# Osint Due Diligence > Use when conducting OSINT due diligence on companies or individuals, performing background investigations, verifying identities, assessing business partners, or investigating any entity using open-source intelligence. Also use for third-party vendor cyber risk and data protection assessments (GDPR/NIS2/DORA compliance). Orchestrates 30+ CLI OSINT tools through a structured 8-phase company, 7-phas… - **Type:** Skill - **Install:** `agentstack add skill-mtjikuzu-hermes-osint-skill-hermes-osint-skill` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [mtjikuzu](https://agentstack.voostack.com/s/mtjikuzu) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [mtjikuzu](https://github.com/mtjikuzu) - **Source:** https://github.com/mtjikuzu/hermes-osint-skill ## Install ```sh agentstack add skill-mtjikuzu-hermes-osint-skill-hermes-osint-skill ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # OSINT Due Diligence Orchestrate open-source intelligence investigations on companies and individuals using CLI tools with a structured methodology grounded in professional standards (Berkeley Protocol, Bellingcat, IntelTechniques). ## Overview This skill turns Hermes Agent into a due diligence investigator. It provides: 1. A **phased methodology** for company (8 phases) and individual (7 phases) investigations — what to look for, in what order, from which sources. 2. A **curated toolkit** of 30+ CLI-first OSINT tools organized by category — which tool to reach for at each phase. 3. A **reporting framework** that produces structured, evidence-backed due diligence reports with source documentation, red flags, and risk ratings. 4. **Red flag catalogs** for both company and individual investigations so nothing is missed. The methodology traces to the Berkeley Protocol (UN-backed international standard), Bellingcat's investigative journalism standards, and Michael Bazzell's IntelTechniques practitioner framework. See `references/methodology.md` for the full academic grounding. ## When to Use - Investigating a company before a business partnership, investment, or vendor relationship - **Third-party vendor risk assessment — cyber security, data protection, GDPR/NIS2/DORA compliance** - Assessing a vendor/processor before signing a DPA or data-sharing agreement - Background-checking an individual (hire, board appointment, counter-party) - Verifying claims made by an entity (credentials, history, associations) - Assessing sanctions, PEP, or regulatory exposure - Mapping an entity's digital footprint and breach exposure - Completing a TPRM (Third-Party Risk Management) questionnaire or security review - Any scenario where the user says "look into," "check out," "due diligence," "vendor assessment," "supplier risk," "background check," "investigate," "vet this vendor," or "what do we know about" **Don't use for:** Criminal investigations requiring legal authority, accessing paywalled/classified data without authorization, or replacing legal counsel's formal DD process. This skill uses publicly available information only. ## Prerequisites Install the core toolset before the first investigation: ```bash # Python tools (pip-installable) pip install sherlock-project maigret holehe theHarvester spiderfoot shodan h8mail recon-ng instaloader toutatis # Go-based tools go install github.com/owasp-amass/amass/v4/...@master go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest # Optional: Docker-based tools for heavy automation # docker pull smicallef/spiderfoot (if not using pip version) # docker pull yogeshojha/rengine (full recon framework with web UI) ``` See `scripts/install-tools.sh` for a one-shot installation script. **API keys to configure (optional but recommended):** - Have I Been Pwned (HIBP) API key — breach checking - Shodan API key — device/infrastructure search - DeHashed API key — breach data search - OpenCorporates API key — company registry queries (higher rate limits) ## Investigation Workflows ### Company Due Diligence (8 Phases) Execute phases in order. Each phase builds on the previous. Skip phases only when explicitly told to. **Phase 1: Corporate Identity & Structure** Goal: Confirm the entity legally exists and understand its structure. ``` theHarvester -d -b all # emails, subdomains, names curl -s "https://api.opencorporates.com/v0.4/companies/search?q=" | python3 -m json.tool # Check national business registry (Companies House, SEC EDGAR, etc.) spiderfoot-cli -s -t DOMAIN_NAME,EMAIL_ADDRESS,HUMAN_NAME ``` What to record: legal name, registration number, jurisdiction, date of incorporation, legal structure, officers/directors, filing history. **Phase 2: Financial Health** Goal: Assess financial stability, funding, and red flags. ``` # Search SEC EDGAR for public filings # Check Crunchbase/PitchBook for funding rounds # Look for tax liens, judgments, bankruptcies via court records ``` Sources: SEC EDGAR, annual reports, D&B, Experian, court records, Crunchbase. Use the browser for registries without APIs. **Phase 3: Regulatory & Compliance** Goal: Screen for sanctions, watchlists, and regulatory actions. ``` # Check OFAC SDN list curl -s "https://sanctionslistservice.ofac.treas.gov/api/Search" # requires setup # Check industry-specific regulators (FINRA, FDA, EPA, FTC) ``` What to record: sanctions matches, PEP status, regulatory enforcement history, license validity. **Phase 4: Litigation & Legal History** Goal: Uncover lawsuits, criminal proceedings, regulatory enforcement. ``` # Browser-based: PACER (US), state court databases, LexisNexis, Westlaw # For non-US: national court databases, EUR-Lex, BAILII ``` **Phase 5: Reputation & Media** Goal: Assess public perception, controversies, customer sentiment. ``` # Browser: Google News, Factiva, Glassdoor, BBB, TrustPilot # Social media monitoring ``` **Phase 6: Operations & Supply Chain** Goal: Understand physical presence, scale, products, IP. ``` shodan domain # exposed infrastructure amass enum -d # subdomain mapping subfinder -d # passive subdomain enum ``` What to record: locations, employee count via LinkedIn, IP portfolio (USPTO), major customers/suppliers. **Phase 7: Digital Footprint & Cybersecurity** Goal: Map online presence, breach history, security posture. ``` curl -s "https://haveibeenpwned.com/api/v3/breacheddomain/" -H "hibp-api-key: $HIBP_KEY" h8mail -t # breach hunting shodan host # exposed services # Check Wayback Machine for historical website changes ``` What to record: domains, breach exposure, exposed services, historical web presence. **Phase 8: Beneficial Ownership & Network Analysis** Goal: Identify who really owns/controls the entity. ``` curl -s "https://api.opencorporates.com/v0.4/companies///statements" # Search ICIJ Offshore Leaks database # Search OCCRP database ``` What to record: UBOs, offshore structures, political connections, related entities. ### Individual Due Diligence (7 Phases) **Phase 1: Identity Verification** — Confirm name, aliases, DOB, nationality via public records. **Phase 2: Professional History** — LinkedIn, SEC filings (board roles), Google Scholar, USPTO patents. ``` theHarvester -d -b linkedin # Browser: LinkedIn profile analysis ``` **Phase 3: Financial Profile** — Property records, bankruptcy, tax liens, sanctions. **Phase 4: Legal & Criminal History** — Court databases, sex offender registries, professional discipline. **Phase 5: Digital Footprint** — Social media, usernames, emails, breach exposure. ``` sherlock # 400+ social networks maigret --all-sites # 3000+ sites, detailed dossier holehe # 120+ site registration check h8mail -t # breach/leak search ghunt email # Google account investigation ``` **Phase 6: Associations & Network** — Business partners, family, political donations, social graph. **Phase 7: Reputation & Media** — News mentions, social sentiment, controversy, awards. ### Fuzzy Search & Partial Information Real investigations rarely start with complete, verified data. Use these strategies when you have ambiguous, partial, or uncertain input. **Step 0: Assess what you actually have.** Before running any tools, categorize the input: - **Exact & verified** — full legal name, confirmed domain, known email → proceed with standard phases - **Partial** — first name only, company without jurisdiction, username without platform → generate variants first - **Ambiguous** — common name (John Smith), name in non-Latin script, nickname, typo possible → widen search, then narrow - **Single data point** — only a phone number, only an email, only a domain → pivot from that point **Name variant generation.** For individual names, generate all plausible variants before searching: ``` # Use the variant generator script python3 scripts/generate-variants.py "Robert J. Smith" # Manual strategy if script unavailable: # 1. Full formal: Robert James Smith # 2. First + Last: Robert Smith # 3. Initial + Last: R. Smith, R Smith, RJ Smith # 4. Nicknames: Bob Smith, Bobby Smith, Rob Smith # 5. Reversed: Smith Robert, Smith R # 6. Common typos: Robert Smyth, Robert Smithe # 7. Hyphenated: Robert James-Smith # 8. Middle name as first: James Smith ``` Run Sherlock/Maigret with the top 3-5 most likely variants in parallel. Cross-reference results — matching profile photos or consistent bios across variants increase confidence. **Company name variant strategy.** Legal names differ from trading names: ``` # Example: "Acme Corp" could be registered as: # - Acme Corporation # - Acme Corp LLC # - Acme Corp Ltd # - Acme Corporate # - The Acme Corporation # - Acme (without suffix) # Search strategy: # 1. Exact match on OpenCorporates # 2. Fuzzy/starts-with search on OpenCorporates # 3. Domain WHOIS lookup (acme.com → find registrant name) # 4. LinkedIn search for company page # 5. Trademark database search (USPTO/WIPO) ``` **Phonetic matching.** When you only know how a name sounds (heard verbally, transliterated from non-Latin script): ``` # Soundex/Metaphone variants for "Mohammed": # Muhammad, Mohammad, Mohamed, Muhammed, Mohamad, Muhamed # Strategy: generate all common transliterations, search all of them # Use the variant script with --phonetic flag: python3 scripts/generate-variants.py "Mohammed" --phonetic ``` **Pivoting from a single data point:** | You have | Pivot to find | |----------|--------------| | Email address | Username (part before @), domain → company, holehe registered sites | | Phone number | Carrier lookup → country/city → name databases, WhatsApp/Telegram check | | Domain name | WHOIS → registrant, theHarvester → emails, Amass → subdomains | | Username | Maigret/Sherlock → other profiles → real name, email, location | | Profile photo | Reverse image search → other accounts, original source | | Physical address | Property records → owner, Google Maps → business at location | **When to widen vs narrow:** - **Widen when:** zero results on initial search, common name (need to find the right one), entity may have rebranded - **Narrow when:** too many results (add location, age range, employer), found probable match (verify with additional data points) - **Stop widening when:** you have 5-15 candidate matches to verify - **Stop narrowing when:** you have 1-3 high-confidence matches with 2+ corroborating data points each **Uncertainty tracking.** When input is fuzzy, tag every finding with confidence: - **[Confirmed]** — 2+ independent sources agree, no contradictions - **[Probable]** — 1 strong source + circumstantial support, or 2 sources with minor inconsistency - **[Possible]** — 1 source only, or plausible but unverified - **[Unverified]** — Lead only, needs follow-up investigation - **[Disconfirmed]** — Was a candidate but ruled out by contradictory evidence **Multi-wave search strategy for common names:** ``` Wave 1: Name + known location (city/country) Wave 2: Name + known employer/school Wave 3: Name + known username/email Wave 4: Cross-reference waves 1-3 — which person appears in multiple? Wave 5: Deep-dive on the intersecting candidate(s) ``` Never present a common-name search result as definitive without corroborating data points (location, employer, photo match, consistent bio details). ### Third-Party Vendor Cyber Risk & Data Protection Assessment Use this workflow when vetting a vendor, processor, or technology partner before sharing data, integrating systems, or signing a contract. This is the compliance-grade variant of company DD — designed for DPA (Data Protection Agreement) due diligence, GDPR Article 28 assessments, and cyber supply chain risk management. **When to use this variant instead of standard company DD:** - Vendor will process personal data on your behalf (GDPR processor assessment) - Vendor will connect to your network/systems (cyber supply chain risk) - Vendor will host or store your data (cloud/SaaS assessment) - Regulatory requirement (GDPR, NIS2, DORA, PCI DSS, HIPAA, POPIA) - You're completing a vendor security questionnaire or TPRM (Third-Party Risk Management) assessment **Phase V1: Data Protection & Privacy Posture** ``` Goal: Understand what data the vendor handles, where, and under what legal framework. Checklist: - What personal data categories does the vendor process? (PII, health, financial, minors, etc.) - Where is data stored/processed? (data residency — specific countries/regions) - Does the vendor transfer data internationally? If so, under what mechanism? (SCCs, BCRs, adequacy decision) - Does the vendor have a DPA (Data Protection Agreement) or DPA template available? - Does the vendor use subprocessors? If so, who are they and where are they? - What is the vendor's breach notification timeline? (GDPR requires 72 hours) - Privacy policy: clear, accessible, GDPR-compliant? Or vague and buried? - Cookie/tracking consent mechanism on their website (basic hygiene check) Key sources: - Vendor's privacy policy and terms of service - Vendor's DPA (if published) - Subprocessor list (required by GDPR Art. 28 for processors) - ICO/DPA register (UK), CNIL (France), or local DPA public registers ``` **Phase V2: Security Certifications & Assurance** ``` Goal: Verify the vendor's security claims with independent evidence. Checklist: - SOC 2 Type II report — request and review (not just "SOC 2 compliant" claim) - ISO 27001 certificate — verify on the certification body's public register - PCI DSS compliance — if handling payment card data, verify on VISA/Mastercard registers - HIPAA compliance — if handling US health data, request BAA (Business Associate Agreement) - FedRAMP — if US government, verify on the FedRAMP marketplace - Cyber Essentials / Cyber Essentials Plus (UK) - Penetration test summary — when was the last test? By whom? Remediation status? - Bug bounty or vulnerability disclosure program — does it exist? Is it responsive? Key sources: - Certification body public registers (ISO 27001: look up the cert number on the CB's site) - Vendor's trust/security page - SOC 2 report (request directly — not publicly available) - Bug bounty platforms: HackerOne, Bugcrowd ``` **Phase V3: Breach & Incident History** ``` Goal: Has this vendor been breached? How did they handle it? h8mail -t @ # employee emails in breaches curl -s "https://haveibeenpwned.com/api/v3/breaches" | grep -i "" # Search: " data breach" " security incident" # Search: " ransomware" " leak" Checklist: - Any publicly disclosed breaches? When? What data? Root cause? - Any regulatory fines or enforcement actions? (ICO, CNIL, FTC, state AGs) - Any class action lawsuits related to data breaches or privacy violations? - Any dark web mentions of the vendor's data? (ransomware leak sites, forums) - How did the vendor respond to past incidents? Transparent or evasive? - Any past-due security patches or end-of-life software mentioned in breach reports? Key sources: - Have I Been Pwned (domain search) - State AG data breach notifications (US) - ICO enforcement action register (UK) - FTC privacy enforcement cases - Google News search for breach history - Ransomware leak site monitoring (Ransomlook, DarkFeed) ``` **Phase V4: Technical Security Posture** ``` Goal: Assess the vendor's externally visible security hygiene. shodan domain # exposed services amass enum -d # subdomain discovery subfinder -d # passive subdomain enum # Check TLS/SSL configuration curl -sI https:// | grep -i strict-transport- … ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [mtjikuzu](https://github.com/mtjikuzu) - **Source:** [mtjikuzu/hermes-osint-skill](https://github.com/mtjikuzu/hermes-osint-skill) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-mtjikuzu-hermes-osint-skill-hermes-osint-skill - Seller: https://agentstack.voostack.com/s/mtjikuzu - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.