The dependency audit changes the adoption decision
Blackbird completed our recorded setup checks, but pip-audit reported 167 known vulnerabilities. Review those findings before adopting the measured environment for routine investigations. Successful installation does not establish whether its dependencies are suitable for a machine holding sensitive research.
Blackbird is a command-line OSINT tool for searching for accounts by username or email address. Its README describes WhatsMyName integration, report exports and optional AI profiling. These are documented capabilities; our sandbox did not evaluate their results. Treat discovered accounts as leads to inspect, rather than proof that a particular person owns them.
What happened when we ran it
Our November 6, 2026 sandbox run used commit 471ef97. Installation completed in 9 seconds, the build in 1 second and the test step in 6 seconds. Pytest reported four passed and zero failed. The sandbox had 3 CPUs and 8 GB RAM configured. Its image label was ghcr.io/astral-sh/uv:python3.12-bookworm, which does not establish the actual runtime or operating-system version.
The recorded install contained 47 dependencies and occupied 72 MB on disk. The checkout was 2.4 MB, with 69 files and approximately 2,287 source lines. The scan found two CI workflow files, a Dockerfile and a tests directory. These measurements describe one checkout and its recorded checks. They do not measure account-search speed or accuracy.
Pip-audit reported 167 known vulnerabilities. The measurement JSON records eight vulnerable packages, but the supplied evidence contains no package names, advisory identifiers or severity breakdown. It does not establish which findings are reachable through Blackbird or which dependency changes would resolve them. The audit count is a reason to investigate, not evidence that Blackbird has 167 exploitable defects.
No live username or email search, false-positive study, AI-output evaluation or exported-report inspection accompanies the lab record. The README's speed and low-false-positive claims remain upstream claims that we have not reproduced.
Basic search and AI profiling need separate evaluation
The README documents cloning the repository, installing requirements and running separate username or email commands. Its clone example uses p1ngul1n0/blackbird, while this review concerns antoniaci/blackbird. Keep the actual repository identity and selected commit with your results.
The README also contains a PDF email example with the email value missing. That command needs an email argument before it is useful as a search example. We did not execute the documented search, export or AI commands, so they should not be read as validated workflows.
Optional AI has a documented API-key setup step and a daily usage limit. The README says only site names are sent to its AI engine. This is the project's description of the feature, not a traffic observation from our sandbox. If profiling must remain entirely local, this documented arrangement does not meet that requirement.
A list of services associated with a handle does not establish someone's occupation, motives or behavior. Check any generated profile against independent evidence. We did not assess the AI's accuracy or inspect its processing of inputs.
A reported compatibility problem has a merged repair
Issue 215 reported missing support for post_body and strip_bad_char in the username checker. The report describes requests that could miss existing accounts because the checker used the wrong request method or failed to remove specified characters from a username.
Pull request 217 says sites with post_body now use POST requests with their headers, and strip_bad_char characters are removed before the URL is built. The supplied page records merge commit 471ef97 on November 3, 2026, matching the commit in our sandbox record. This supports describing a merged repair at the measured revision. It does not establish that our four tests exercised those cases, and we did not reproduce the reported misses or validate the repair with live searches.
The repository metadata records a last push on November 3, 2026. That and the issue discussion show recent maintenance, without establishing typical response times or sustained support capacity. The supplied record does not establish the latest release status.
Choose alternatives by the output you need
Sherlock documents username account searches and individual text files for the usernames searched. Its README also lists CSV and spreadsheet output. Consider it when account links by username cover your task. We have no comparative evidence that it is faster or more accurate than Blackbird.
Maigret describes gathering information from profile pages into a dossier based on a username. Consider it when page information belongs in the investigation alongside account discovery. Neither alternative was audited or benchmarked in this review; each needs its own dependency and result checks.
Documentation rating and next step
Documentation receives 3/5 on an editorial rubric where 1 means orientation only, 3 means an actionable main path with gaps, and 5 means verified coverage across documented paths. The README supplies basic search and AI commands, but the incomplete PDF email example and different clone owner leave gaps. We did not execute those examples or assess the linked documentation. Setup ease, community and maturity remain unscored because the supplied evidence does not establish them.
For a contained evaluation, use known accounts you have permission to check and inspect both matches and misses. Keep commit 471ef97, or the different revision you select, with the output. Before routine adoption of the measured environment, obtain the advisory details behind the 167 findings and decide which dependency changes are required.