Skill UI

Monitors crt.sh certificate transparency logs via pycrtsh to detect phishing domains, unauthorized issuance, typosquatting, and shadow IT, enabling SOC analysts to proactively hunt for suspicious certificates and validate monitoring coverage.

Use dnstwist to generate and resolve domain permutations, flagging registered typosquatting, homograph, and impersonation sites so SOC teams can hunt, alert, and request take-downs.

Simulates software supply chain attacks by detecting typosquatting via Levenshtein distance, testing dependency confusion for private registries, verifying package hashes with pip, and scanning known CVEs with pip-audit to validate defenses.

Automatically detects typosquatting in npm and PyPI by generating candidate variants from popular dependencies, querying each registry, and scoring matches with Levenshtein distance, publication recency, and download anomalies so teams can flag suspicious packages before installation.