Agent skill

Tech Stack Teardown

by majiayu000 in majiayu000/claude-skill-registry

Reverse-engineer a company's sales and marketing tech stack from public signals.

MITAuto-check: notesSales & Support

Install Tech Stack Teardown

skills CLI
$ npx skills add majiayu000/claude-skill-registry --skill tech-stack-teardown -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install majiayu000/claude-skill-registry tech-stack-teardown --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/majiayu000/claude-skill-registry.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analysis/tech-stack-teardown .claude/skills/tech-stack-teardown && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
tech-stack-teardown
GitHub stars
666
Used in
2 other repos
Token cost
~3.1k tokens
SKILL.md length
1,126 words
Files
2
Skills in repo
1,273
Repo updated
First seen
Licence
MIT

At a glance

Reverse-engineer a company's sales and marketing tech stack from public signals.

  • Works in 2 steps: Required → Optional (for Apify Technology Profiler)
  • Tasks that involve Web scraping
  • SKILL.md covers What It Detects, How It Works, Cost and Setup, plus 6 more sections
  • Calls python3, pip3 and curl; reaches console.apify.com; needs APIFY_API_TOKEN

What it does

Tech Stack Teardown is an agent skill from majiayu000/claude-skill-registry. Reverse-engineer a company's sales and marketing tech stack from public signals. Detects CRMs, cold email tools, people databases, ad pixels, email delivery services, and outbound sending domains via DNS records, website source inspection, Apify technology profiling, blacklist checks, and public spam complaint searches. Works on single companies or batches. Outputs a structured markdown report per company.

Its SKILL.md is about 3.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `metadata.json`).

It sits in Sales & Support, covering Web scraping, Transactional email and Cold outreach. It works with Apify and SendGrid. The repository describes itself as: Searchable Claude Code skills catalog with source-linked guides and generated registry artifacts. The licence is MIT.

When your agent uses it

  • Tasks that involve Web scraping
  • Tasks that involve Transactional email
  • Tasks that involve Cold outreach

Example prompts

  • “/tech-stack-teardown”

Requirements

  • Python 3
  • A credential in APIFY_API_TOKEN

Workflow steps

2 steps, taken from the step headings in SKILL.md.

  1. Required
  2. Optional (for Apify Technology Profiler)

What it can do on your machine

Read from SKILL.md and the folder at commit 2d14a69. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python3
    • pip3
    • curl

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • console.apify.com

    Also links to:

    • apify.com
    • mxtoolbox.com
    • check.spamhaus.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • APIFY_API_TOKEN

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Tech Stack Teardown loads about 3.1k tokens when it runs. Until then it costs about 107 tokens; SKILL.md has 1,126 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~107
When it runs · the whole SKILL.md, loaded when a task matches
~3.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:112
    # Add to .env:

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from majiayu000/claude-skill-registry at commit 2d14a69, republished under its MIT licence (© majiayu000). 1,126 words, ~3,068 tokens.

Download SKILL.mdSave it as .claude/skills/tech-stack-teardown/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
tech-stack-teardown
description
Reverse-engineer a company's sales and marketing tech stack from public signals. Detects CRMs, cold email tools, people databases, ad pixels, email delivery services, and outbound sending domains via DNS records, website source inspection, Apify technology profiling, blacklist checks, and public spam complaint searches. Works on single companies or batches. Outputs a structured markdown report per company.
tags
competitive-intel

Tech Stack Recon

Reverse-engineer a company's sales, marketing, and outbound infrastructure from public signals. No login, no API access to their tools needed — everything is derived from DNS records, website source code, technology profiling, blacklist databases, and public complaints.

What It Detects

CategoryTools Detected
CRMHubSpot, Salesforce (via SPF, website pixels, DNS)
Cold Email ToolsSmartlead, Instantly, Outreach, Salesloft, Lemlist (via SPF, DKIM, TXT records, website source)
People DatabasesApollo, ZoomInfo, Clearbit, 6sense (via website tracker scripts)
Email DeliverySendGrid, Amazon SES, Postmark, Mailgun, Mandrill (via SPF includes, DKIM selectors)
Email MarketingMailchimp, Brevo, ActiveCampaign, Klaviyo (via DKIM selectors)
Ad RetargetingLinkedIn Insight Tag, Facebook Pixel, AdRoll, Reddit Ads, Twitter Ads (via Apify profiler + source)
Website BuilderWebflow, Framer, Next.js, WordPress (via Apify profiler + source)
Chat / SupportIntercom, Drift, Crisp, Zendesk (via website source)
AnalyticsGoogle Analytics, Segment, Mixpanel, Amplitude, PostHog, Heap (via website source)
Outbound DomainsSeparate cold sending domains (via SPF-only Google Workspace + redirect to primary)

How It Works

The skill runs 5 layers of detection, each revealing different signals:

Layer 1: DNS Records (Free, instant)
MX     → Primary email provider (Google Workspace, Microsoft 365, etc.)
SPF    → Every service authorized to send email on their behalf
DKIM   → Cryptographic proof of which tools actually send email
DMARC  → Email authentication policy (how strict they are)
TXT    → Misc verifications (Smartlead tracking domains, tool verifications)
CNAME  → Subdomains pointing to third-party services

This is the highest-signal layer. SPF and DKIM don't lie — if SendGrid is in their SPF, they use SendGrid.

Layer 2: Website Source Inspection (Free, instant)

Fetches the target website and searches HTML for:

  • Tracking pixels (Apollo, REB2B, HubSpot, Facebook, LinkedIn)
  • Script tags loading third-party tools
  • Meta tags and framework signatures
  • Hidden form handlers and API endpoints
Layer 3: Apify Technology Profiler (Pay-per-use, ~$0.005/domain)

Runs justa/technology-profiling-engine actor for deep detection of 7,000+ technologies using 8-tier inspection with confidence scores. Catches tools that don't appear in source code (loaded dynamically, via GTM, etc.).

Layer 4: Blacklist Checks (Free, instant)

Queries 6 major DNS-based blacklists:

  • Spamhaus (zen.spamhaus.org)
  • Barracuda (b.barracudacentral.org)
  • SpamCop (bl.spamcop.net)
  • SORBS (dnsbl.sorbs.net)
  • SURBL (multi.surbl.org)
  • URIBL (black.uribl.com)
Layer 5: Public Complaint Search (Free)

Web searches for spam complaints on Trustpilot, Reddit, SpamCop forums, and general web. Also searches for the company + tool names to find public mentions of their stack.

Cost

ComponentCost
DNS queriesFree
Website source fetchFree
Blacklist checksFree
Web searchesFree
Apify Technology Profiler~$0.005 per domain

Typical costs:

ScenarioDomainsEst. Cost
Single company1~$0.005
Small batch5~$0.025
Large batch20~$0.10

Skip the Apify profiler with --no-apify for free-only analysis (DNS + source + blacklists).

Setup

1. Required
bash
# dig (DNS lookups) — included on macOS/Linux
which dig

# curl (website source fetch) — included on macOS/Linux
which curl

# Python 3 with requests + dotenv
pip3 install requests python-dotenv
2. Optional (for Apify Technology Profiler)
bash
# Get your token at https://console.apify.com/account/integrations
# Add to .env:
APIFY_API_TOKEN=apify_api_YOUR_TOKEN_HERE

Usage

Single Company
bash
python3 scripts/recon.py --domains pump.co
Batch of Companies
bash
python3 scripts/recon.py --domains "dili.ai,pump.co,runautomat.com"
Free-Only Mode (No Apify)
bash
python3 scripts/recon.py --domains pump.co --no-apify
Output to File
bash
python3 scripts/recon.py --domains "dili.ai,pump.co" --output /path/to/report.md
JSON Output
bash
python3 scripts/recon.py --domains pump.co --json

What the Script Does

For each domain:

  1. DNS Scan — Queries MX, SPF, DKIM (18 common selectors), DMARC, TXT records, and 30+ common subdomains (email, tracking, click, bounce, send, smtp, mail, etc.)
  2. Website Source Scan — Fetches the homepage HTML and greps for 40+ known tool signatures (script URLs, pixel IDs, tracking domains)
  3. Apify Technology Profile (optional) — Runs deep 8-tier technology detection for 7,000+ technologies with confidence scores
  4. Blacklist Check — Queries 6 DNS-based blacklists for the domain
  5. Outbound Domain Detection — Checks if common variations of the domain exist (get[name].com, try[name].com, [name]reach.com, etc.) and analyzes their DNS for cold outbound patterns
  6. Report Generation — Produces a structured markdown report with confirmed tools, evidence, email auth assessment, blacklist status, and an overall assessment

Agent Integration

When using this skill as an agent, follow this flow:

  1. User provides one or more company domains
  2. Run recon.py for all domains (confirm Apify cost if > 5 domains)
  3. Present the report — group findings by:
    • Confirmed tools (with evidence)
    • Email authentication (SPF/DKIM/DMARC assessment)
    • Deliverability (blacklist status + spam complaints)
    • Notable signals (outbound domains, missing DMARC, SPF gaps)
  4. If batch, include a comparative summary table at the end
Agent Without the Script

The agent can perform all checks manually using built-in tools:

DNS checks — Use Bash tool:

bash
dig +short MX example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT selector._domainkey.example.com
dig +short CNAME subdomain.example.com

Website source scan — Use Bash tool:

bash
curl -sL https://www.example.com | grep -oi 'pattern1\|pattern2\|pattern3' | sort -u

Blacklist checks — Use Bash tool:

bash
dig +short example.com.zen.spamhaus.org A

Apify profiler — Use Bash tool with Python:

python
# See scripts/recon.py for the full implementation

Spam complaints — Use WebSearch tool:

"example.com" spam OR unsolicited OR "cold email" OR blacklist

DNS Record Cheat Sheet

SPF Includes → Tool Identification
SPF IncludeTool
_spf.google.comGoogle Workspace
spf.protection.outlook.comMicrosoft 365
sendgrid.netSendGrid
amazonses.comAmazon SES
*.hubspotemail.netHubSpot
*.rsgsv.net or servers.mcsv.netMailchimp/Mandrill
spf.mandrillapp.comMandrill (Mailchimp transactional)
mail.zendesk.comZendesk
*.freshdesk.comFreshdesk
spf.mailjet.comMailjet
spf.brevo.comBrevo (Sendinblue)
_spf.salesforce.comSalesforce
mktomail.comMarketo
postmarkapp.comPostmark
mailgun.orgMailgun
Show full SKILL.md (437 more words)Show less
DKIM Selectors → Tool Identification
Selector PatternTool
google._domainkeyGoogle Workspace
selector1._domainkey / selector2._domainkeyMicrosoft 365
s1._domainkey / s2._domainkey → *.sendgrid.netSendGrid
k1._domainkey → *.mcsv.net or dkim.mcsv.netMailchimp
k2._domainkey / k3._domainkey → dkim2.mcsv.net / dkim3.mcsv.netMailchimp
mandrill._domainkeyMandrill
pm._domainkeyPostmark
smtp._domainkeyGeneric SMTP
em._domainkeyVarious (check CNAME target)
TXT Records → Tool Identification
TXT PatternTool
open.sleadtrack.comSmartlead (custom tracking domain)
hubspot-developer-verification=*HubSpot
anthropic-domain-verification-*Anthropic (Claude)
MS=*Microsoft 365
google-site-verification=*Google Search Console
slack-domain-verification=*Slack
atlassian-domain-verification=*Atlassian (Jira/Confluence)
docusign=*DocuSign
facebook-domain-verification=*Facebook/Meta
_github-pages-challenge-*GitHub Pages
stripe-verification=*Stripe
Website Source Patterns → Tool Identification
Pattern in HTMLTool
assets.apollo.io/micro/website-trackerApollo.io (visitor tracking)
hs-script or js.hs-scripts.comHubSpot
px.ads.linkedin.comLinkedIn Insight Tag
connect.facebook.net or fbq(Facebook Pixel
snap.licdn.comLinkedIn Insight Tag
cdn.segment.comSegment
cdn.mxpnl.com or mixpanelMixpanel
cdn.amplitude.comAmplitude
app.posthog.com or posthogPostHog
widget.intercom.ioIntercom
js.driftt.comDrift
client.crisp.chatCrisp
static.zdassets.comZendesk
s3-us-west-2.amazonaws.com + reb2bREB2B
clearbit.com/tag.js or revealClearbit Reveal
6sc.co or 6sense6sense
tag.demandbase.comDemandbase
d.adroll.comAdRoll
googletagmanager.comGoogle Tag Manager
gtag('config', 'G-*')Google Analytics 4
Cold Outbound Domain Patterns

A separate domain is being used for cold email if it has:

  • Google Workspace MX (or similar) but no product/marketing email tools in SPF
  • SPF that only includes _spf.google.com (sending from raw mailboxes)
  • A 301/302 redirect to the company's primary domain
  • No website content of its own
  • Domain name follows patterns like: [brand]reach.com, get[brand].com, try[brand].com, meet[brand].com, [brand]hq.com

DMARC Assessment Guide

PolicyMeaningAssessment
p=rejectReject unauthenticated emailStrong — best practice
p=quarantineSend to spam if unauthenticatedGood — enforcing
p=noneMonitor only, don't enforceWeak — anyone can spoof the domain
No DMARC recordNo policy at allMissing — wide open to spoofing

Troubleshooting

"No tools detected"
  • The company may be very early-stage with minimal tooling
  • Some tools (like Apollo used only for prospecting, not sending) leave no DNS trace
  • LinkedIn Sales Navigator, Clay enrichment, and similar tools don't leave public signals
  • Try the Apify profiler if you only ran free-only mode
"SPF has Google only but they use Smartlead/Instantly"
  • This is normal. Smartlead and Instantly typically connect to Google Workspace mailboxes via SMTP and send through Google — so SPF passes via Google's include. The cold email tool itself doesn't need its own SPF entry.
  • Look for Smartlead's open.sleadtrack.com in TXT records or website source as confirmation.
"Apify profiler timed out"
  • Some sites take longer to load. The profiler has a 3-minute timeout.
  • Retry once. If it fails again, rely on DNS + source code analysis.
"artisan.ai resolves but redirects to Afternic"
  • The domain is parked/for sale. Check common alternatives: .co, .com, .io.
  • Wildcard DNS (all subdomains resolve to the same IP) is a sign of a parked domain.

© majiayu000, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/analysis/tech-stack-teardown of majiayu000/claude-skill-registry.

  • SKILL.md
  • metadata.json

Open the folder on GitHubat commit 2d14a69

Used in 2 other repositories

We found 3 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in majiayu000/claude-skill-registry, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Tech Stack Teardown next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Tech Stack Teardown compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Tech Stack Teardown this skillmajiayu000/claude-skill-registry6662 repos~3.1kAutomated safety check: NotesMIT
Ops LeadgenLifecycle-Innovations-Limited/claude-ops540—~990Automated safety check: NotesMIT
Apify Buying Signal Detectionapify/awesome-skills264—~5.1kAutomated safety check: NotesApache-2.0
Auto Research Publicgrowthenginenowoslawski/coldoutboundskills742—~2.9kAutomated safety check: PassMIT
Pain Language Engagersgooseworks-ai/goose-skills1.2k1 repos~2.1kAutomated safety check: NotesMIT
Etsy Shop Sales Historysickn33/agentic-awesome-skills47k1 repos~1.2kAutomated safety check: PassMIT

Similar skills

  • Ops Leadgen

    Lifecycle-Innovations-Limited/claude-ops

    OPS on-demand: This skill should be used when the user asks to "leadgen drafts", "cold email approve"…

    540 GitHub stars~990 tokensUpdated yesterday
    Sales & SupportAuto-check: notes
  • Apify Buying Signal Detection

    apify/awesome-skills

    Official

    Set up a recurring buying-signal detection pipeline that finds companies showing buying intent across three signal types — job postings (hiring for the persona), fundraising events (recent raises)…

    264 GitHub stars~5.1k tokensUpdated 16 days ago
    Business, Finance & HRAuto-check: notes
  • Auto Research Public

    growthenginenowoslawski/coldoutboundskills

    Autonomous cold email campaign launcher. An agent skill from growthenginenowoslawski/coldoutboundskills.

    742 GitHub stars~2.9k tokensUpdated 3 days ago
    Sales & SupportAuto-check passed
  • Pain Language Engagers

    gooseworks-ai/goose-skills

    Find warm leads by searching LinkedIn for pain-language posts — the frustrations, complaints, and operational struggles your ICP talks about publicly.

    1.2k GitHub starsUsed in 1 repo~2.1k tokens
    Sales & SupportAuto-check: notes
  • Etsy Shop Sales History

    sickn33/agentic-awesome-skills

    Read Etsy shop sales counters, deltas, and breakout flags from Apify Actor publicrecords/etsy-shop-velocity (MCP panel snapshot).

    47k GitHub starsUsed in 1 repo~1.2k tokens
    Sales & SupportAuto-check passed
  • Personalize Message

    Othmane-Khadri/YALC-the-GTM-operating-system

    Generate a personalized outbound message (LinkedIn DM or cold email) for a single prospect by combining a template with the lead's profile, company, and recent signals.

    317 GitHub stars~1.3k tokensUpdated 1 mo ago
    Sales & SupportAuto-check: notes

More from majiayu000/claude-skill-registry

All 1,273 skills in this repo
  • Deep Research

    majiayu000/claude-skill-registry

    Multi-source deep research using firecrawl and exa MCPs. An agent skill from majiayu000/claude-skill-registry.

    666 GitHub starsUsed in 6 repos~1.1k tokens
    Auto-check passed
  • Exa Search

    majiayu000/claude-skill-registry

    Neural search via Exa MCP for web, code, and company research.

    666 GitHub starsUsed in 5 repos~856 tokens
    Auto-check passed
  • Fal AI Media

    majiayu000/claude-skill-registry

    Unified media generation via fal.ai MCP — image, video, and audio.

    666 GitHub starsUsed in 5 repos~1.7k tokens
    Auto-check passed
  • Pyzotero

    majiayu000/claude-skill-registry

    Interact with Zotero reference management libraries using the pyzotero Python client.

    666 GitHub starsUsed in 5 repos~1.6k tokens
    Auto-check: notes
  • Bgpt Paper Search

    majiayu000/claude-skill-registry

    Search scientific papers and retrieve structured experimental data extracted from full-text studies via the BGPT MCP server.

    666 GitHub starsUsed in 4 repos~619 tokens
    Auto-check: notes
  • Bio Alignment Pairwise

    majiayu000/claude-skill-registry

    Perform pairwise sequence alignment using Biopython Bio.Align.PairwiseAligner.

    666 GitHub starsUsed in 4 repos~1.7k tokens
    Auto-check passed

Works with

Categories

Questions about Tech Stack Teardown

What does Tech Stack Teardown do?

Reverse-engineer a company's sales and marketing tech stack from public signals. Tech Stack Teardown is an agent skill from majiayu000/claude-skill-registry. Reverse-engineer a company's sales and marketing tech stack from public signals.

When should I use Tech Stack Teardown?

Tech Stack Teardown fits situations like: tasks that involve Web scraping; tasks that involve Transactional email; tasks that involve Cold outreach.

How do I install Tech Stack Teardown in Claude Code?

Run `npx skills add majiayu000/claude-skill-registry --skill tech-stack-teardown -a claude-code`. Or copy the skill folder (skills/analysis/tech-stack-teardown in majiayu000/claude-skill-registry) into .claude/skills/tech-stack-teardown in your project. Claude Code loads it when a task matches its description.

How do I install Tech Stack Teardown in Codex?

Run `npx skills add majiayu000/claude-skill-registry --skill tech-stack-teardown -a codex`. Or copy the skill folder (skills/analysis/tech-stack-teardown in majiayu000/claude-skill-registry) into .agents/skills/tech-stack-teardown in your project. Codex loads it when a task matches its description.

Can I use Tech Stack Teardown in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add majiayu000/claude-skill-registry --skill tech-stack-teardown -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/tech-stack-teardown, .gemini/skills/tech-stack-teardown, .github/skills/tech-stack-teardown and .opencode/skills/tech-stack-teardown in your project.

What does Tech Stack Teardown need to run?

Going by SKILL.md and its folder, Tech Stack Teardown needs the command-line tools its instructions call (python3, pip3 and curl) and credentials named APIFY_API_TOKEN. Our summary lists: Python 3; A credential in APIFY_API_TOKEN.

Does Tech Stack Teardown access the network?

SKILL.md names 4 domains. In commands or code: console.apify.com; the agent is likely to contact it when it follows the instructions. As links in the text: apify.com, mxtoolbox.com and check.spamhaus.org. This is read from the text; nothing was executed.

Is Tech Stack Teardown safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Tech Stack Teardown use?

Tech Stack Teardown is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Tech Stack Teardown use?

About 3.1k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Tech Stack Teardown?

Skills that share tags, products or a category with Tech Stack Teardown: Ops Leadgen (Lifecycle-Innovations-Limited/claude-ops, 540 stars), Apify Buying Signal Detection (apify/awesome-skills, 264 stars), Auto Research Public (growthenginenowoslawski/coldoutboundskills, 742 stars) and Pain Language Engagers (gooseworks-ai/goose-skills, 1.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Tech Stack Teardown?

majiayu000 (a GitHub user) maintains it in majiayu000/claude-skill-registry, which has 666 GitHub stars. The repository holds 1,273 skills in this directory. The repository was last updated on October 7, 2026.

Source: majiayu000/claude-skill-registry on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.