← Back to Skills Marketplace
snipercat69

Phishing Kit Detector

by snipercat69 · GitHub ↗ · v1.4.0 · MIT-0
cross-platform ⚠ suspicious
102
Downloads
0
Stars
0
Active Installs
4
Versions
Install in OpenClaw
/install edgeiq-phishing-kit-detector
Description
Detects phishing kit artifacts, brand impersonation, suspicious JavaScript, and infrastructure on URLs or local HTML to identify phishing kit clones.
README (SKILL.md)

Phishing Kit Detector

Skill Name: phishing-kit-detector Version: 1.0.0 Category: Security / Phishing / OSINT Price: Lifetime: $39 / Optional Monthly: $7/mo (includes all Pro features permanently) Author: EdgeIQ Labs OpenClaw Compatible: Yes — Python 3, pure stdlib, WSL + Linux

What It Does

Detects phishing kit artifacts, brand impersonation, form action URLs, stolen branding, suspicious JavaScript, and credential harvesting infrastructure. Analyzes live URLs or local HTML dumps to determine if a page is a phishing kit clone.

⚠️ Legal Notice: Only analyze domains you own or have explicit written authorization to audit. Not for unauthorized scanning of third-party sites.

Features

  • Phishing artifact detection — form action URLs pointing to credential capture endpoints, hidden fields, credential autocomplete
  • Brand impersonation analysis — detects brand logos, CSS frameworks, and imagery copied from legitimate sites
  • Infrastructure fingerprinting — shared/free hosting detection, suspicious TLDs, URL path patterns
  • JavaScript analysis — credential harvesting scripts, redirect chains, keyloggers, obfuscated callbacks
  • Stolen branding detection — references to legitimate brand assets, fake SSL badges, trust seals
  • URL structure analysis — phishing-specific URL path patterns (login, account, verify, secure)
  • JSON export — structured forensic report

Tier Comparison

Feature Free Lifetime ($39) Optional Monthly ($7/mo)
URL scan ✅ (5 scans) ✅ (unlimited) ✅ (unlimited)
Local file scan ✅ ✅ ✅
Brand impersonation check ✅ ✅ ✅
JS analysis ✅ ✅ ✅
Infrastructure fingerprinting ✅ ✅ ✅
Stolen branding detection ✅ ✅ ✅
JSON export ✅ ✅ ✅

Installation

cp -r /home/guy/.openclaw/workspace/apps/phishing-kit-detector ~/.openclaw/skills/phishing-kit-detector

Usage

Basic URL scan (free tier)

python3 phishing_detector.py --url "https://suspicious-site.com/login"

Local HTML file scan (Pro)

[email protected] python3 phishing_detector.py \
  --file /path/to/phishing_page.html --pro

Brand impersonation check (Pro)

python3 phishing_detector.py --url "https://fake-paypal.com" \
  --brands paypal,amazon,apple --pro

Full bundle analysis + JSON export

[email protected] python3 phishing_detector.py \
  --url "https://phishing-site.net" --bundle --output report.json

Parameters

Flag Type Default Description
--url string — Phishing URL to analyze
--file string — Path to local HTML file
--brands string — Comma-separated brand list (paypal,amazon,apple,google,microsoft,facebook,instagram,twitter,netflix,linkedin)
--pro flag False Enable Pro features
--bundle flag False Enable Bundle features
--output string — Write JSON report to file

Brand List

Supported brands for impersonation detection: paypal · amazon · apple · google · microsoft · facebook · instagram · twitter · netflix · linkedin · ebay · salesforce · dropbox · slack · zoom · steam · epic games · steam · yahoo · cnn · chase · bank of america · wells fargo · capital one

Output Example

=== Phishing Kit Detector ===
Analyzing: https://fake-paypal.com/account/verify

  🔴 PHISHING KIT DETECTED (98% confidence)
  
  Artifact Analysis:
    Form action → credential harvest endpoint detected
    Hidden field → password re-entry field (credential capture)
    Credential autocomplete → enabled on sensitive fields
    Multiple forms → login + payment + PIN entry

  Brand Impersonation:
    Detected: PayPal (logo, CSS framework, brand colors)
    Stolen assets: 3 CSS files, 2 images from paypal.com
    Fake SSL badge detected

  Infrastructure:
    Free hosting provider detected (Freenom .tk domain)
    Suspicious TLD: .tk — commonly used in phishing
    Redirect chain: 2 hops before landing page
    Shared hosting IP — multiple malicious sites on same IP

  JavaScript Findings:
    Credential harvester script detected
    Keylogger injection found
    Redirect to: paypal.com.legit-site.ru

  Threat Level: CRITICAL — Sophisticated phishing kit with credential harvesting + keylogger

Pro Upgrade

Full phishing kit analysis + brand impersonation + JS analysis + infrastructure fingerprinting:

👉 Buy Lifetime — $39 👉 Subscribe Monthly — $7/mo

Support

Open a ticket in #edgeiq-support or email [email protected]

🔗 More from EdgeIQ Labs

edgeiqlabs.com — Security tools, OSINT utilities, and micro-SaaS products for developers and security professionals.

  • 🛠️ Subdomain Hunter — Passive subdomain enumeration via Certificate Transparency
  • 📸 Screenshot API — URL-to-screenshot API for developers
  • 🔔 uptime.check — URL uptime monitoring with alerts
  • 🛡️ headers.check — HTTP security headers analyzer

👉 Visit edgeiqlabs.com →

Usage Guidance
This skill appears to implement phishing detection, but before installing or running it you should: 1) inspect the included files (phishing_detector.py and edgeiq_licensing.py) yourself or in a sandbox — they read/write ~/.edgeiq/*. 2) Be cautious about setting EDGEIQ_EMAIL to unlock Pro features — that acts as a license bypass and is not a standard API key. 3) Run scans only on domains you control or are authorized to test (the tool will fetch remote URLs). 4) If you plan to pay for 'Pro' or 'Bundle', verify the vendor identity and Stripe links; the repository/homepage information in the skill is sparse. 5) Prefer running the tool in an isolated VM or container and monitor outbound network traffic to ensure no unexpected exfiltration to unknown endpoints. If you want higher assurance, ask the publisher for a canonical source (Git repo or homepage) and a clear privacy/telemetry statement.
Capability Analysis
Type: OpenClaw Skill Name: edgeiq-phishing-kit-detector Version: 1.4.0 The skill is a legitimate security utility designed to analyze URLs or local HTML files for phishing indicators, such as brand impersonation and credential harvesting patterns. The code in `phishing_detector.py` uses standard libraries (`urllib`, `re`, `socket`) to perform its stated functions without any evidence of data exfiltration, unauthorized execution, or malicious persistence. While `edgeiq_licensing.py` contains a hardcoded developer email (`[email protected]`) to bypass licensing checks, this is a common software licensing practice and does not pose a security risk to the user's system.
Capability Tags
cryptocan-make-purchases
Capability Assessment
⚠ Purpose & Capability
The core functionality (HTML/JS analysis, URL fetching, brand signatures) matches the phishing-detector purpose. However, the bundle includes a separate licensing module that reads ~/.edgeiq/license.key and ~/.edgeiq/stripe_licenses.json and accepts EDGEIQ_EMAIL as a license shortcut; these side-effects are not declared in the registry metadata (which lists no required config paths or env vars). Reading/writing those files is outside the stated primary purpose and should be disclosed.
⚠ Instruction Scope
SKILL.md shows how to run scans and mentions using EDGEIQ_EMAIL to enable Pro features, but it does not call out that the code will read a license file in the user's home directory or accept an email as a license. The code will also fetch arbitrary remote URLs (expected for a scanner) — which is appropriate for the purpose but increases risk if run against unknown domains. The instructions do not disclose all data accesses performed by the included code.
✓ Install Mechanism
There is no network install step or downloaded archive in the registry metadata; the skill is instruction-only with code files included. That is lower-risk than remote downloads. No package managers or external installers are invoked by the provided instructions.
⚠ Credentials
The registry declares no required env vars or credentials, yet both code files check the environment variable EDGEIQ_EMAIL and read license files under the user's home directory to enable Pro/Bundle features. Asking users to set EDGEIQ_EMAIL to unlock features is an unconventional and undeclared mechanism; reading home-directory files without declaring them is disproportionate to 'scan a URL' and should be explicit.
✓ Persistence & Privilege
The skill is not marked always:true and does not request system-wide privileges. The only persistent artifact is the expected ~/.edgeiq/ license files accessed by the licensing module; the skill does not appear to modify other skills or global agent config.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install edgeiq-phishing-kit-detector
  3. After installation, invoke the skill by name or use /edgeiq-phishing-kit-detector
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.4.0
v1.4.0: URGENT FIX — corrected Stripe Payment Link URLs (no suffixes, correct live URLs)
v1.3.0
v1.3.0: CRITICAL FIX — replaced placeholder Stripe URLs with real working Payment Link checkout URLs
v1.2.0
v1.2.0: Dual pricing — Lifetime as primary purchase option with optional monthly. Updated Stripe checkout URLs.
v1.0.0
Initial release: phishing artifact detection, brand impersonation analysis, form action URL scoring, harvest endpoint detection, JavaScript analysis, infrastructure fingerprinting.
Metadata
Slug edgeiq-phishing-kit-detector
Version 1.4.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 4
Frequently Asked Questions

What is Phishing Kit Detector?

Detects phishing kit artifacts, brand impersonation, suspicious JavaScript, and infrastructure on URLs or local HTML to identify phishing kit clones. It is an AI Agent Skill for Claude Code / OpenClaw, with 102 downloads so far.

How do I install Phishing Kit Detector?

Run "/install edgeiq-phishing-kit-detector" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Phishing Kit Detector free?

Yes, Phishing Kit Detector is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Phishing Kit Detector support?

Phishing Kit Detector is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Phishing Kit Detector?

It is built and maintained by snipercat69 (@snipercat69); the current version is v1.4.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463815 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259802 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200680 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191345 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190333 · by oswalpalash

💬 Comments