ocas-scout
Scout conducts structured OSINT research on individuals and organizations, providing provenance-backed briefs with cited sources.
Install this skill
or
80/100
Security score
The ocas-scout skill was audited on Sep 25, 2026 and we found 2 security issues across 2 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
medium line 257
Access to home directory dotfiles
SourceSKILL.md
| 255 | - **Public-records scripts use stdlib only** — All fetch scripts in `scripts/fetch_*.py` use Python stdlib only (no pip installs required). They use `urllib.request` with retry logic and respect `Retry-After` headers. 429 responses surface immediately with the upstream's quota message. |
| 256 | - **Entity resolution is token-bag only** — `entity_resolution.py` does NOT use external fuzzy libraries (no rapidfuzz, no jellyfish). Token-bag matching is the upper bound. For Levenshtein, transliteration, or phonetic matching, pip-install separately. |
| 257 | - **ICIJ offshore leaks cache** — First run downloads ~70 MB bulk CSV. Cached for 30 days under `$HERMES_OSINT_CACHE/icij/` (default: `~/.cache/hermes-osint/icij/`). Subsequent runs search the local cache. |
| 258 | - **Statistical significance ≠ wrongdoing** — `timing_analysis.py` p < 0.05 means the timing pattern is unlikely under the null. It does not establish corruption. Always state this in the brief. |
| 259 |
high line 169
Windows registry startup
SourceSKILL.md
| 167 | - **Social Graph**: verified profiles (platform, URL, discovery method, verification evidence) + unverified leads separately. Omit if no handles found. |
| 168 | - **Digital Footprint**: email accounts (Holehe), breaches (h8mail/HIBP), Google data (Ghunt), phone metadata (PhoneInfoga), email risk (EmailRep), dark web (OnionClaw). Omit if no data available. |
| 169 | - **Public Records**: corporate filings (SEC EDGAR), government contracts (USAspending), lobbying disclosures (Senate LD-1/LD-2), sanctions (OFAC SDN), offshore leaks (ICIJ), property records (NYC ACRIS), corporate registry (OpenCorporates), court records (CourtListener), web archives (Wayback), knowledge base (Wikipedia/Wikidata), news monitoring (GDELT). Omit if no public-records investigation was run. |
| 170 | |
| 171 | Read `references/scout_brief_template.md` for the full template. |
Scanned on Sep 25, 2026
View Security DashboardGitHub Stars 2
Rating
5.01
Rate this skill
Categoryeducation research
UpdatedSeptember 26, 2026
hermesfrontenddocxgitapidatabasetestingbackendresearcherdata-analystmarket-research-analysteducation researchdata analytics
indigokarasu/scout