1. Classify the target. Person, company, domain/IP, B2B account, due-diligence subject, or threat entity. If ambiguous, ask the user.
2. Pick a depth. Quick (≤5 min, web search only) → Standard (15–30 min, multi-tool) → Deep (full dossier, may take an hour). Default to Standard unless the user signals otherwise.
3. Run the gates below — every investigation, every time.
4. Route to a workflow. See the routing table.
5. Produce the output contract — a markdown dossier plus a

   findings.json

   sidecar.

• Lawful basis. Public information about a public-facing target (executive, company, public domain) is fine. Private individuals investigated for stalking, harassment, or unauthorized vetting are not. If the request smells like that, decline and say why.
• No prohibited methods. No paid breach databases. No social engineering. No accessing accounts you don't own. No bypassing paywalls or platform ToS. No active probing of infrastructure (port scans, vuln scans) without explicit authorization.
• Scope statement. Write one sentence: "I am researching [target] for [purpose] using [public sources]." If you can't write that sentence cleanly, stop.

references/ethics-and-scope.md

1. Identify all plausible candidates that match the name/handle.
2. Pick a discriminator — employer, location, age range, domain, industry, photo.
3. Confirm the discriminator from a primary source (LinkedIn, corporate bio, company website, official registry).
4. State which candidate you're tracking and which ones you're explicitly not.

references/disambiguation.md

• Trace each claim to a primary source (the entity itself, an authoritative registry, a first-hand account).
• Two sources owned by the same parent, or two articles citing each other, count as one.
• Self-published claims (the target's own LinkedIn, bio, website) are useful for what they claim but not independent confirmation of the underlying fact.

• A — Three or more independent sources, including at least one primary or authoritative.
• B — Two independent sources.
• C — One source, or multiple non-independent sources.
• D — Inferred, likely-but-unconfirmed, or single self-published source.

references/confidence-grading.md

• 3–5 targeted searches.
• Read 1–2 primary sources.
• Output: 2–3 paragraph summary + 3–5 cited findings + confidence grades.
• Use for: triage, "do I care about this", before-a-meeting prep.

• 8–15 targeted searches across general web, LinkedIn, corporate registries.
• Read 5–10 primary sources, including the target's own properties.
• Cross-check at least three claims for source independence.
• Output: full dossier per

  templates/dossier.md

  +

  findings.json

  sidecar.
• Use for: most B2B account work, prospect research, person research.

• Iterative search with progressive narrowing.
• DNS/WHOIS/cert transparency for domain targets.
• Multiple platforms cross-referenced.
• Historical data (Wayback) where it changes the picture.
• Output: full dossier, findings.json, plus a one-page executive summary.
• Use for: due diligence, investment decisions, big-account work.

1. <target-slug>-dossier.md

   — human-readable, follows

   templates/dossier.md

   . Section headers, confidence grades on every claim, source URLs collected at the bottom.

2. <target-slug>-findings.json

   — machine-readable, follows

   templates/findings.schema.json

   . Each finding has

   claim

   ,

   confidence

   ,

   sources[]

   ,

   category

   ,

   extracted_at

   .

osint/<target-slug>/

• LinkedIn search (via web search operators or scraper)
• WHOIS / DNS / certificate transparency for domain work
• GitHub search (free API tier is plenty)
• Wayback Machine (

  web.archive.org

  ) for historical
• Apify or Bright Data actors for social platform extraction (if API keys present)

references/search-operators.md

[ -n "$GITHUB_TOKEN" ]   && echo "github: yes"   || echo "github: no"
[ -n "$BRAVE_API_KEY" ]  && echo "brave: yes"    || echo "brave: no"
[ -n "$APIFY_TOKEN" ]    && echo "apify: yes"    || echo "apify: no"
[ -n "$SHODAN_API_KEY" ] && echo "shodan: yes"   || echo "shodan: no"

• Don't open with the dossier. State the depth, scope, and disambiguation result first; produce the dossier at the end.
• Don't manufacture confidence. A C-grade finding labeled C is useful. A C-grade finding labeled A poisons the rest of the report.
• Don't pad with noise. Five well-sourced findings beat fifty drive-by mentions.
• Don't assume the most prominent match is the right one. The CEO is famous; the IT director you're actually trying to reach is not.
• Don't write speculative biography. If a source doesn't say it, you don't either.
• Don't keep mining after the question is answered. Quick means quick.

• User customizations at

  ~/.opencode/skills/PAI/USER/SKILLCUSTOMIZATIONS/OSINT/PREFERENCES.md

  override defaults.
• Apify actors via

  ~/.opencode/skills/Apify/

  are used when present.
• Memory/context loading from

  ~/.opencode/skills/PAI/SKILL.md

  runs first if the file exists.

Setting up a B2B account intel investigation. Routing to

workflows/b2b-account.md

. Depth: Standard (~20 min). Disambiguation target: Jason Gurash, VP Operations, Avenir Senior Living. I'll confirm that match before reporting any details about him personally. Scope: public sources for sales discovery — corporate site, LinkedIn, news, tech footprint. I'll skip personal-life angles since they're not relevant to the consulting use case. Starting now.