An OSINT (Open Source Intelligence) investigation skill for Hermes Agent that orchestrates CLI tools through a structured due diligence methodology on companies and individuals.
Turns Hermes Agent into a due diligence investigator. It provides:
- Phased methodology — 8-phase company, 7-phase individual, and 6-phase vendor cyber risk investigation sequences based on Berkeley Protocol, Bellingcat, and IntelTechniques standards
- Vendor risk assessment — Third-party cyber risk and data protection assessment with scoring matrix, compliance mapping (GDPR, NIS2, DORA, PCI DSS, HIPAA, POPIA), and contract clause recommendations
- Curated toolkit — 30+ CLI OSINT tools organized by category (people, company, domain, social media, breach data, automation)
- Fuzzy search — Name variant generation, phonetic matching, transliteration handling, and pivot strategies for incomplete information
- Reporting framework — 11-section structured report template with source documentation, red flags catalog, and risk ratings
- Red flag catalogs — 30+ company, 20+ individual, and 25+ vendor cyber risk red flags
# Clone into your Hermes skills directory
git clone https://github.com/YOUR_USER/hermes-osint-skill.git ~/.hermes/skills/research/osint-due-diligence/Or copy the folder manually:
cp -r hermes-osint-skill ~/.hermes/skills/research/osint-due-diligence/bash scripts/install-tools.sh> Investigate company X for a potential partnership
> Run due diligence on John Doe
> What do we know about example.com?
The skill auto-loads when Hermes detects an investigation/due diligence request.
hermes-osint-skill/
├── SKILL.md # Main skill file (triggers, workflows, tool orchestration)
├── README.md # This file
├── references/
│ ├── methodology.md # Full DD methodology (Berkeley, Bellingcat, IntelTechniques)
│ ├── tool-catalog.md # 30-tool survey with install/usage details
│ ├── report-template.md # 11-section DD report template
│ ├── fuzzy-search-strategies.md # Fuzzy search: variants, phonetics, pivots
│ └── vendor-risk-assessment.md # Vendor cyber risk: 6-phase scoring, compliance mapping
├── scripts/
│ ├── install-tools.sh # One-shot installation script
│ └── generate-variants.py # Name/company variant generator
└── .gitignore
This skill follows professional OSINT standards:
| Framework | Source | Role |
|---|---|---|
| Berkeley Protocol | UN-OHCHR + UC Berkeley (2020) | International investigation standard, 8-phase methodology |
| Bellingcat | Investigative journalism collective | Verification, transparency, right to reply |
| IntelTechniques | Michael Bazzell (former FBI) | Practical tool-based OSINT workflow |
The company DD follows 8 phases: Identity → Financial → Regulatory → Legal → Reputation → Operations → Digital → Ownership.
The individual DD follows 7 phases: Identity → Professional → Financial → Legal → Digital → Network → Reputation.
| Category | Primary Tool | Coverage |
|---|---|---|
| People search | Maigret, Sherlock | 3000+ / 400+ sites |
| Company DD | SpiderFoot (200+ modules), theHarvester | Automated + manual recon |
| Domain recon | Amass, Subfinder, Shodan | DNS, subdomains, infrastructure |
| Social media | Instaloader, Holehe, Osintgram | Instagram, email→site mapping |
| Breach data | H8mail, HIBP API, Mosint | 12B+ breach records |
| Automation | Recon-ng, Osmedeus, Photon | Modular frameworks |
Full catalog: references/tool-catalog.md
- Python 3.8+ with pip (for most tools)
- Go 1.20+ (optional, for Amass, Subfinder, PhoneInfoga)
- API keys (optional but recommended):
- HIBP API key — breach checking
- Shodan API key — device/infrastructure search
- DeHashed API key — breach data search
This skill is designed to be shared and improved. PRs welcome for:
- New tool additions to the catalog
- Additional investigation phases or sources
- Jurisdiction-specific registries and databases
- Bug fixes and methodology improvements
MIT — use freely, attribute if you share.
Created by Mbaunguraije Tjikuzu with Hermes Agent. Research and methodology synthesis: May 2026.