apify-osint-threat-intel

A security report built from what is public today rather than from memory: known weaknesses in a piece of software, leaks or breach talk about a company's website, and what a named hacking group has been up to — every finding rated by severity and linked to its source.

WHEN TO USE

SCOPE

USE FOR

Check whether a product version has known security holes and whether attackers are already using them.
See if a company's domain turns up in breach reports or leaked-password dumps.
Profile a named hacking group's recent campaigns and methods.
Get a security news brief on a topic from the past week, with links.
Get a short list of what to fix first, ranked from critical to low.

NOT FOR

Building profiles of private individuals; it researches organisations, systems and named hacker groups only.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (7)

OSINT Threat Intelligence

Real-time security intelligence powered by live threat data via Apify actors. Never answer security questions from training knowledge alone. CVEs, breaches, and threat actor activity change daily — always gather live data first, then analyze.

Prerequisites

Apify CLI v1.5.0+: npm i -g apify-cli
Authenticated: apify login or export APIFY_TOKEN=your_token
Token: https://console.apify.com/settings/integrations

CLI rules (always follow)

Always pass --user-agent apify-awesome-skills/apify-osint-threat-intel on every apify CLI call — it's critical for telemetry, never omit it.

apify actors call "ACTOR_ID" -i 'INPUT_JSON' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null
apify datasets get-items DATASET_ID --format json --user-agent apify-awesome-skills/apify-osint-threat-intel > /tmp/results.json 2>/dev/null
jq '.[] | "\(.field1) | \(.field2)"' /tmp/results.json
apify actors info "ACTOR_ID" --input --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null   # check schema

Actor Routing Table

Data Need	Actor ID	Notes
CVE lookup	`apify/google-search-scraper`	Query: `site:nvd.nist.gov [product] [version]`
NVD full record	`apify/website-content-crawler`	URL: `nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX`
CISA known exploited	`apify/rag-web-browser`	URL: `cisa.gov/known-exploited-vulnerabilities-catalog`
GitHub advisories	`apify/rag-web-browser`	URL: `github.com/advisories?query=[product]`
Exploit-DB search	`apify/google-search-scraper`	Query: `site:exploit-db.com [product] [version]`
Security news	`data_xplorer/google-news-scraper-fast`	Keywords: `"[target]" vulnerability OR exploit OR breach`
Reddit threat discussion	`harshmaur/reddit-scraper`	`searchTerms` + `withinCommunity` — one subreddit per run (`netsec`, then a second run for `cybersecurity`); a value like `netsec OR cybersecurity` silently drops the filter and searches all of Reddit. Always set `postedAfter` (`YYYY-MM-DD`) for recency — `searchTime` is not enforced and the Actor pads the cap with years-old posts. Pay-per-event: $0.02 per run + $0.002 per post; `maxPostsCount` is per search term.
Threat intel Twitter/X	`apidojo/tweet-scraper`	Keywords: `#threatintel [target]`, search mode
Breach mention search	`apify/google-search-scraper`	Query: `"[domain]" site:pastebin.com OR intext:breach`
Vendor security advisory	`apify/website-content-crawler`	Direct vendor security page URL
Shodan exposure hints	`apify/google-search-scraper`	Query: `site:shodan.io "[domain OR org name]"`
Threat actor research	`apify/rag-web-browser`	MITRE ATT&CK: `attack.mitre.org/groups/`

Prefer apify/google-search-scraper and apify/rag-web-browser over website-content-crawler for speed.
Use website-content-crawler only when you need the full page body (e.g. NVD detail, vendor advisory).
Do NOT use website-content-crawler on: reddit.com, twitter.com, pastebin.com, linkedin.com.

Core Workflow

Step 0 — Clarify scope before running anything

Ask the user:

Target type: domain, IP, software/version, CVE ID, threat actor name, or keyword?
Goal: one-time lookup vs. ongoing monitoring brief?
Autonomy: full autopilot, or checkpoint before each actor call?

Step 1 — Identify module

User says	Module	Steps
"Find CVEs for [product]"	CVE Intelligence	2a
"Is [domain] breached / exposed"	Domain Threat Profile	2b
"Research [threat actor / malware]"	Threat Actor Profile	2c
"Security news about [topic]"	Security News Brief	2d
"Attack surface of [company]"	Attack Surface Discovery	2b + 2d
"Full threat report on [target]"	Multi-Module	2a + 2b + 2c + 2d

Step 2a — CVE Intelligence

Gather live CVE data for a product or version:

# 1. Search NVD via Google
apify actors call "apify/google-search-scraper" -i '{
  "queries": "site:nvd.nist.gov CVE [PRODUCT] [VERSION]",
  "maxPagesPerQuery": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 2. Pull full NVD record for each CVE ID found
apify actors call "apify/website-content-crawler" -i '{
  "startUrls": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX"}],
  "proxyConfiguration": {"useApifyProxy": true},
  "maxCrawlPages": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 3. Check if CVE is in CISA's Known Exploited Vulnerabilities list
apify actors call "apify/rag-web-browser" -i '{
  "query": "[CVE-ID] site:cisa.gov/known-exploited-vulnerabilities-catalog",
  "maxResults": 3
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 4. Check Exploit-DB for public PoC
apify actors call "apify/google-search-scraper" -i '{
  "queries": "site:exploit-db.com [PRODUCT] [VERSION]",
  "maxPagesPerQuery": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

Synthesize: severity (CVSS), exploitability (CISA KEV = active exploitation), public PoC exists (yes/no), patch available (yes/no).

Step 2b — Domain Threat Profile

# 1. Search for breach mentions
apify actors call "apify/google-search-scraper" -i '{
  "queries": "\"[DOMAIN]\" breach OR leak OR hacked OR \"data exposed\"",
  "maxPagesPerQuery": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 2. Check paste sites for credential leaks
apify actors call "apify/google-search-scraper" -i '{
  "queries": "\"[DOMAIN]\" site:pastebin.com OR site:ghostbin.com OR site:rentry.co",
  "maxPagesPerQuery": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 3. Check Shodan exposure hints via Google
apify actors call "apify/google-search-scraper" -i '{
  "queries": "site:shodan.io \"[DOMAIN OR ORG]\"",
  "maxPagesPerQuery": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 4. Scan r/netsec for mentions — one subreddit per run; repeat with "withinCommunity": "cybersecurity"
#    postedAfter = today minus 365 days (YYYY-MM-DD). 3 terms × 5 posts = 15 posts ≈ $0.05.
#    Use `postUrl` as the Source and `createdAt` for the date stamp.
apify actors call "harshmaur/reddit-scraper" -i '{
  "searchTerms": ["[DOMAIN] breach", "[DOMAIN] hack", "[DOMAIN] vulnerability"],
  "withinCommunity": "netsec",
  "postedAfter": "[YYYY-MM-DD]",
  "maxPostsCount": 5,
  "crawlCommentsPerPost": false
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

Step 2c — Threat Actor Profile

# 1. MITRE ATT&CK lookup
apify actors call "apify/rag-web-browser" -i '{
  "query": "[THREAT ACTOR NAME] site:attack.mitre.org",
  "maxResults": 3
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 2. Recent activity via news
apify actors call "data_xplorer/google-news-scraper-fast" -i '{
  "keywords": ["[THREAT ACTOR NAME] attack OR campaign OR malware"],
  "timeframe": "30d",
  "maxArticles": 15
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 3. Community threat intel on Twitter/X
apify actors call "apidojo/tweet-scraper" -i '{
  "searchTerms": ["#threatintel [THREAT ACTOR]", "[THREAT ACTOR] TTPs"],
  "maxItems": 20,
  "sort": "Latest"
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 4. Reddit discussion — postedAfter = today minus 365 days; `createdAt` of the newest post = "Last seen"
apify actors call "harshmaur/reddit-scraper" -i '{
  "searchTerms": ["[THREAT ACTOR NAME]"],
  "withinCommunity": "netsec",
  "postedAfter": "[YYYY-MM-DD]",
  "maxPostsCount": 10,
  "crawlCommentsPerPost": false
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

Step 2d — Security News Brief

# 1. Google News for topic
apify actors call "data_xplorer/google-news-scraper-fast" -i '{
  "keywords": ["[TOPIC] vulnerability OR CVE OR breach OR exploit"],
  "timeframe": "7d",
  "maxArticles": 20
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 2. Reddit r/netsec latest — sort goes into the URL (/new/); `searchSort` does not apply to startUrls
apify actors call "harshmaur/reddit-scraper" -i '{
  "startUrls": [{"url": "https://www.reddit.com/r/netsec/new/"}],
  "maxPostsCount": 15,
  "crawlCommentsPerPost": false
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

Step 3 — Triage and assess

For every finding, apply this classification:

Severity	Criteria
Critical	CVSS ≥ 9.0 OR on CISA KEV list OR public PoC + unpatched
High	CVSS 7.0–8.9 OR active exploitation reported in news
Medium	CVSS 4.0–6.9 OR breach mention without active exploit
Low	CVSS < 4.0 OR historical, patched, no active exploitation
Informational	Exposure hints without confirmed vulnerability

Step 4 — Deliver structured report

Output format:

## Threat Intelligence Report — [TARGET]
Date: [today]

### Executive Summary
[2–3 sentence risk verdict]

### Critical Findings
- [CVE/Finding] — Severity: [X] — Status: [Patched/Unpatched/Active exploit]
  Source: [URL]

### Breach/Exposure Indicators
- [Finding] — Source: [URL]

### Threat Actor Activity (if applicable)
- [Actor] — TTPs: [list] — Last seen: [date]

### Recommended Actions
1. [Immediate action]
2. [Short-term action]
3. [Monitoring recommendation]

### Data Sources
[Bullet list of all URLs cited]

Data Quality Rules

Every claim needs a source URL — no ungrounded assertions
Empty results are intelligence — report them explicitly ("no paste mentions found")
Date-stamp all findings — CVE severity, patch status, and breach reports are time-sensitive
Confidence tiers:
- [Confirmed] — primary source (NVD, CISA, vendor advisory)
- [Reported] — news + community corroboration
- [Unverified] — single secondary source, flag clearly
Parallelize independent actor calls (CVE search + news + Reddit can run simultaneously; the two Reddit runs — netsec, cybersecurity — too)
Budget: warn user if >10 actor calls needed; get approval before proceeding

Troubleshooting

Problem	Fix
`google-search-scraper` returns 0 results	Simplify query, remove `site:` filter, try broader terms
`website-content-crawler` times out on NVD	Use `rag-web-browser` as fallback with direct CVE URL
`harshmaur/reddit-scraper` returns 0 items, or posts from unrelated subreddits	Read the `RUN-SUMMARY` record in the run's key-value store: `inputWarnings` says when `withinCommunity` was dropped (more than one name) or a date was unparseable, `emptyReason` explains 0 items. Shorten the term (Reddit search is literal). Fallback: `fatihtahta/reddit-scraper-search-fast` with `{"subredditName": "netsec", "subredditKeywords": ["[TERM]"], "subredditTimeframe": "month", "maxPosts": 10}` ($0.00149 per post, no start fee; fields `title`, `url`, `subreddit`, `created_utc`, `score`, `num_comments`)
`tweet-scraper` returns sparse results	Broaden to `#cybersecurity [term]` or drop hashtag requirement
CISA KEV page too large to crawl	Use `rag-web-browser` with specific CVE ID as query

Example prompts

"Check if example.com has any known vulnerabilities or appears in recent breach data."
"What's the latest threat intel on CVE-2026-1234 — is it actively exploited?"
"Profile the APT28 group — recent campaigns, TTPs, and infrastructure."

Boundary: This skill researches organizations, infrastructure and named threat groups. It won't build cross-platform profiles of private individuals.

Account or credentials required

1 FOR YOU

01
Install the Apify CLI and sign in; each lookup is a paid run
Install Apify CLI v1.5.0+ with npm i -g apify-cli, then apify login or export APIFY_TOKEN (token at console.apify.com/settings/integrations). The skill warns and asks before going past 10 Actor calls.
You set: APIFY_TOKEN — or sign in with apify login instead

This skill ships inside the Apify Community Skills plugin.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add apify/awesome-skills --skill "apify-osint-threat-intel" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

View on GitHub

Same repository

apify-ads-intelligence
Research, spy on, and analyze ads across Meta (Facebook & Instagram), Google (Ads Transparency Center + paid search results), TikTok (Ads Library + Creative Center), LinkedIn Ad Library, and X (Twitter — promoted tweets, best-effort) using Apify Actors. Use when user asks about competitor ads, ad library research, winning creatives, ad copy analysis, landing page audits from ads, cross-platform ad audits, brand transparency checks, or any task involving paid ad creatives, advertiser data, or ad targeting from public ad libraries.Read full description
apify-ai-search-visibility-tracker
Track whether a brand and its competitors get cited or mentioned across Google AI Overviews, Google AI Mode, ChatGPT Search, Perplexity, Microsoft Copilot, and Google Gemini for a defined set of prompts, on a recurring schedule. Use when user asks to track AI visibility, monitor brand mentions in AI search, track ChatGPT citations, do AI search SEO tracking, GEO tracking (Generative Engine Optimization), AEO tracking (Answer Engine Optimization), monitor Perplexity citations, track AI Overviews mentions, see if their brand shows up in AI search, discover which prompts competitors rank for in AI search, find citation opportunities, or audit a website for AI visibility readiness.Read full description
apify-app-store-intelligence
Pull structured Apple App Store and Google Play data — app metadata, price, rating, the 1–5★ ratings histogram, version, developer, and reviews — and watch it for changes over time. Use when the user asks to look up an iOS or Android app by App ID, bundle ID, package name or app name, compare a set of competitor apps across both stores, monitor a competitor's price or rating for changes, track when an app ships a new version, scrape App Store or Google Play reviews, resolve a bundle ID to a full app record, check an app's rating across multiple country storefronts, build an ASO or app-market dataset, or set up a recurring app-store watch on an app's price, rating and version. One routed Actor, praise-most-high/app-store-intelligence, is built by this skill's author; every other row is unaffiliated (see Disclosure).Read full description
apify-ashby-jobs-scraper
Scrape Ashby jobs or discover companies using Ashby with the Apify Ashby Job Board API Actor (johnvc/ashby-job-board-scraper). Job mode returns live job rows with title, company, location, remote and employment fields, publish date, apply URL, employer-published salary columns, equity flag, and Markdown descriptions. Company mode finds Ashby boards from a bundled directory or checks a prospect list, returning company name, board slug and URL, live open-job count, and verification fields. Takes company names, board slugs, or board URLs; supports pre-billing job filters and publishedAfter feeds. Use for Ashby jobs data or API requests, salary and remote-role collection, job-board pipelines, companies using Ashby/Ashby customers, ATS market maps, prospect checks, and recruiting or sales target lists. Billed per delivered result with no start fee, and MCP-ready for Claude and other AI agents.Read full description
apify-blocked-scrape-triage
Diagnose and recover a scrape that is blocked, throttled, or served empty or partial content, in cost order, before paying for a heavier Actor. Use when a run returns 0 items, when a site answers 403, 429 or a challenge page, when the HTML comes back empty or truncated, when a request fails with no response at all, when the page shows data in a browser that the Actor does not see, or when a scraper that worked yesterday suddenly returns nothing. Triggers - "I'm getting blocked", "403 from the site", "429 rate limited", "Cloudflare challenge", "scraper returns empty results", "connection reset", "page loads in my browser but not in the Actor", "do I need residential proxies", "should I switch to a browser", "my scraper broke overnight". Escalates in cost order - a cheaper published source first, then reachability, request rate and IP spread, request fidelity, session tokens, the site's own internal API, browser last.Read full description
apify-booking-host-leads
Find and enrich B2B leads from Booking.com - hotels, apartments, and vacation rentals - and pull each host's or property manager's real contact details (email, phone, company name, registration number). Use when the user says things like "get emails from Booking.com", "Booking.com lead generation", "find tour operator / property manager / host contacts", "scrape accommodation owner emails", or "build a list of Booking hosts". The host's email is usually already inside the Booking scraper's traderInfo field (EU/AU trader-transparency disclosure) - this skill leads with that and uses a Google Maps email scraper only as a fallback, instead of relying on Google Maps first (which mostly returns the wrong business).Read full description