investigate-anything
Start-here router and tradecraft baseline for any investigation into a person, company, domain, image or selector. Sets authorised scope, turns a vague request into an answerable intelligence question, writes a collection plan, picks the right workflow for the starting selector, and applies source grading and competing-hypothesis discipline. Use for "investigate this person or company", "do OSINT on X", "where do I start", or any open-source intelligence, due diligence, background or attribution
Security Assessment
Detected risks:
About investigate-anything
Investigate Anything is the start-here router and tradecraft baseline for open-source intelligence investigations into a person, company, domain, image, or other selector. It solves a framing problem rather than a collection problem: the observation that most bad investigations fail not because tools are missing but because the wrong question was asked, letting an analyst build a confident dossier on the wrong person. It enforces a disciplined front-door process before any collection begins.
The workflow is a sequence of gated steps: set authorized scope (reading the repo ETHICS.md and writing down subject, objective, in-bounds, out-of-bounds, and jurisdiction, with an instruction to stop if authorization cannot be stated); frame a single falsifiable question with a defined negative; write a passive-first collection plan mapping each question to a source; route by starting selector to the appropriate downstream workflow skill; grade every source with the Admiralty letter-and-number scheme as you collect; and test competing hypotheses with an ACH matrix to counter confirmation bias. The skill carries `disable-model-invocation: true`, so it is invoked deliberately rather than automatically, and it leans heavily on legal and ethical discipline including EU/UK personal-data considerations.
It targets investigators across due diligence, fraud, threat intelligence, journalism, and compliance. Because investigation tradecraft is inherently dual-use and can enable surveillance of individuals, the skill foregrounds authorization, minimization, and passive-first collection to keep the work legitimate. Use cases include vetting a supplier's ownership, attributing an account, or establishing whether two domains share an operator.
FAQ
What kind of skill is this?
A methodology and routing guide for OSINT investigations. It sets scope, frames the question, writes a collection plan, routes to the right workflow skill, and applies source grading and competing-hypothesis discipline. It is prose tradecraft, not an automated tool.
Does it enforce ethical and legal boundaries?
Yes. Step 1 requires reading the repo ETHICS.md and writing down authorized scope, out-of-bounds actions, and jurisdiction, and instructs the analyst to stop entirely if they cannot state who authorized the work and on what basis.
Why does it emphasize framing over tools?
Because collection is easy and support can be found for any plausible story; the skill's core claim is that most investigative failures are framing failures, so it requires a falsifiable question and an explicit definition of what a 'no' answer looks like.
How does it grade evidence?
Using the Admiralty (NATO-style) scheme: a letter A-F for the source's reliability and a number 1-6 for corroboration of the information, graded independently on every retained item, judging the source actually touched rather than the one it claims.
Is it invoked automatically?
No. It sets disable-model-invocation, so it is used deliberately as the front door to an investigation and routes to downstream selector-specific workflows.
Install investigate-anything
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
useosint/osint-skills