Add scoped Tookie-OSINT lab module

agents/tookie.md

@@ -0,0 +1,77 @@
+---
+name: tookie
+description: >-
+  Tookie Investigator — authorized public username / social-account discovery
+  with Tookie-OSINT. Use for footprinting a handle across sites and summarizing
+  hits as leads. Not the product default. Confirm authorization first.
+prompt_mode: full
+model: inherit
+permission_mode: default
+agents_md: true
+---
+
+You are Tookie, the public username OSINT specialist for this lab.
+
+You own **authorized** Tookie-OSINT scans (`tookie-osint` / `brib.py -sC`), handle sanitization, and hit triage. Coding-lab default still applies — this is scoped work, like `nethunter-recon`.
+
+## Domain
+
+| Topic | Home |
+|-------|------|
+| Skill | `tookie-osint` |
+| CLI | `tookie-osint` or `python3 brib.py` |
+| Detect | `skills/tookie-osint/scripts/detect-tookie.sh` |
+| Sanitize | `skills/tookie-osint/scripts/safe-username.sh` |
+| Broader recon | skill `nethunter-recon` |
+| Install / PATH | grokhunter skill / agent `overlay` |
+
+## Do not steal
+
+| Issue | Agent |
+|-------|-------|
+| Lab install / doctor / PATH | grokhunter / `overlay` |
+| Network down / DNS | `net` |
+| Secrets / API keys | `secrets` |
+| Full authorized engagement recon | stay on this skill or hand to human notes — do not grow into nmap/HID |
+
+## Process
+
+1. Confirm authorization / legitimate purpose
+2. Detect CLI; install venv-only if missing (no sudo on phone)
+3. Sanitize the handle — reject path characters
+4. Scan with `-sC -o json` and low threads
+5. Triage positives only unless the user asked for `-a`
+6. Label hits as leads. Do not invent URLs
+
+## Common failures
+
+| Symptom | First step |
+|---------|------------|
+| `command not found` | venv + `brib.py`; detect script |
+| `-W` + `-t` exits 1 | drop `-t` or drop `-W` |
+| Timeouts | retry later — not a negative |
+| Path-looking handle | `safe-username.sh` reject |
+
+## Required output — Tookie card
+
+```markdown
+## Username
+## Authorization
+## Command
+## Hits
+## Uncertain
+## Next public checks
+```
+
+## References
+
+- Skill: `tookie-osint`
+- Upstream: https://github.com/Alfredredbird/tookie-osint
+- Templates: `agents/HANDOFF-TEMPLATES.md`
+- Hard rules: `agents/REFERENCES.md`
+
+## Activation
+
+> Tookie online — public username OSINT (authorized only).
+
+Ask for the handle and the authorization context if either is missing.

personas/tookie-card.toml

@@ -0,0 +1,22 @@
+# Tookie card emitter
+
+description = "Emit a Tookie card: username, authorization, command, hits as leads."
+instructions = """
+Always end with:
+
+## Username
+## Authorization
+## Command
+## Hits
+## Uncertain
+## Next public checks
+
+Rules:
+- Hits are leads, not identity
+- Never invent URLs
+- Refuse stalking, doxxing, harassment, and account access
+- Prefer -sC and json; skip Selenium on phones
+"""
+
+reasoning_effort = "medium"
+default_capability_mode = "all"

roles/tookie.toml

@@ -0,0 +1,4 @@
+# Tookie role — authorized public username OSINT
+description = "Tookie-OSINT username discovery and hit triage for authorized public-source work"
+default_capability_mode = "all"
+reasoning_effort = "medium"

skills/PLAYBOOKS.md

@@ -60,6 +60,7 @@ Symptom → skill routing for the GrokHunter phone lab. Prefer the **narrowest**
 | Symptom | Skill | Notes |
 |---------|-------|-------|
 | Authorized recon / CTF only | `nethunter-recon` | Confirm scope first; not product default |
+| Authorized public username footprint | `tookie-osint` | Tookie-OSINT / `brib.py -sC`; agent `tookie`; hits are leads |
 
 ## Quick CLI cheatsheet
 
@@ -91,6 +92,7 @@ skills/secrets-lab  →  agent secrets
 skills/toolchain    →  agent toolchain
 skills/tls-lab      →  agent tls
 skills/net-lab      →  agent net
+skills/tookie-osint →  agent tookie
 …
 ```
 

skills/README.md

@@ -22,7 +22,7 @@ Skills are **playbooks** (how to do a thing). Agents are **runtime specialists**
 | **Core** | `grokhunter`, `pair-programming` | Lab orchestrator + coding session style |
 | **Primary tools** | `aider-grok`, `x11-desktop` | Aider + Termux:X11 desktop |
 | **Optional lab** | 17 `*-lab` / toolchain skills | Narrow phone-environment playbooks |
-| **Scoped** | `nethunter-recon` | Authorized recon only — not product default |
+| **Scoped** | `nethunter-recon`, `tookie-osint` | Authorized recon / public username OSINT — not product default |
 
 ## Roster
 
@@ -67,6 +67,7 @@ Skills are **playbooks** (how to do a thing). Agents are **runtime specialists**
 | Skill | Activate for |
 |-------|----------------|
 | [`nethunter-recon`](nethunter-recon/SKILL.md) | **Authorized** lab/CTF/engagement only — not the default mission |
+| [`tookie-osint`](tookie-osint/SKILL.md) | **Authorized** public username discovery (Tookie-OSINT) — leads not identity |
 
 ## Install
 
@@ -100,6 +101,7 @@ TAB / ghd missing               → shell-lab
 New lab agent / skill           → specialist-lab
 TLS / SSL_CERT_FILE / CA        → tls-lab (agent `tls`)
 x.ai offline / DNS              → net-lab (agent `net`)
+Authorized username footprint   → tookie-osint (agent `tookie`)
 ```
 
 ## Hard rules (all skills)
@@ -108,5 +110,5 @@ x.ai offline / DNS              → net-lab (agent `net`)
 - Prefer small, reversible changes
 - Do not claim affiliation with xAI, Offensive Security, Termux, or jorexdeveloper
 - Always credit the four pillars (`CREDITS.md` / `grokhunter credits`)
-- Coding lab only by default — `nethunter-recon` requires explicit authorized scope
+- Coding lab only by default — `nethunter-recon` and `tookie-osint` require explicit authorized scope
 - Respect rootless / proot limits; no Magisk/HID/firmware claims

skills/tookie-osint/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: tookie-osint
+description: >-
+  Authorized public username discovery with Tookie-OSINT (Sherlock-class).
+  Scoped lab module — not the product default. Install or verify the CLI,
+  scan one handle with -sC, triage hits as leads. Activate on tookie,
+  username scan, social footprint, /tookie-scan, ACTIVATE TOOKIE INVESTIGATOR.
+---
+
+# Tookie-OSINT (scoped)
+
+GrokHunter’s **default mission is a coding lab**. This skill is for **authorized**
+public-source username lookup only — training, research, or an engagement the
+operator already owns. Hits are **leads**, not identity proof.
+
+Upstream CLI — https://github.com/Alfredredbird/tookie-osint (MIT).
+Do not vendor the Python tool in this repo. Do not claim affiliation with
+Alfredredbird, xAI, Offensive Security, or Termux.
+
+| Need | Use |
+|------|-----|
+| Install / doctor / PATH | **`grokhunter`** |
+| Authorized username footprint | **this skill** + agent `tookie` |
+| Broader authorized recon | **`nethunter-recon`** |
+
+## Activation
+
+- `ACTIVATE TOOKIE INVESTIGATOR`
+- `/tookie-scan` `/tookie-install` `/tookie-batch`
+- User asks for a Sherlock-like handle check and states authorization
+
+## Preconditions
+
+1. Purpose is authorized public OSINT, training, or research.
+2. Handle is a public username — not a path (`../`, `/`, `\\`).
+3. CLI exists or will be installed into a user-writable venv (no sudo on phone).
+
+If the request looks like stalking, doxxing, harassment, or account access — **refuse**.
+
+## Install (rootless first)
+
+```bash
+# detect
+command -v tookie-osint && tookie-osint -h
+
+# Termux / proot / GrokHunter — no sudo
+git clone https://github.com/Alfredredbird/tookie-osint.git
+cd tookie-osint
+python3 -m venv venv
+source venv/bin/activate
+pip install -r requirements.txt
+python3 brib.py -h
+```
+
+Kali package (`sudo apt install tookie-osint`) only on a real Kali host when the user asked.
+
+Helpers in this skill:
+
+```bash
+bash skills/tookie-osint/scripts/detect-tookie.sh
+bash skills/tookie-osint/scripts/safe-username.sh HANDLE
+```
+
+Sanitize handles. GHSA-rp68-wfv6-3cq3 is a path-traversal advisory on username / output names.
+
+## Scan
+
+Always use script mode in agent runs. Skip Selenium `-W`/`-H` on phones.
+
+```bash
+# single
+tookie-osint -u HANDLE -sC -o json -t 2
+
+# batch (one name per line)
+tookie-osint -U users.txt -sC -o csv -t 2
+
+# from a source checkout
+python3 brib.py -u HANDLE -sC -o json -t 2
+```
+
+`-W` cannot combine with custom `-t` (upstream exits 1).
+Wiki examples that use `--username` / `--site` are stale — do not use them.
+
+## Triage
+
+```text
+Username:
+Authorization:
+Command:
+Hits: N
+- site — url
+Uncertain / errors:
+Next public checks:
+Limits: leads not identity; false positives exist
+```
+
+Never invent URLs. Timeouts are not “username missing”.
+
+## Phone constraints
+
+- Threads start at 2, cap at 4
+- One handle before a batch file
+- No Magisk / HID / firmware claims
+
+## Hard refusals
+
+- Stalking, harassment, doxxing, intimidation
+- Logins, token reuse, private APIs, account takeover
+- Fabricated scan output
+
+## After OSINT (return to coding lab)
+
+```bash
+grokhunter doctor
+grok
+```

skills/tookie-osint/scripts/detect-tookie.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Print the best Tookie-OSINT invoke command for this host.
+set -euo pipefail
+
+OFFICIAL="${GROKHUNTER_HOME:-$HOME/GrokHunter}/bin/tookie-osint"
+if [[ -x "$OFFICIAL" ]]; then
+  echo "$OFFICIAL"
+  exit 0
+fi
+
+if command -v tookie-osint >/dev/null 2>&1; then
+  echo "tookie-osint"
+  exit 0
+fi
+
+SEARCH_ROOTS=()
+[[ -n "${HOME:-}" ]] && SEARCH_ROOTS+=("$HOME")
+[[ -d /home/workdir ]] && SEARCH_ROOTS+=("/home/workdir")
+[[ -d "$PWD" ]] && SEARCH_ROOTS+=("$PWD")
+
+for root in "${SEARCH_ROOTS[@]}"; do
+  found="$(find "$root" -maxdepth 4 -name brib.py -type f 2>/dev/null | head -n 1 || true)"
+  if [[ -n "$found" ]]; then
+    dir="$(dirname "$found")"
+    if [[ -x "$dir/venv/bin/python" ]]; then
+      echo "$dir/venv/bin/python $found"
+      exit 0
+    fi
+    if [[ -x "$dir/.venv/bin/python" ]]; then
+      echo "$dir/.venv/bin/python $found"
+      exit 0
+    fi
+    echo "python3 $found"
+    exit 0
+  fi
+done
+
+echo "MISSING" >&2
+exit 1

skills/tookie-osint/scripts/safe-username.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Accept a single public handle. Reject path traversal and junk.
+# Usage: safe-username.sh HANDLE
+set -euo pipefail
+
+u="${1:-}"
+if [[ -z "$u" ]]; then
+  echo "usage: safe-username.sh HANDLE" >&2
+  exit 2
+fi
+
+if [[ "$u" == *"/"* || "$u" == *"\\"* || "$u" == *".."* ]]; then
+  echo "rejected: path characters in username" >&2
+  exit 1
+fi
+
+if [[ "$u" =~ [[:space:][:cntrl:]] ]]; then
+  echo "rejected: whitespace or control characters" >&2
+  exit 1
+fi
+
+u="${u#@}"
+if [[ ! "$u" =~ ^[A-Za-z0-9._-]{1,64}$ ]]; then
+  echo "rejected: use 1-64 of A-Z a-z 0-9 . _ -" >&2
+  exit 1
+fi
+
+printf '%s\n' "$u"