OSINT Autopilot

Purpose: eliminate the "thin first pass, then user pushes for more" failure. When the user says run OSINT/recon on <domain> (authorized), execute the whole pipeline to completion and hand back the consolidated workbook — no stopping to ask except the two hard gates below.

Read the companion osint-methodology skill for the framework; this skill is the executable runbook. Feedback memory osint-full-pipeline-default governs the default.

Hard gates (the ONLY reasons to stop and ask)

1. Authorization — if not already asserted, ask the one scope question, then proceed. (Here it's typically already signed.)
2. Stage 6 (active exploitation) — BOLA/IDOR, credential replay, injection confirmation. Never run under autopilot; present the ranked target queue and wait for arming.
3. Out-of-scope siblings — a newly-discovered sibling domain/brand (e.g. <company>.io when scope was .com). Flag; don't scan until confirmed.

Everything in Stages 1–5 runs without pausing for questions.

Run sequence

Let S = ~/.claude/skills/osint-autopilot/scripts.

1. Deterministic recon (Stages 1–3 + harvest + breach + ports)