Stats
Actions
Tags
Produces an OSINT brief on social media accounts: authenticity analysis, narrative tracking, coordination detection for investigative reporting.
How this skill is triggered — by the user, by Claude, or both
Slash command
/autopunk-media-skills:social-media-intelligenceThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Produces a structured open-source intelligence brief on a social media account or set of accounts, covering account authenticity analysis, narrative tracking, and coordination-detection patterns to support investigative reporting.
Produces a structured open-source intelligence brief on a social media account or set of accounts, covering account authenticity analysis, narrative tracking, and coordination-detection patterns to support investigative reporting.
Required: The account(s) to analyze (platform, handle or URL, and the context of why this account matters to the investigation); the specific question you are trying to answer (authenticity, origin of a claim, coordination, influence) Optional: A timeframe to focus on; related accounts you suspect are connected; the narrative or claim you are tracking; screenshots or archived versions of key posts
Account profile analysis. Examines the account's observable characteristics: creation date relative to activity patterns, username format and history, profile photo (reverse-image searchable), bio claims, follower-to-following ratio, posting frequency and hours of activity. Flags indicators of inauthenticity — new accounts with sudden high output, generic stock profile photos, bios that mimic real organisations without exact matches, follower counts inconsistent with engagement levels.
Content pattern analysis. Reviews the account's posting behaviour: dominant topics, language consistency, hashtag usage, link-sharing patterns, reply behaviour. Identifies whether the account produces original content, amplifies others, or mainly reacts. Notes shifts in topic focus, language, or posting cadence that may indicate a change of operator or purpose.
Narrative tracking. If the investigation concerns a specific claim or narrative: maps when the claim first appeared on the account, what the earliest version said, how the framing evolved, and what other accounts picked it up. Constructs a timeline showing the claim's spread path across platforms. Identifies whether the account was an originator, early amplifier, or late adopter.
Coordination-detection patterns. Looks for signs that multiple accounts are operating in concert: near-simultaneous posting of identical or near-identical content, shared unusual hashtags, mutual amplification clusters, similar account creation dates, overlapping follower networks, and identical link-shortener patterns. Notes the difference between organic communities (people who agree and share similar content independently) and coordinated networks (accounts acting in lockstep with operational signatures).
Attribution boundaries. States clearly what can and cannot be determined from open-source social media analysis alone. Names the specific attribution gap: for instance, "these accounts behave as a coordinated cluster, but open-source analysis cannot determine who operates them or whether the coordination is commercial, political, or state-sponsored."
Evidence preservation guidance. Recommends which posts, profiles, and network connections to archive immediately (using Wayback Machine, Archive.today, or screenshot-with-timestamp tools) in case accounts are deleted or content is edited. Notes anything that has already been deleted during the investigation window.
Structured intelligence brief, 500–1000 words. Sections: Account overview (profile data, creation date, key metrics), Content patterns (topics, behaviour, anomalies), Narrative spread (if applicable — timeline with dates), Coordination indicators (evidence for or against coordinated behaviour), Attribution boundaries (what cannot be determined), Evidence preservation (what to archive now). Direct, factual register. No characterisations beyond what the evidence supports.
Platform: X (Twitter). Account: @CleanWaterNow_EU. Context: This account has been posting aggressively against a proposed EU water-quality directive. A press officer at the European Commission flagged it to our bureau, saying they suspect it is not a genuine grassroots environmental group. Question: Is this account authentic, and is it part of a coordinated campaign? Timeframe: last 90 days.
Social media intelligence brief — @CleanWaterNow_EU
Account overview
Content patterns
The account posts exclusively about the proposed EU Directive 2025/XX on drinking-water quality standards. No other environmental topic appears in 90 days of posts. This single-issue focus, combined with the account's creation date coinciding with the directive's committee-stage announcement, suggests the account was created specifically to oppose this directive.
Language is polished and consistent. Posts use regulatory terminology accurately ("impact assessment," "proportionality test," "delegated acts") — unusual for a grassroots account, typical for a public-affairs professional or communications firm. No spelling errors, no casual tone, no personal anecdotes. Every post includes at least one hashtag from a fixed set: #WaterRights, #EUPolicy, #NoToDirectiveXX, #ProtectOurWater.
The account does not reply to comments or engage in conversation. It posts, retweets selected accounts, and does not interact. Engagement under its posts (likes, replies) is low relative to follower count — averaging 12 likes and 2 replies per post for 4,200 followers.
Coordination indicators
Three other accounts exhibit similar patterns within the same timeframe:
| Account | Created | Followers | Daily posts | Overlap |
|---|---|---|---|---|
| @WaterVoice_DE | 10 weeks ago | 2,800 | 6–10 | Same hashtag set, shares same links |
| @AquaCitizensNL | 9 weeks ago | 1,900 | 5–8 | Identical post text on 14 occasions |
| @DrinkSafe_PL | 10 weeks ago | 2,100 | 7–11 | Same stock-photo provider for profile image |
All four accounts were created within a two-week window. All use the same five hashtags. On 14 occasions in the past 60 days, @CleanWaterNow_EU and @AquaCitizensNL posted identical text within 30 minutes of each other. @WaterVoice_DE shares every link that @CleanWaterNow_EU posts, usually within one hour. All four accounts link to the same two PDF documents hosted on an anonymous file-sharing service — not on any organisational website.
This is not organic agreement. The creation timing, identical content, shared hashtag vocabulary, and mutual amplification pattern are consistent with a coordinated campaign operated by a single entity or a small team using multiple accounts.
Attribution boundaries
Open-source analysis can establish that these accounts behave as a coordinated cluster. It cannot determine:
The anonymous PDF hosting and absence of any organisational website or registration are deliberate opacity. Further attribution would require platform data (IP logs, registration email addresses) available only to X and law-enforcement authorities, or investigative reporting on the PDF documents' authorship metadata.
Evidence preservation
Archive immediately:
Two posts from @DrinkSafe_PL that were visible last week are no longer accessible — they may have been deleted. If screenshots were not taken, those posts are lost.
npx claudepluginhub ur-grue/autopunk-media-skills --plugin autopunk-media-skillsAssesses account authenticity, detects coordinated inauthentic behavior, and tracks narrative spread across social platforms. Useful for investigations, fact-checking, and building evidence trails.
Assesses social media account authenticity with red-flag checklists, detects coordinated inauthentic behavior via timing/content patterns, and tracks narrative spread. For bot detection, campaign analysis, and evidence trails.
Structured OSINT methodology covering target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Guides systematic OSINT campaigns or training.