/apify-osint-threat-intel

name: apify-osint-threat-intel
description: >
  Use this skill when the user asks to "find CVEs for", "check if my domain is breached",
  "threat intel on", "OSINT on", "security news about", "attack surface of",
  "is this IP malicious", "what vulnerabilities affect", "security advisory for",
  "monitor threats for", "threat actor research", "recent exploits for",
  "data breach check", "security posture of", "what's the threat landscape for",
  "investigate [domain/IP/software]", "is [company] exposed", or any request involving
  vulnerability research, breach detection, threat actor profiling, or security intelligence.
  Requires Apify CLI or Apify MCP server.

author: karthik-zoro-96
author_url: https://github.com/karthik-zoro-96
metadata:
  keywords: "osint, threat-intel, cve, vulnerability, security, cybersecurity, breach, threat-actor, cisa, mitre-attack"

OSINT Threat Intelligence

Real-time security intelligence powered by live threat data via Apify actors. **Never answer security questions from training knowledge alone.** CVEs, breaches, and threat actor activity change daily — always gather live data first, then analyze.

---

Prerequisites

• Apify CLI v1.5.0+: `npm i -g apify-cli`
• Authenticated: `apify login` or `export APIFY_TOKEN=your_token`
• Token: https://console.apify.com/settings/integrations

CLI rules (always follow)

Always pass `--user-agent apify-awesome-skills/apify-osint-threat-intel` on every `apify` CLI call — it's critical for telemetry, never omit it.

apify actors call "ACTOR_ID" -i 'INPUT_JSON' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null
apify datasets get-items DATASET_ID --format json --user-agent apify-awesome-skills/apify-osint-threat-intel > /tmp/results.json 2>/dev/null
jq '.[] | "\(.field1) | \(.field2)"' /tmp/results.json
apify actors info "ACTOR_ID" --input --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null   # check schema

---

Actor Routing Table

| Data Need | Actor ID | Notes | |---|---|---| | CVE lookup | `apify/google-search-scraper` | Query: `site:nvd.nist.gov [product] [version]` | | NVD full record | `apify/website-content-crawler` | URL: `nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX` | | CISA known exploited | `apify/rag-web-browser` | URL: `cisa.gov/known-exploited-vulnerabilities-catalog` | | GitHub advisories | `apify/rag-web-browser` | URL: `github.com/advisories?query=[product]` | | Exploit-DB search | `apify/google-search-scraper` | Query: `site:exploit-db.com [product] [version]` | | Security news | `data_xplorer/google-news-scraper-fast` | Keywords: `"[target]" vulnerability OR exploit OR breach` | | Reddit threat discussion | `harshmaur/reddit-scraper` | `searchTerms` + `withinCommunity` — **one subreddit per run** (`netsec`, then a second run for `cybersecurity`); a value like `netsec OR cybersecurity` silently drops the filter and searches all of Reddit. Always set `postedAfter` (`YYYY-MM-DD`) for recency — `searchTime` is not enforced and the Actor pads the cap with years-old posts. Pay-per-event: $0.02 per run + $0.002 per post; `maxPostsCount` is **per search term**. | | Threat intel Twitter/X | `apidojo/tweet-scraper` | Keywords: `#threatintel [target]`, search mode | | Breach mention search | `apify/google-search-scraper` | Query: `"[domain]" site:pastebin.com OR intext:breach` | | Vendor security advisory | `apify/website-content-crawler` | Direct vendor security page URL | | Shodan exposure hints | `apify/google-search-scraper` | Query: `site:shodan.io "[domain OR org name]"` | | Threat actor research | `apify/rag-web-browser` | MITRE ATT&CK: `attack.mitre.org/groups/` |

**Prefer** `apify/google-search-scraper` and `apify/rag-web-browser` over `website-content-crawler` for speed. **Use** `website-content-crawler` only when you need the full page body (e.g. NVD detail, vendor advisory). **Do NOT** use `website-content-crawler` on: reddit.com, twitter.com, pastebin.com, linkedin.com.

---

Core Workflow

Step 0 — Clarify scope before running anything

Ask the user:

• **Target type**: domain, IP, software/version, CVE ID, threat actor name, or keyword?
• **Goal**: one-time lookup vs. ongoing monitoring brief?
• **Autonomy**: full autopilot, or checkpoint before each actor call?

Step 1 — Identify module

| User says | Module | Steps | |---|---|---| | "Find CVEs for [product]" | CVE Intelligence | 2a | | "Is [domain] breached / exposed" | Domain Threat Profile | 2b | | "Research [threat actor / malware]" | Threat Actor Profile | 2c | | "Security news about [topic]" | Security News Brief | 2d | | "Attack surface of [company]" | Attack Surface Discovery | 2b + 2d | | "Full threat report on [target]" | Multi-Module | 2a + 2b + 2c + 2d |

Step 2a — CVE Intelligence

Gather live CVE data for a product or version:

# 1. Search NVD via Google
apify actors call "apify/google-search-scraper" -i '{
  "queries": "site:nvd.nist.gov CVE [PRODUCT] [VERSION]",
  "maxPagesPerQuery": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 2. Pull full NVD record for each CVE ID found
apify actors call "apify/website-content-crawler" -i '{
  "startUrls": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX"}],
  "proxyConfiguration": {"useApifyProxy": true},
  "maxCrawlPages": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 3. Check if CVE is in CISA's Known Exploited Vulnerabilities list
apify actors call "apify/rag-web-browser" -i '{
  "query": "[CVE-ID] site:cisa.gov/known-exploited-vulnerabilities-catalog",
  "maxResults": 3
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/null

# 4. Check Exploit-DB for public PoC
apify actors call "apify/google-search-scraper" -i '{
  "queries": "site:exploit-db.com [PRODUCT] [VERSION]",
  "maxPagesPerQuery": 1
}' --user-agent apify-awesome-skills/apify-osint-threat-intel --json 2>/dev/