Agent skill · security · aiskillstore
investigate-without-getting-made
Investigator OPSEC — threat-model who might notice you, control your attribution surface across IP, ASN, browser and TLS fingerprint, timing and logged-in accounts, separate research identity from real identity, build and age a sockpuppet research persona, and choose between VPN, residential proxy and Tor. Use when setting up a research account, avoiding tipping off a subject, worrying about LinkedIn profile-view leakage, needing a burner phone or email, or hardening a research VM or browser profile. Applies to covert due diligence, insider-threat investigation, source protection in journalism, and law-enforcement online work. Reference at useosint.com/skills/investigate-without-getting-made.
Why this skill is useful
Provides detailed operational security protocols and strategies for covert investigations that the AI cannot generate from general knowledge.
What it needs
About 10k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Investigate without getting made Collection is bidirectional. Most investigators are burned not by a clever adversary but by a platform doing exactly what it advertises: telling the subject who looked at their profile, suggesting the investigator to the subject as someone they may know, or marking a story as viewed. The default failure is not a leaked IP address. It is being logged into a real account. Threat-model first OPSEC effort should be proportionate. Answer three questions before you spend a day building infrastructure — or before you decide you need none. 1. Who might notice? A dormant shell company, a moderately technical individual, a criminal group running monitored infrastructure, or a state service. Their capability sets the bar. 2. What would they see? Passive collection: a line in a server log. A logged-in visit: your name. An interaction: your persona and its history. 3. What is the consequence? Nothing, or evidence destroyed and accounts gone dark, or the investigation attributed to your organisation and disclosed, or physical risk to you or a source. Situation Proportionate posture --- --- Registries, archives, CT logs, court records Normal browser, no persona. You are one of thousands. Viewing a target's public website Clean browser profile, commercial VPN, no logged-in sessions. Any logged-in platform view of a target Persona account, dedicated profile, and check the platform's viewer-notification behaviour first. Target operates monitored infrastructure or is technically capable Dedicated VM, non-datacentre egress, no reused fingerprint, timing discipline. Organised crime, harassment risk, physical safety in play Everything above plus compartmented hardware, and a colleague who knows what you're doing. Over-engineering costs too: a locked-down setup gets CAPTCHA'd, rate-limited and blocked, so you collect less, and unusual configurations are themselves distinctive. Blend in where blending in is the goal. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/investigate-without-getting-made