How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

performing-osint-with-spiderfoot - Skill

Name: performing-osint-with-spiderfoot
Author: mukul975

Imported from mukul975/anthropic-cybersecurity-skills (skills/performing-osint-with-spiderfoot/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill performing-osint-with-spiderfoot. Copyright stays with the author (Apache-2.0).

Performing OSINT with SpiderFoot

Overview

SpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.

When to Use

When conducting security assessments that involve performing osint with spiderfoot
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

SpiderFoot 4.0+ installed or SpiderFoot HX cloud account
Python 3.8+ with requests library
SpiderFoot server running on default port 5001
Optional: API keys for VirusTotal, Shodan, HaveIBeenPwned modules

Steps

Connect to SpiderFoot REST API or use CLI interface
Create a new scan with target specification (domain, IP, email, name)
Select scan modules by use case (all, footprint, investigate, passive)
Monitor scan progress via API polling
Retrieve and parse scan results by data element type
Extract key findings: subdomains, IPs, emails, leaked credentials
Generate structured OSINT intelligence report

Expected Output

JSON report containing OSINT findings organized by data type (domains, IPs, emails, credentials, DNS records), module source attribution, and target profile summary with risk indicators.

Install performing-osint-with-spiderfoot and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "mukul975-anthropic-cybersecurity-skills-performing-osint-db74c8", "kind": "skill", "name": "performing-osint-with-spiderfoot", "description": "Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.", "publisher": "mukul975", "version": "1.0.0", "capabilities": { "domains": [ "coding", "math" ], "tags": [ "skill-md", "osint", "spiderfoot", "reconnaissance", "threat-intelligence", "attack-surface", "target-profiling", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills", "path": "skills/performing-osint-with-spiderfoot/SKILL.md", "ref": "HEAD", "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-osint-with-spiderfoot/SKILL.md", "key": "mukul975/anthropic-cybersecurity-skills/skills/performing-osint-with-spiderfoot/SKILL.md" }, "license": "Apache-2.0" }, "instructions": "# Performing OSINT with SpiderFoot\n\n## Overview\n\nSpiderFoot is an open-source OSINT automation tool with 200+ modules that integrates with data sources for threat intelligence and attack surface mapping. This skill uses the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) to create and manage scans, select modules by use case (footprint, investigate, passive), parse structured results for domains, IPs, email addresses, leaked credentials, and DNS records, and generate target intelligence profiles.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing osint with spi", "cost": { "context_tokens": 419 } }

performing-osint-with-spiderfoot

About

Performing OSINT with SpiderFoot

Overview

When to Use

Prerequisites

Steps

Expected Output

Use it

Install performing-osint-with-spiderfoot and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Manifest

Reviews