Loading...
Loading...
Found 22 Skills
Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.
Prevent and fix Google Safe Browsing "Dangerous site" flags. Use when launching a public web app, buying/picking a domain, building a login or signup page, or when any site shows a red "Dangerous site" / "Deceptive site" warning in Chrome, Brave, Safari, Firefox, or Edge. Triggers on "dangerous site", "deceptive site", "site blocked", "safe browsing", "phishing flag", "red warning screen".
Guides Solana-specific on-chain forensics—ATA resolution, SPL instruction parsing, transaction history via RPC and indexers (e.g. Helius-style APIs), fund-flow graphs, Solana clustering heuristics, and program authority review. Use when the user investigates Solana wallets, SPL tokens, DEX/Jito flows, rug or phishing patterns on Solana, or needs evidence-structured tracing reports with public data only.
Points to Impersonator (EVM) and Impersonator Solana—open-source tools to connect to dApps via WalletConnect (and related flows) while presenting an arbitrary address for UI exploration without holding that address’s keys. Use when the user names impersonator.xyz, solana.impersonator.xyz, or the GitHub repos for local dev—not for phishing, identity fraud, or circumventing dApp or legal controls.
Guides multi-chain wallet and entity clustering using public bridge traces, wrapped-asset flows, temporal and behavioral heuristics, unified graphs with chain-prefixed addresses, and confidence scoring. Use when the user asks for cross-chain clustering, bridge hop analysis, multichain scam or phishing infrastructure mapping, laundering-pattern education from observable flows, or Arkham/Nansen-style entity graphs—without claiming ground-truth identity from heuristics alone.
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.
Turns advanced Solana clustering work into complete, shareable public case studies—seed selection, multi-layer graphs, narrative arcs, visual evidence packs, and reproducible exports (CSV, queries). Use when the user wants a Solana rug/Sybil/sniper/phishing case study, X/thread writeup, educational fraud exposé from on-chain data, or timestamped evidence package built from clusters and heuristics.
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat
Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.
KnowBe4 integration. Manage Users, Roles, Organizations, Persons, Groups, Campaigns and more. Use when the user wants to interact with KnowBe4 data.