agentmods.dev

analyzing-malicious-url-with-urlscan

analyzing-malicious-url-with-urlscan is a skill for Claude Code from killvxk/cybersecurity-skills-zh. It costs 53 tokens per session (996 once invoked), scanned A, original, Apache-2.0.

A guide for investigating suspicious web addresses with URLScan.io, a service that opens a URL in an isolated browser and records its screenshot, page structure, network requests, scripts, and redirects.

In plain words
What is it for?
Use it to submit and inspect suspicious URLs, review page behavior and certificates, and collect indicators such as domains, IP addresses, redirect URLs, and file hashes.
Why use it?
It lets investigators examine a potentially harmful page without opening it directly on their own computer. The collected evidence can reveal phishing, fake login pages, malicious redirects, and possible data theft.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the cybersecurity-skills-zh plugin — 58 skills shipped together

not rated 45repo 4mo ago A scan 53 tokens original Apache-2.0

Good fit Use it to submit and inspect suspicious URLs, review page behavior and certificates, and collect indicators such as domains, IP addresses, redirect URLs, and file hashes.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/killvxk/cybersecurity-skills-zh/analyzing-malicious-url-with-urlscan
View source ↗ killvxk/cybersecurity-skills-zh
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-malicious-url-with-urlscan
Clone the repo
git clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zh

Made for: Claude Code.

Or install cybersecurity-skills-zh, the plugin that ships this one along with the rest of its 58 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for analyzing-malicious-url-with-urlscan

README.md
[![agentmods](https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-malicious-url-with-urlscan/github.svg)](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-malicious-url-with-urlscan)
Your own site
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-malicious-url-with-urlscan"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-malicious-url-with-urlscan/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for analyzing-malicious-url-with-urlscan

Your own site · 80×15
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-malicious-url-with-urlscan"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-malicious-url-with-urlscan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 53 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 996 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00053 $0.00996
Opus 5 $0.00026 $0.00498
Sonnet 5 $0.00011 $0.00199
Haiku 4.5 $0.00005 $0.00100

Measured 12d ago against content hash 4043daeee90a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

analyzing-malicious-url-with-urlscan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/agent.py, scripts/process.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/analyzing-malicious-url-with-urlscan/SKILL.md · 85 lines

What it actually says

使用 URLScan 分析恶意 URL

概述

URLScan.io 是一项用于扫描和分析可疑 URL 的免费服务，可在隔离环境中捕获网页的截图、DOM 内容、HTTP 事务、JavaScript 行为和网络连接。本 skill 涵盖使用 URLScan 的 Web 界面和 API 调查钓鱼（phishing）URL、凭据收割页面和恶意重定向，而无需将分析师的系统暴露于风险中。

前置条件

  • URLScan.io 账号（提供免费层级，自动化操作需要 API key）
  • Python 3.8+ 及 requests 库
  • 了解 HTTP 协议和 Web 技术
  • 熟悉钓鱼 URL 模式

核心概念

URLScan 功能

  1. 安全浏览：在隔离的 Chromium 实例中渲染 URL
  2. 截图捕获：渲染页面的可视快照
  3. DOM 分析：JavaScript 执行后的完整 HTML 内容
  4. 网络日志：页面发出的所有 HTTP 请求（HAR 格式）
  5. 证书分析：SSL/TLS 证书详情
  6. 技术检测：识别 Web 框架和库
  7. IP/ASN 映射：基础设施情报
  8. 裁决（Verdict）：社区和自动化分类

钓鱼 URL 危险信号

  • 新注册域名（< 30 天）
  • 免费托管服务（Wix、GitHub Pages、Firebase）
  • 隐藏最终目标的 URL 短链接
  • 过多的子域名层级（login.microsoft.com.evil.com）
  • 品牌名在子域或路径中，而非在域名中
  • 非标准端口
  • Data URI 或 Base64 编码内容
  • JavaScript 密集、HTML 极少的页面

实施步骤

步骤 1：向 URLScan 提交 URL

Web：访问 https://urlscan.io 并提交可疑 URL
API：POST https://urlscan.io/api/v1/scan/
     Header: API-Key: your-api-key
     Body: {"url": "https://suspicious-url.com", "visibility": "private"}

步骤 2：分析结果

  • 查看截图中的品牌仿冒（brand impersonation）情况
  • 检查重定向和最终目标 URL
  • 检查 DOM 中的凭据输入表单
  • 审查网络请求中的数据外泄端点
  • 检查 SSL 证书有效性和签发者

步骤 3：提取 IOC（失陷指标）

  • 已联系的域名和 IP
  • 重定向链中的 URL
  • 页面资源的 SHA-256 哈希
  • JavaScript 文件哈希

步骤 4：与威胁情报交叉比对

使用 scripts/process.py 自动化 URL 扫描、提取 IOC，并与 VirusTotal、PhishTank 和 Google Safe Browsing 交叉比对。

工具与资源

验证

  • 通过 API 成功扫描可疑 URL
  • 提取截图并识别品牌仿冒
  • 记录完整重定向链
  • 从扫描结果生成 IOC 列表
  • 将发现与至少 2 个威胁情报来源交叉比对
Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 85 lines · 53 tokens per session scan A 4043daeee90a

Subscribe to this mod's changes

analyzing-malicious-url-with-urlscan is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (45 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 53 tokens to every session and 996 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Browser automationSecurityawarenessdmarcemail-securityphishingsocial-engineeringthreat-intelligenceurl-analysis
Related

Other skills, from other repositories

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.

mukul975/Anthropic-Cybersecurity-Skills · 48 tokens

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.

plurigrid/asi · 48 tokens

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.

pinkpixel-dev/skills-collection-1 · 48 tokens

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.

marysatasselshaped667/skills-collection-1 · 48 tokens

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.

Mikaru0Mystic/sectinel · 48 tokens

analyzing-malicious-url-with-urlscan

URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat.

RobotFlow-Labs/skills-repo · 48 tokens