -106,10 +108,14 @@ the model fail.
   and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
 - **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
   posture, and WHOIS, marked as derived.
+- **Info-stealer logs.** Hudson Rock reports machines infected by stealers that saved
+  credentials, with dates and hostnames; one infection forces a high risk floor.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
 - **Validated output.** Strict JSON schema, one repair round-trip, then a clean failure.
+- **Self-checked claims.** Every breach, date, host, and account URL is compared back to the
+  collected data; anything unsupported is called out.
 
 ## Collectors
 
@@ -127,6 +133,9 @@ against the public HIBP and XposedOrNot catalogues for date, exposed fields, and
 the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
 `HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
 
+Stealer logs matter more than most breaches: the credentials were live on an infected machine,
+not just leaked years ago. They are queried for every target type, keyless.
+
 Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
 millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
 machine.

{osintkit-0.5.0 → osintkit-0.7.0}/docs/REFERENCE.md

@@ -6,8 +6,9 @@ Everything the README leaves out: every flag, every collector, storage, and fail
 
 | Collector | Targets | Source | Needs key |
 | --- | --- | --- | --- |
+| `infostealer` | email / username / domain | Hudson Rock stealer logs | no |
 | `hibp_breaches`, `hibp_pastes` | email | Have I Been Pwned | yes |
-| `xposed_or_not`, `leakcheck_public` | email | free public breach indexes | no |
+| `xposed_or_not`, `xposed_analytics`, `leakcheck_public` | email | free public breach indexes | no |
 | `gravatar` | email | Gravatar | no |
 | `crt_sh_subdomains`, `crt_sh_certificates` | domain | crt.sh | no |
 | `crt_sh_organization` | company | crt.sh organisation search, with apex-domain identity fallback | no |
@@ -61,6 +62,22 @@ Explicit `--base-url` and `--model` beat both the provider and the prefix. Tempe
 Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--offline`, `--dry-run`, `--only`, `--skip`,
 `--ports`, `--fail-fast`, `-c/--concurrency`, `--limit`, `--show`, `--days`, `--clear`, `--deep`.
 
+## Self-check
+
+After synthesis every breach name, date, subdomain, and account URL is compared with the supplied
+data. Anything the model asserted that no source returned is listed under a "not found in source
+data" note, so drift is visible instead of plausible. Checks only run for source families that
+were actually collected.
+
+## Info-stealer logs
+
+`infostealer` queries Hudson Rock's keyless endpoint for infections that saved credentials on a
+compromised machine. It returns the infection count, dates, hostnames, IPs, antivirus state, and
+masked logins and passwords. Any infection forces a `high` risk floor; masked values are shown as
+the source provides them and are not usable as credentials.
+
+The address goes to Hudson Rock; nothing else does.
+
 ## Breach catalogue enrichment
 
 Breach names from free indexes are joined against `haveibeenpwned.com/api/v3/breaches` (keyless
@@ -78,7 +95,7 @@ pwned. `--json` for machines. Nothing about the password beyond the prefix leave
 
 `osintkit init` writes `~/.config/osintkit/config.toml` (or `$XDG_CONFIG_HOME`) with mode 600 in
 a 700 directory, after checking the key with a one-token request. Keys recognised:
-`provider`, `model`, `base_url`, `api_key`, `resolvers`.
+`provider`, `model`, `base_url`, `api_key`, `hibp_api_key`, `resolvers`.
 
 `osintkit config` prints them masked, `--reveal` shows the key, `--unset KEY` removes one, and
 `--path` prints the location. Deleting the file is the same as `--unset` everything.
@@ -86,6 +103,7 @@ a 700 directory, after checking the key with a one-token request. Keys recognise
 Precedence for each value: command-line flag, then the provider-specific environment variable,
 then a key prefix, then the config file, then the built-in default. Stored values apply only when
 the stored provider matches the one in use, so a one-off key export never gets the stored key.
+`HIBP_API_KEY` in the environment beats a stored `hibp_api_key`.
 
 ## Offline mode
 

{osintkit-0.5.0 → osintkit-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "osintkit"
-version = "0.5.0"
+version = "0.7.0"
 description = "Public-data OSINT aggregator for emails, usernames, domains, and companies"
 readme = "README.md"
 requires-python = ">=3.12"

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/__init__.py

@@ -1,3 +1,3 @@
 """osintkit: a public-data OSINT aggregator."""
 
-__version__ = "0.5.0"
+__version__ = "0.7.0"

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/cli.py

@@ -112,6 +112,7 @@ def root(
         base_url=base_url or (stored.get("base_url") if config_applies else None) or preset[0],
         model=model or (stored.get("model") if config_applies else None) or preset[1],
         api_key=api_key,
+        hibp_api_key_value=stored.get("hibp_api_key"),
         temperature=temperature,
         max_tokens=max_tokens,
         timeout=timeout,
@@ -561,6 +562,9 @@ def init(
     provider: str | None = typer.Option(None, "--provider", help="Provider to store."),
     api_key: str | None = typer.Option(None, "--api-key", help="Key to store."),
     model: str | None = typer.Option(None, "--model", help="Default model to store."),
+    hibp_key: str | None = typer.Option(
+        None, "--hibp-key", help="Optional Have I Been Pwned key for breach and paste checks."
+    ),
     base_url: str | None = typer.Option(None, "--base-url", help="Custom endpoint to store."),
     force: bool = typer.Option(False, "--force", help="Replace an existing config."),
     verify: bool = typer.Option(True, "--verify/--no-verify", help="Check the key afterwards."),
@@ -603,11 +607,19 @@ def init(
             raise typer.Exit(2)
         data["api_key"] = key
 
+    stored_hibp = stored.get("hibp_api_key")
+    if hibp_key:
+        data["hibp_api_key"] = hibp_key
+    elif stored_hibp and not force:
+        data["hibp_api_key"] = stored_hibp
+
     written = userconfig.save(data)
     out.print(f"[green]stored[/green] {written} (mode 600)")
     out.print(f"provider: {chosen}")
     if data.get("api_key"):
         out.print(f"key: {userconfig.mask(str(data['api_key']))}")
+    if data.get("hibp_api_key"):
+        out.print(f"HIBP key: {userconfig.mask(str(data['hibp_api_key']))}")
 
     if verify:
         probe = Settings(
@@ -698,7 +710,7 @@ def config_cmd(
     table.add_column("value")
     for name, value in stored.items():
         shown: object = value
-        if name == "api_key" and isinstance(value, str) and not reveal:
+        if name in {"api_key", "hibp_api_key"} and isinstance(value, str) and not reveal:
             shown = userconfig.mask(value)
         table.add_row(name, render.escape(str(shown)))
     out.print(table)

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/collectors/__init__.py

@@ -8,10 +8,12 @@ from . import (  # noqa: F401  (import order matters: side-effect registration)
     ct,
     dns,
     github,
+    infostealer,
     pastes,
     ports,
     subdomains,
     whois_lookup,
+    xposed_analytics,
 )
 from .base import REGISTRY, Collector, Context, collectors_for, run_collector
 

osintkit-0.7.0/src/osintkit/collectors/infostealer.py

@@ -0,0 +1,71 @@
+"""Info-stealer log exposure via Hudson Rock's keyless endpoint."""
+
+from __future__ import annotations
+
+from urllib.parse import quote
+
+from .base import Context, collector
+
+BASE = "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by"
+MAX_STEALERS = 5
+
+
+def _clean(value: object) -> str | None:
+    text = str(value or "").strip()
+    if not text or text.lower() == "not found":
+        return None
+    return text[:120]
+
+
+def _summary(body: object) -> dict:
+    if not isinstance(body, dict):
+        return {"infected": False, "infections": 0, "stealers": []}
+    raw = body.get("stealers") or []
+    stealers = []
+    for row in raw[:MAX_STEALERS]:
+        if not isinstance(row, dict):
+            continue
+        stealers.append(
+            {
+                "date": (row.get("date_compromised") or "")[:10] or None,
+                "computer": _clean(row.get("computer_name")),
+                "os": _clean(row.get("operating_system")),
+                "ip": _clean(row.get("ip")),
+                "antiviruses": [av for av in row.get("antiviruses") or [] if av != "None"][:5],
+                "logins": [str(item) for item in (row.get("top_logins") or [])[:5]],
+                "passwords": [str(item) for item in (row.get("top_passwords") or [])[:5]],
+            }
+        )
+    return {
+        "infected": bool(stealers),
+        "infections": len(raw),
+        "corporate_services": body.get("total_corporate_services"),
+        "user_services": body.get("total_user_services"),
+        "stealers": stealers,
+        "source": "hudsonrock",
+    }
+
+
+async def _lookup(ctx: Context, kind: str) -> dict:
+    response = await ctx.http.get(
+        f"{BASE}-{kind}",
+        namespace="hudsonrock",
+        params={kind: ctx.target},
+        empty_on=(404, 429),
+        timeout=ctx.http_timeout or 45,
+    )
+    if response.status_code != 200:
+        return {"infected": False, "infections": 0, "stealers": [], "note": f"HTTP {response.status_code}"}
+    try:
+        return _summary(response.json())
+    except ValueError:
+        return {"infected": False, "infections": 0, "stealers": [], "note": "non-JSON"}
+
+
+@collector("infostealer", ("email", "username", "domain"), "Info-stealer log infections", order=5, ttl=43200)
+async def infostealer(ctx: Context) -> dict:
+    kind = {"email": "email", "username": "username", "domain": "domain"}[ctx.target_type]
+    result = await _lookup(ctx, kind)
+    result["target_kind"] = kind
+    result["checked"] = quote(ctx.target)
+    return result

osintkit-0.7.0/src/osintkit/collectors/xposed_analytics.py

@@ -0,0 +1,73 @@
+"""XposedOrNot breach analytics: dated, typed membership plus pastes."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .base import Context, collector
+
+URL = "https://api.xposedornot.com/v1/breach-analytics"
+MAX_LISTED = 80
+
+
+def _types(value: Any) -> list[str]:
+    return [part.strip() for part in str(value or "").split(";") if part.strip()]
+
+
+def _breach(row: dict[str, Any]) -> dict[str, Any] | None:
+    name = str(row.get("breach") or "").strip()
+    if not name:
+        return None
+    date = str(row.get("xposed_date") or "").strip() or None
+    return {
+        "name": name,
+        "date": date,
+        "data_types": _types(row.get("xposed_data")),
+        "domain": row.get("domain"),
+        "pwn_count": row.get("xposed_records"),
+        "verified": str(row.get("verified") or "").lower() == "yes",
+        "password_risk": row.get("password_risk"),
+        "source": "xposedornot-analytics",
+    }
+
+
+def _paste(row: dict[str, Any]) -> dict[str, Any] | None:
+    paste_id = str(row.get("paste_id") or row.get("id") or "").strip()
+    if not paste_id and not row.get("title"):
+        return None
+    return {
+        "id": paste_id or None,
+        "title": row.get("title"),
+        "date": row.get("date") or row.get("xposed_date"),
+        "source": row.get("source") or "xposedornot-analytics",
+        "origin": "xposedornot",
+    }
+
+
+@collector("xposed_analytics", ("email",), "Dated breach and paste membership", order=14, ttl=21600)
+async def xposed_analytics(ctx: Context) -> dict:
+    response = await ctx.http.get(
+        URL,
+        namespace="xposed-analytics",
+        params={"email": ctx.target},
+        empty_on=(404, 422, 429),
+        timeout=ctx.http_timeout or 60,
+    )
+    if response.status_code != 200:
+        return {"breaches": [], "pastes": [], "note": f"HTTP {response.status_code}"}
+    try:
+        body = response.json()
+    except ValueError:
+        return {"breaches": [], "pastes": [], "note": "non-JSON"}
+
+    raw = ((body.get("ExposedBreaches") or {}).get("breaches_details")) or []
+    breaches = [entry for entry in (_breach(row) for row in raw if isinstance(row, dict)) if entry]
+    raw_pastes = ((body.get("ExposedPastes") or {}).get("pastes_details")) or []
+    pastes = [entry for entry in (_paste(row) for row in raw_pastes if isinstance(row, dict)) if entry]
+    breaches.sort(key=lambda row: str(row.get("date") or ""), reverse=True)
+    return {
+        "found": len(breaches),
+        "breaches": breaches[:MAX_LISTED],
+        "pastes": pastes[:25],
+        "source": "xposedornot-analytics",
+    }

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/config.py

@@ -109,6 +109,7 @@ class Settings:
     base_url: str = DEFAULT_BASE_URL
     model: str = DEFAULT_MODEL
     api_key: str | None = None
+    hibp_api_key_value: str | None = None
     temperature: float = DEFAULT_TEMPERATURE
     max_tokens: int = 4000
     timeout: float = DEFAULT_TIMEOUT
@@ -127,7 +128,7 @@ class Settings:
 
     @property
     def hibp_api_key(self) -> str | None:
-        return os.environ.get("HIBP_API_KEY") or None
+        return os.environ.get("HIBP_API_KEY") or self.hibp_api_key_value or None
 
     @property
     def github_token(self) -> str | None:

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/doctor.py

@@ -124,10 +124,10 @@ def collect_checks(settings: Settings) -> list[Check]:
         ),
     ]
     for name, variable, why in (
-        ("Have I Been Pwned", "HIBP_API_KEY", "breach collectors will be skipped"),
+        ("Have I Been Pwned", "HIBP_API_KEY", "breach and paste collectors will be skipped"),
         ("GitHub", "GITHUB_TOKEN", "GitHub is limited to 60 requests/hour"),
     ):
-        present = bool(os.environ.get(variable))
+        present = bool(os.environ.get(variable)) or (name.startswith("Have I") and bool(settings.hibp_api_key))
         checks.append(Check(name, "ok" if present else "warn", "set" if present else why))
     if key:
         checks.append(Check("api key shape", "ok" if len(key) >= 20 else "warn", f"{len(key)} chars"))

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/normalise.py

@@ -7,14 +7,14 @@ from typing import Any
 
 from .models import CollectorResult
 
-BREACH_SOURCES = frozenset({"hibp_breaches", "xposed_or_not", "leakcheck_public"})
+BREACH_SOURCES = frozenset({"hibp_breaches", "xposed_or_not", "xposed_analytics", "leakcheck_public"})
 KEY_RE = re.compile(r"[^a-z0-9]+")
 CREDENTIAL_RE = re.compile(r"pass|hash|credential|secret|token|api[ _-]?key", re.I)
 SEVERITY = ("low", "medium", "high")
 MAX_PROMPT_BREACHES = 15
 
 
-def signals_for(merged: list[dict[str, Any]]) -> dict[str, Any]:
+def signals_for(merged: list[dict[str, Any]], infections: int = 0) -> dict[str, Any]:
     """Compute risk signals the model can check itself against."""
     credential = [
         entry
@@ -22,10 +22,12 @@ def signals_for(merged: list[dict[str, Any]]) -> dict[str, Any]:
         if any(CREDENTIAL_RE.search(str(kind)) for kind in entry.get("data_types", []))
     ]
     count = len(merged)
+    floor = "high" if infections else _floor(count, len(credential))
     return {
         "breach_count": count,
         "credential_bearing": len(credential),
-        "risk_floor": _floor(count, len(credential)),
+        "stealer_infections": infections,
+        "risk_floor": floor,
     }
 
 

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/offline.py

@@ -91,6 +91,15 @@ def _infrastructure(results: list[CollectorResult], report_notes: list[str]) ->
     if isinstance(wildcard, dict) and wildcard.get("wildcard"):
         notes.append("Wildcard DNS is enabled, so unknown labels resolve")
 
+    stealer = _data(results, "infostealer")
+    if isinstance(stealer, dict) and stealer.get("infections"):
+        first = (stealer.get("stealers") or [{}])[0]
+        notes.append(
+            f"{stealer['infections']} info-stealer infection(s)"
+            + (f", latest {first.get('date')}" if first.get("date") else "")
+            + (f" on {first.get('computer')}" if first.get("computer") else "")
+        )
+
     whois = _data(results, "whois_registration")
     if isinstance(whois, dict) and whois.get("registrar"):
         parts = [f"registrar {whois['registrar']}"]
@@ -117,9 +126,16 @@ def _infrastructure(results: list[CollectorResult], report_notes: list[str]) ->
 
 
 def _recommendations(
-    creds: int, mail: dict | None, wildcard: bool, ports: list[int], breach_count: int
+    creds: int,
+    mail: dict | None,
+    wildcard: bool,
+    ports: list[int],
+    breach_count: int,
+    infections: int = 0,
 ) -> list[str]:
     recs: list[str] = []
+    if infections:
+        recs.append("Change every password saved on the infected machine, then sign out all sessions")
     if creds:
         recs.append("Rotate passwords for the affected services and enable MFA where offered")
     elif breach_count:
@@ -204,5 +220,6 @@ def build(
             wildcard,
             risky,
             signals["breach_count"],
+            int((_data(results, "infostealer") or {}).get("infections") or 0),
         ),
     )

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/pipeline.py

@@ -14,7 +14,7 @@ from pathlib import Path
 
 from rich.console import Console
 
-from . import catalogue, collectors, normalise, offline, render, retention, synthesis
+from . import catalogue, collectors, normalise, offline, render, retention, synthesis, verify
 from .config import Settings
 from .errors import MissingAPIKey, OsintKitError, SynthesisError, TargetParseError
 from .http import HttpClient
@@ -186,7 +186,11 @@ async def execute(
             logger.event("breaches_merged", duplicates=duplicates)
 
         merged_breaches = next((r.data for r in prompt_results if r.collector == "breach_index"), [])
-        signals = normalise.signals_for(merged_breaches)
+        stealer = next((r.data for r in prompt_results if r.collector == "infostealer"), {})
+        infections = int((stealer or {}).get("infections") or 0)
+        signals = normalise.signals_for(merged_breaches, infections)
+        if infections:
+            report.notes.append(f"{infections} info-stealer infection(s) observed")
 
         bundle = PromptBundle(
             target=target,
@@ -244,6 +248,9 @@ async def execute(
                     report.analysis.risk_level = normalise.apply_floor(
                         report.analysis.risk_level, signals.get("risk_floor", "low")
                     )
+                    unsupported = verify.claims(report.analysis, prompt_results)
+                    if unsupported:
+                        report.notes.append("not found in source data: " + "; ".join(unsupported))
                     if not report.analysis.summary.strip():
                         fallback = offline.build(prompt_results, report.notes, target, narrated=True)
                         report.analysis.summary = fallback.summary

{osintkit-0.5.0 → osintkit-0.7.0}/src/osintkit/userconfig.py

@@ -7,8 +7,8 @@ from pathlib import Path
 from typing import Any
 
 FILENAME = "config.toml"
-KEYS = ("provider", "model", "base_url", "api_key", "resolvers")
-SECRET_KEYS = frozenset({"api_key"})
+KEYS = ("provider", "model", "base_url", "api_key", "hibp_api_key", "resolvers")
+SECRET_KEYS = frozenset({"api_key", "hibp_api_key"})
 
 
 def config_home() -> Path:

osintkit-0.7.0/src/osintkit/verify.py

@@ -0,0 +1,77 @@
+"""Post-synthesis check that claims exist in the collected data."""
+
+from __future__ import annotations
+
+from .models import Analysis, CollectorResult
+
+MAX_ISSUES = 5
+
+
+def _breach_rows(results: list[CollectorResult]) -> list[dict]:
+    rows: list[dict] = []
+    for result in results:
+        if result.collector == "breach_index" and isinstance(result.data, list):
+            rows.extend(row for row in result.data if isinstance(row, dict))
+    return rows
+
+
+def _names(results: list[CollectorResult]) -> set[str]:
+    return {str(row.get("name") or "").strip().lower() for row in _breach_rows(results)}
+
+
+def _dates(results: list[CollectorResult]) -> set[str]:
+    return {str(row.get("date") or "")[:10] for row in _breach_rows(results) if row.get("date")}
+
+
+def _subdomains(results: list[CollectorResult]) -> set[str]:
+    names: set[str] = set()
+    for result in results:
+        data = result.data
+        if result.collector in {"crt_sh_subdomains"} and isinstance(data, list):
+            names.update(str(item).lower() for item in data)
+        if result.collector == "passive_subdomains" and isinstance(data, dict):
+            for key in ("live_hosts", "common_prefix_hits"):
+                names.update(str(row.get("host")).lower() for row in data.get(key) or [] if row.get("host"))
+    return names
+
+
+def _urls(results: list[CollectorResult]) -> set[str]:
+    urls: set[str] = set()
+    for result in results:
+        data = result.data
+        if result.collector == "username_presence" and isinstance(data, dict):
+            urls.update(str(row.get("url")) for row in data.get("found") or [] if row.get("url"))
+        if result.collector == "github_profile" and isinstance(data, dict):
+            url = (data.get("profile") or {}).get("url")
+            if url:
+                urls.add(str(url))
+    return urls
+
+
+def claims(analysis: Analysis, results: list[CollectorResult]) -> list[str]:
+    """Return short descriptions of claims that the source data does not support."""
+    issues: list[str] = []
+    names = _names(results)
+    dates = _dates(results)
+    hosts = _subdomains(results)
+    urls = _urls(results)
+    checked = {result.collector for result in results}
+    has_breaches = "breach_index" in checked
+    has_hosts = bool(checked & {"crt_sh_subdomains", "passive_subdomains"})
+    has_accounts = bool(checked & {"username_presence", "github_profile"})
+
+    for breach in analysis.breaches:
+        if has_breaches and breach.name.strip().lower() not in names:
+            issues.append(f"breach {breach.name!r} not in the supplied data")
+        if has_breaches and breach.date and breach.date[:10] not in dates:
+            issues.append(f"date {breach.date} for {breach.name!r} not in the supplied data")
+
+    for host in analysis.subdomains:
+        if has_hosts and host.strip().lower() not in hosts:
+            issues.append(f"subdomain {host!r} not in the supplied data")
+
+    for account in analysis.associated_accounts:
+        if has_accounts and account.url and account.url.rstrip("/") not in {url.rstrip("/") for url in urls}:
+            issues.append(f"account URL {account.url!r} not in the supplied data")
+
+    return issues[:MAX_ISSUES]

{osintkit-0.5.0 → osintkit-0.7.0}/tests/test_cli.py

@@ -643,3 +643,48 @@ def test_password_command_hit_and_miss(monkeypatch):
         miss = runner.invoke(app, ["password", "hunter3", "--json"])
     assert miss.exit_code == 0
     assert jsonish(miss.output)["pwned"] is False
+
+
+def test_init_stores_optional_hibp_key(xdg):
+    from osintkit import userconfig
+
+    result = runner.invoke(
+        app,
+        ["init", "--provider", "venice", "--api-key", "k" * 30, "--hibp-key", "h" * 32, "--no-verify"],
+    )
+    assert result.exit_code == 0
+    assert userconfig.load()["hibp_api_key"] == "h" * 32
+    shown = runner.invoke(app, ["config"])
+    assert "hhhhhh…" in shown.output
+    assert "h" * 32 not in shown.output
+
+
+def test_stored_hibp_key_reaches_settings(xdg, monkeypatch):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "api_key": "k" * 30, "hibp_api_key": "stored-hibp"})
+    captured = {}
+
+    async def spy(target, settings, *args, **kwargs):
+        captured["hibp"] = settings.hibp_api_key
+        raise RuntimeError("stop")
+
+    monkeypatch.setattr(pipeline, "execute", spy)
+    runner.invoke(app, ["lookup", "--domain", "a.com"])
+    assert captured["hibp"] == "stored-hibp"
+
+
+def test_env_hibp_key_beats_stored(xdg, monkeypatch):
+    from osintkit import userconfig
+
+    userconfig.save({"provider": "venice", "api_key": "k" * 30, "hibp_api_key": "stored-hibp"})
+    monkeypatch.setenv("HIBP_API_KEY", "env-hibp")
+    captured = {}
+
+    async def spy(target, settings, *args, **kwargs):
+        captured["hibp"] = settings.hibp_api_key
+        raise RuntimeError("stop")
+
+    monkeypatch.setattr(pipeline, "execute", spy)
+    runner.invoke(app, ["lookup", "--domain", "a.com"])
+    assert captured["hibp"] == "env-hibp"

osintkit-0.7.0/tests/test_infostealer.py

@@ -0,0 +1,64 @@
+import httpx
+import respx
+
+from osintkit.collectors import infostealer
+
+URL = "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email"
+
+
+@respx.mock
+async def test_infections_are_summarised(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "stealers": [
+                    {
+                        "date_compromised": "2026-10-31T00:00:00.000Z",
+                        "computer_name": "DESKTOP-1 (David)",
+                        "operating_system": "Not Found",
+                        "ip": "105.118.***.**",
+                        "antiviruses": ["None"],
+                        "top_logins": ["a***n"],
+                        "top_passwords": ["v**************E"],
+                    }
+                ],
+                "total_corporate_services": 3,
+                "total_user_services": 9,
+            },
+        )
+    )
+    result = await infostealer.infostealer(ctx)
+    assert result["infected"] is True
+    assert result["infections"] == 1
+    assert result["stealers"][0]["date"] == "2026-10-31"
+    assert result["stealers"][0]["os"] is None
+    assert result["stealers"][0]["antiviruses"] == []
+
+
+@respx.mock
+async def test_clean_target(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(return_value=httpx.Response(200, json={"stealers": []}))
+    result = await infostealer.infostealer(ctx)
+    assert result["infected"] is False
+
+
+@respx.mock
+async def test_rate_limited_is_not_an_error(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(return_value=httpx.Response(429))
+    result = await infostealer.infostealer(ctx)
+    assert result["infections"] == 0
+    assert "429" in result["note"]
+
+
+@respx.mock
+async def test_domain_uses_domain_endpoint(make_context):
+    ctx = make_context("example.com", "domain")
+    route = respx.get("https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain").mock(
+        return_value=httpx.Response(200, json={"stealers": []})
+    )
+    await infostealer.infostealer(ctx)
+    assert route.calls[0].request.url.params["domain"] == "example.com"

{osintkit-0.5.0 → osintkit-0.7.0}/tests/test_normalise.py

@@ -116,3 +116,12 @@ def test_dict_shaped_sources_are_merged():
     row = next(r for r in kept if r.collector == "breach_index").data[0]
     assert row["sources"] == ["leakcheck_public", "xposedornot"]
     assert row["date"] == "2020-01-01"
+
+
+def test_infections_force_a_high_floor():
+    assert normalise.signals_for([], infections=1)["risk_floor"] == "high"
+    assert normalise.signals_for([], infections=0)["risk_floor"] == "low"
+
+
+def test_infections_are_counted_in_signals():
+    assert normalise.signals_for([], infections=3)["stealer_infections"] == 3

osintkit-0.7.0/tests/test_verify.py

@@ -0,0 +1,54 @@
+from osintkit import verify
+from osintkit.models import Analysis, CollectorResult
+
+
+def result(name, data):
+    return CollectorResult(collector=name, target="t", target_type="email", data=data)
+
+
+def analysis(**kwargs):
+    base = {"summary": "s", "risk_level": "low"}
+    base.update(kwargs)
+    return Analysis.model_validate(base)
+
+
+def test_supported_claims_pass():
+    results = [result("breach_index", [{"name": "Acme", "date": "2020-01-01"}])]
+    check = analysis(breaches=[{"name": "Acme", "date": "2020-01-01"}])
+    assert verify.claims(check, results) == []
+
+
+def test_unknown_breach_is_flagged():
+    results = [result("breach_index", [{"name": "Acme"}])]
+    check = analysis(breaches=[{"name": "Invented"}])
+    assert any("Invented" in issue for issue in verify.claims(check, results))
+
+
+def test_wrong_date_is_flagged():
+    results = [result("breach_index", [{"name": "Acme", "date": "2020-01-01"}])]
+    check = analysis(breaches=[{"name": "Acme", "date": "2024-09-09"}])
+    assert any("2024-09-09" in issue for issue in verify.claims(check, results))
+
+
+def test_unknown_subdomain_and_url_are_flagged():
+    results = [
+        result("crt_sh_subdomains", ["api.example.com"]),
+        result("username_presence", {"found": [{"url": "https://github.com/other"}]}),
+    ]
+    check = analysis(
+        subdomains=["api.example.com", "made-up.example.com"],
+        associated_accounts=[{"platform": "GitHub", "url": "https://github.com/x"}],
+    )
+    issues = verify.claims(check, results)
+    assert any("made-up" in issue for issue in issues)
+    assert any("github.com/x" in issue for issue in issues)
+
+
+def test_no_source_data_means_no_noise():
+    assert verify.claims(analysis(breaches=[{"name": "Anything"}]), []) == []
+
+
+def test_issue_list_is_capped():
+    results = [result("breach_index", [])]
+    check = analysis(breaches=[{"name": f"B{index}"} for index in range(20)])
+    assert len(verify.claims(check, results)) == verify.MAX_ISSUES

osintkit-0.7.0/tests/test_xposed_analytics.py

@@ -0,0 +1,61 @@
+import httpx
+import respx
+
+from osintkit.collectors import xposed_analytics as xa
+
+URL = "https://api.xposedornot.com/v1/breach-analytics"
+
+
+@respx.mock
+async def test_breaches_are_normalised_and_sorted(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "ExposedBreaches": {
+                    "breaches_details": [
+                        {"breach": "Old", "xposed_date": "2019", "xposed_data": "Emails;Passwords"},
+                        {"breach": "New", "xposed_date": "2026", "xposed_records": 10, "verified": "Yes"},
+                    ]
+                }
+            },
+        )
+    )
+    result = await xa.xposed_analytics(ctx)
+    assert [row["name"] for row in result["breaches"]] == ["New", "Old"]
+    assert result["breaches"][1]["data_types"] == ["Emails", "Passwords"]
+    assert result["breaches"][0]["verified"] is True
+
+
+@respx.mock
+async def test_pastes_are_normalised(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(
+        return_value=httpx.Response(
+            200,
+            json={"ExposedPastes": {"pastes_details": [{"paste_id": "abc", "title": "t"}]}},
+        )
+    )
+    result = await xa.xposed_analytics(ctx)
+    assert result["pastes"][0]["id"] == "abc"
+
+
+@respx.mock
+async def test_error_status_is_a_note_not_a_crash(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(return_value=httpx.Response(429))
+    result = await xa.xposed_analytics(ctx)
+    assert result["breaches"] == []
+    assert "429" in result["note"]
+
+
+@respx.mock
+async def test_junk_rows_are_dropped(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(
+        return_value=httpx.Response(
+            200, json={"ExposedBreaches": {"breaches_details": [None, {}, {"breach": ""}]}}
+        )
+    )
+    assert (await xa.xposed_analytics(ctx))["breaches"] == []