Metabigor OSINT Recon
j3ssie/metabigor
Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.
Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to…
Install Monitoring Darkweb Sources
The automated check flagged lines worth reading first. See the safety section below.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills monitoring-darkweb-sources --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/monitoring-darkweb-sources .claude/skills/monitoring-darkweb-sources && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "monitoring-darkweb-sources" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/monitoring-darkweb-sources into .claude/skills/monitoring-darkweb-sources/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "monitoring-darkweb-sources", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/monitoring-darkweb-sourcesType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills monitoring-darkweb-sources --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/monitoring-darkweb-sources .agents/skills/monitoring-darkweb-sources && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "monitoring-darkweb-sources" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/monitoring-darkweb-sources into .agents/skills/monitoring-darkweb-sources/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "monitoring-darkweb-sources", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills monitoring-darkweb-sources --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/monitoring-darkweb-sources .cursor/skills/monitoring-darkweb-sources && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "monitoring-darkweb-sources" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/monitoring-darkweb-sources into .cursor/skills/monitoring-darkweb-sources/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "monitoring-darkweb-sources", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/monitoring-darkweb-sources--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills monitoring-darkweb-sources --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/monitoring-darkweb-sources .gemini/skills/monitoring-darkweb-sources && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "monitoring-darkweb-sources" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/monitoring-darkweb-sources into .gemini/skills/monitoring-darkweb-sources/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "monitoring-darkweb-sources", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills monitoring-darkweb-sourcesInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/monitoring-darkweb-sources .github/skills/monitoring-darkweb-sources && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "monitoring-darkweb-sources" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/monitoring-darkweb-sources into .github/skills/monitoring-darkweb-sources/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "monitoring-darkweb-sources", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills monitoring-darkweb-sources --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/monitoring-darkweb-sources .opencode/skills/monitoring-darkweb-sources && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "monitoring-darkweb-sources" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/monitoring-darkweb-sources into .opencode/skills/monitoring-darkweb-sources/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "monitoring-darkweb-sources", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
monitoring-darkweb-sources- GitHub stars
- 34k
- Token cost
- ~2.1k tokens
- SKILL.md length
- 817 words
- Files
- 4 (incl. scripts, references)
- Skills in repo
- 644
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to…
- Works in 5 steps: Establish Keyword Monitoring via… → Manual Investigation with Operational… → Investigate Ransomware Leak Sites → …
- Establishing dark web monitoring coverage
- SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 2 more sections
- Runs Python scripts from its folder; calls curl and jq; reaches psbdmp.ws and pastebin.com
What it does
Monitoring Darkweb Sources is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden…
Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).
It sits in Security, covering OSINT. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.
When your agent uses it
- Establishing dark web monitoring coverage
- Investigating specific data breach claims
- Enriching incident investigations with dark web context
Example prompts
- “Use the monitoring-darkweb-sources skill to monitor dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of…”
- “/monitoring-darkweb-sources”
Requirements
- Python 3
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
curljq
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
psbdmp.wspastebin.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Monitoring Darkweb Sources loads about 2.1k tokens when it runs, and up to ~2.6k if it reads all its reference files. Until then it costs about 141 tokens; SKILL.md has 817 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: warnings
The automated check found patterns that need a careful read before installing.
- WarningMentions a paste, webhook or tunnelling service often used to send data outSKILL.md:118
curl "https://pastebin.com/search?q=company.com" # Rate-limited public search
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 817 words, ~2,061 tokens.
Download SKILL.mdSave it as
.claude/skills/monitoring-darkweb-sources/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- monitoring-darkweb-sources
- description
- Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.
- domain
- cybersecurity
- subdomain
- threat-intelligence
- tags
- dark-web, OSINT, credential-monitoring, ransomware-leaks, Recorded-Future, SpiderFoot, CTI
- version
- 1.0.0
- author
- team-cybersecurity
- license
- Apache-2.0
- nist_ai_rmf
- MEASURE-2.7, MAP-5.1, MANAGE-2.4
- atlas_techniques
- AML.T0070, AML.T0066, AML.T0082
- nist_csf
- ID.RA-01, ID.RA-05, DE.CM-01, DE.AE-02
- mitre_attack
- T1591, T1592, T1593, T1589, T1003
Monitoring Dark Web Sources
When to Use
Use this skill when:
- Establishing continuous monitoring for organizational domain names, executive names, and product brands on dark web forums
- Investigating a reported data breach claim found on a ransomware leak site or paste site
- Enriching an incident investigation with context about stolen credentials or planned attacks
Do not use this skill without proper operational security measures — dark web browsing without isolation exposes analyst infrastructure to adversary counter-intelligence.
Prerequisites
- Commercial dark web monitoring service (Recorded Future, Flashpoint, Intel 471, or Cybersixgill)
- Isolated operational environment: Whonix OS or Tails OS running in a VM with no persistent storage
- Keyword watchlist: organization domain, key executive names, product names, IP ranges, known credentials
- Legal guidance confirming passive monitoring is authorized in your jurisdiction
Workflow
Step 1: Establish Keyword Monitoring via Commercial Services
Configure dark web monitoring keywords in your CTI platform (e.g., Recorded Future Exposure module):
- Domain variations:
company.com,@company.com,company[dot]com - Executive names: CEO, CISO, CFO full names
- Product/brand names
- Internal codenames or project names (if suspected breach scope is broad)
- Known email domains for credential monitoring
Most commercial services (Flashpoint, Intel 471, Cybersixgill) crawl forums like XSS, Exploit[.]in, BreachForums, and Russian-language cybercriminal communities without analyst exposure.
Step 2: Manual Investigation with Operational Security
For investigations requiring direct dark web access:
Environment setup:
- Use a dedicated physical machine or air-gapped VM (Whonix + VirtualBox)
- Connect via Tor Browser only — never via standard browser
- Use a cover identity with no links to organization
- Never log in with real credentials to any dark web site
- Document all sessions in investigation log with timestamps
Paste site monitoring (clearnet-accessible, no Tor required):
# Hunt paste sites via API
curl "https://psbdmp.ws/api/search/company.com" | jq '.data[].id'
curl "https://pastebin.com/search?q=company.com" # Rate-limited public searchStep 3: Investigate Ransomware Leak Sites
Ransomware groups maintain .onion leak sites. Monitor these through commercial services rather than direct access. When a claim appears about your organization:
- Capture screenshot evidence via commercial service (do not access directly)
- Assess legitimacy: Does the threat actor's claimed data align with any known internal systems?
- Check timestamp: Is this claim recent or historical?
- Cross-reference with any known security incidents or phishing campaigns from that timeframe
- Engage IR team if claim appears credible before public disclosure
Known active ransomware leak site operators (as of early 2025): LockBit (disrupted Feb 2024), ALPHV/BlackCat (disrupted Dec 2023), Cl0p, RansomHub, Play.
Step 4: Credential Exposure Monitoring
For leaked credential monitoring:
- Have I Been Pwned Enterprise: Domain-level notification for credential exposures in breach datasets
- SpyCloud: Commercial credential monitoring with anti-cracking and plaintext password recovery from criminal markets
- Flare Systems: Automated monitoring of paste sites and dark web markets for credential dumps
When credential exposures are confirmed:
- Force password reset for affected accounts immediately
- Check if credentials provide access to any organizational systems (SSO, VPN)
- Review access logs for the period between credential exposure and detection for unauthorized access
Show full SKILL.md (344 more words)Show less
Step 5: Document and Escalate Findings
For each dark web finding:
- Capture evidence (commercial service screenshot, paste site archive)
- Classify severity: P1 (imminent attack threat or active data exposure), P2 (credential exposure), P3 (general mention)
- Notify appropriate stakeholders within defined SLAs
- Open investigation ticket and link to evidence artifacts
- Apply TLP:RED for any findings referencing named executives or specific attack plans
Key Concepts
| Term | Definition |
|---|---|
| Dark Web | Tor-accessible hidden services (.onion domains) not indexed by standard search engines; hosts both legitimate and criminal content |
| Paste Site | Clearnet text-sharing sites (Pastebin, Ghostbin) frequently used to publish stolen data or malware configurations |
| Ransomware Leak Site | .onion site operated by ransomware group to publish stolen victim data as extortion leverage |
| Operational Security (OPSEC) | Protecting analyst identity and organizational affiliation during dark web investigation |
| Credential Stuffing | Automated use of leaked username/password pairs against authentication systems |
| Stealer Logs | Data packages exfiltrated by infostealer malware containing saved browser credentials, cookies, and session tokens |
Tools & Systems
- Recorded Future Dark Web Module: Automated monitoring of dark web sources with alerting on organization-specific keywords
- Flashpoint: Dark web forum monitoring with human intelligence augmentation for criminal community context
- Intel 471: Closed-source access to cybercriminal communities with structured intelligence on threat actors
- SpyCloud: Credential exposure monitoring with recaptured plaintext passwords from criminal markets
- Have I Been Pwned Enterprise: Domain-level breach notification API for credential monitoring at scale
Common Pitfalls
- Direct access without OPSEC: Accessing dark web forums without Tor and a cover identity can expose analyst IP, browser fingerprint, and organization affiliation to adversaries.
- Overreacting to unverified claims: Ransomware groups and forum posters fabricate attack claims for extortion or reputation. Verify before escalating to incident response.
- Missing clearnet sources: Most dark web intelligence programs miss Telegram channels, Discord servers, and paste sites which operate on the clearnet and host significant criminal activity.
- Inadequate legal review: Dark web monitoring must be reviewed by legal counsel — passive monitoring is generally lawful but active participation in criminal markets is not.
- No evidence preservation: Dark web content disappears rapidly. Capture timestamped evidence immediately upon discovery using commercial service exports.
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files (scripts, references) in skills/monitoring-darkweb-sources of mukul975/Anthropic-Cybersecurity-Skills.
- SKILL.md
- LICENSE
- references/api-reference.md
- scripts/agent.py
Open the folder on GitHubat commit 54a7988
Compare with similar skills
Monitoring Darkweb Sources next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Monitoring Darkweb Sources this skillmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.1k | Automated safety check: Warn | Apache-2.0 | |
| Metabigor OSINT Reconj3ssie/metabigor | 1.8k | — | ~2.4k | Automated safety check: Pass | MIT | |
| Ctf Osintljagiello/ctf-skills | 3.4k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| ShadowBroker Intelligence ClientBigBodyCobain/Shadowbroker | 11k | — | ~8.9k | Automated safety check: Warn | AGPL-3.0 | |
| Awesome Osint Operatorshoyann/RZK-The-Hunter | 141 | — | ~4.8k | Automated safety check: Pass | CC-BY-SA-4.0 | |
| Run Claude Osintelementalsouls/Claude-OSINT | 2.8k | — | ~1.2k | Automated safety check: Pass | MIT |
Similar skills
Ctf Osint
ljagiello/ctf-skills
Provides open source intelligence techniques for CTF challenges.
ShadowBroker Intelligence Client
BigBodyCobain/Shadowbroker
Lets an agent query a ShadowBroker OSINT platform for tracked flights, ships, satellites and news, and place its findings on the map as intel pins.
Awesome Osint Operator
shoyann/RZK-The-Hunter
Ethical, evidence-first OSINT planning, tool selection, verification, monitoring, reporting, and guarded official wanted/fugitive-person location intelligence using a structured catalog adapted from…
Run Claude Osint
elementalsouls/Claude-OSINT
Build, validate, and run the claude-osint skills repo — check SKILL.md frontmatter, run the secretscan.py and h1reference.py helpers, run sync-skill-content.sh, run the smoke test.
Osint
smixs/osint-skill
Conduct deep OSINT research on individuals. An agent skill from smixs/osint-skill.
More from mukul975/Anthropic-Cybersecurity-Skills
All 644 skills in this repoCampaign Attribution Evidence Analysis
mukul975/Anthropic-Cybersecurity-Skills
Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.
Go Malware Analysis in Ghidra
mukul975/Anthropic-Cybersecurity-Skills
Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.
LNK and Jump List Forensics
mukul975/Anthropic-Cybersecurity-Skills
Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.
Malware Persistence Analysis with Autoruns
mukul975/Anthropic-Cybersecurity-Skills
Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.
NTFS MFT Deleted File Recovery
mukul975/Anthropic-Cybersecurity-Skills
Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.
Network Covert Channel Analysis
mukul975/Anthropic-Cybersecurity-Skills
Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.
Related
Categories
Questions about Monitoring Darkweb Sources
What does Monitoring Darkweb Sources do?
Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to…. Monitoring Darkweb Sources is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence.
When should I use Monitoring Darkweb Sources?
Monitoring Darkweb Sources fits situations like: establishing dark web monitoring coverage; investigating specific data breach claims; enriching incident investigations with dark web context.
How do I install Monitoring Darkweb Sources in Claude Code?
Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a claude-code`. Or copy the skill folder (skills/monitoring-darkweb-sources in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/monitoring-darkweb-sources in your project. Claude Code loads it when a task matches its description.
How do I install Monitoring Darkweb Sources in Codex?
Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a codex`. Or copy the skill folder (skills/monitoring-darkweb-sources in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/monitoring-darkweb-sources in your project. Codex loads it when a task matches its description.
Can I use Monitoring Darkweb Sources in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill monitoring-darkweb-sources -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/monitoring-darkweb-sources, .gemini/skills/monitoring-darkweb-sources, .github/skills/monitoring-darkweb-sources and .opencode/skills/monitoring-darkweb-sources in your project.
What does Monitoring Darkweb Sources need to run?
Going by SKILL.md and its folder, Monitoring Darkweb Sources needs Python for the scripts in its folder and the command-line tools its instructions call (curl and jq). Our summary lists: Python 3.
Does Monitoring Darkweb Sources access the network?
SKILL.md names 2 domains. In commands or code: psbdmp.ws and pastebin.com; the agent is likely to contact these when it follows the instructions. This is read from the text; nothing was executed.
Is Monitoring Darkweb Sources safe to install?
Our automated static check of SKILL.md flagged 1 warning(s): mentions a paste, webhook or tunnelling service often used to send data out. Read the flagged lines before installing; the check is not a guarantee either way. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Monitoring Darkweb Sources use?
Monitoring Darkweb Sources is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Monitoring Darkweb Sources use?
About 2.1k tokens (SKILL.md is roughly 8.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 567 tokens, read only when the agent opens those files.
What are the alternatives to Monitoring Darkweb Sources?
Skills that share tags, products or a category with Monitoring Darkweb Sources: Metabigor OSINT Recon (j3ssie/metabigor, 1.8k stars), Ctf Osint (ljagiello/ctf-skills, 3.4k stars), ShadowBroker Intelligence Client (BigBodyCobain/Shadowbroker, 11k stars) and Awesome Osint Operator (shoyann/RZK-The-Hunter, 141 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Monitoring Darkweb Sources?
mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,993 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.
Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.