The Problem This repository functions as a curated orchestration of 14 shell scripts that install and invoke 753+ OSINT tools. There is no modular codebase, no test suite, and no CI/CD gate. Shell scripts repeat 136 six-line blocks across 9 files (blueteam.sh, labs.sh, osint.sh, redteam.sh, etc.), creating a maintenance burden for any meaningful code changes. For a technical team evaluating this for operational use, the absence of automated testing and version locking (no lockfile) raises reliability concerns for production-adjacent workflows.

What This Does The repo’s core consists of bash entry points: install.sh, osint.sh, redteam.sh, blueteam.sh, forensics.sh, hardware.sh, labs.sh, and termux.sh. tools.json appears to be the data source listing 753+ tools across 50 categories. Running sudo bash install.sh triggers a multi-distro setup (best on Kali/Debian/Ubuntu via apt, fallback on Arch/Fedora via git/pip/go). Each category script likely iterates or selects from tools.json to invoke installation commands or launch specific tools. The scripts operate primarily on the filesystem (cloning repos, creating dirs) and the package manager (apt). They do not import internal modules—the import graph shows 0 internal modules and 0 edges across 9 analyzed shell files—so each script is largely self-contained, invoking system commands directly. The assets/ directory holds osint_arsenal_logo.png; README.md and CONTRIBUTING.md provide human-facing docs and contribution guidance.

How It Is Wired Entry point → script → system commands. No internal module graph exists; the architecture is flat orchestration. The widest blast radius is install.sh (system-wide setup) and the category scripts that iterate tools.json. Changing the tool list requires editing tools.json or the relevant .sh script. There are no circular dependencies because the codebase is not modular—it is a collection of orchestration scripts without internal function edges.

How To Use It

  • Setup: git clone https://github.com/moses-y/awesome-osint-arsenal && cd awesome-osint-arsenal && sudo bash install.sh
  • Configuration: tools.json holds the tool registry; no environment variables or API keys were detected in the static analysis. Scripts rely on system package managers and git.
  • Running it: sudo bash osint.sh for OSINT tools, sudo bash redteam.sh for red team, sudo bash blueteam.sh for blue team, sudo bash forensics.sh for DFIR, sudo bash hardware.sh for SDR/hardware, sudo bash labs.sh for vulnerable practice apps, or bash termux.sh for the Android subset.

Real-World Use An engagement team needs a quick, reproducible environment for network recon and credential auditing across mixed Linux distros. They clone the repo, run install.sh, then invoke sudo bash redteam.sh to pull in BloodHound, Nuclei, Mimikatz, etc., or sudo bash osint.sh for Sherlock, Maigret, Amass. Within minutes they have a populated toolset without manually resolving 753 install commands. If a tool fails, there is no test gate to catch it, so they validate manually or patch the underlying script.

Code Health & Issues

  • [HIGH/clarity] Duplicated code blocks: 136 repeated 6-line blocks across 9 files (blueteam.sh, labs.sh, osint.sh, redteam.sh, …). Fix: extract shared helpers; DRY the repeated logic.
  • [Medium/SDLC] No test files detected – untested code paths – repository-wide.
  • [Medium/SDLC] No CI/CD pipeline detected – no automated build/test gate – .github/ or CI config absent.
  • Repo hygiene: tests: no | CI: no | Dockerfile: no | licence: yes | lockfile: no | committed secrets: none found.

The Bottom Line This is a functional, one-command orchestration layer for a massive OSINT/recon toolkit, ideal for ad hoc research, red team training, or teams that accept untested shell logic and can manage tool-list drift in tools.json. Maintenance risk is elevated by duplicated repeated blocks, absent tests, and no CI gate; it is not a production-grade software system but a pragmatic convenience layer for security practitioners who need rapid, multi-distro tooling without manual dependency resolution.