analyzing-typosquatting-domains-with-dnstwist

Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable, executable workflow with strong code, but it is held back by a verbose Key Concepts section that duplicates the bundled reference and by missing validation checkpoints before the batch blocklist/takedown operations. The bundle files are present but never referenced from the body.

Suggestions

Replace the inlined 'Domain Permutation Techniques' list and CLI flag detail with a pointer to references/api-reference.md, keeping only the essential workflow in SKILL.md.

Add an explicit validation/review step before Step 4 (e.g. 'Review the high-risk list with the SOC lead before generating blocklist or takedown requests') to satisfy the batch-operation feedback-loop requirement.

Link to scripts/agent.py for the reusable scanning implementation so the body does not re-implement the same subprocess/resolve logic inline.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with substantial executable code, but the 'Key Concepts' section re-explains permutation techniques and ssdeep/pHash hashing that duplicate the bundled api-reference.md, adding educational padding Claude largely does not need.	3 / 5
Actionability	Four complete, copy-paste-ready Python blocks use real dnstwist CLI flags, subprocess calls, and risk-scoring logic that cover the common scan / prioritize / monitor / export cases.	5 / 5
Workflow Clarity	The four steps are clearly sequenced, but the blocklist export and takedown-report generation are batch / outward-facing operations with no validation checkpoint or review-before-acting feedback loop, capping this dimension at 3 per the rubric.	3 / 5
Progressive Disclosure	Section headers give decent structure, but the body inlines the permutation-technique list and CLI flags that already live in references/api-reference.md and never links to the bundled api-reference.md or scripts/agent.py, so content that belongs in separate files is duplicated inline.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely names the tool and several actions and pairs them with explicit, natural trigger phrases. Only minor: a few synonym triggers sit on the capability side rather than the 'Use when' clause.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Generate domain permutations with dnstwist', 'check DNS resolution', detect 'typosquatting, homograph phishing, and brand impersonation domains' — giving comprehensive capability coverage rather than vague language.	5 / 5
Completeness	Explicitly states both what it does (generate permutations, check DNS, detect threat types) and when to use it via a concrete 'Use when asked to monitor... investigate... or assess...' clause.	5 / 5
Trigger Term Quality	'monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk' are natural user phrases, but a few common synonyms (e.g. 'typosquatting', 'homograph', 'lookalike domain') appear only on the capability side, not as triggers.	4 / 5
Distinctiveness Conflict Risk	The dnstwist-specific, threat-intelligence niche with distinct triggers (lookalike-domain monitoring, phishing-domain investigation, brand-impersonation risk) makes overlap with other skills minimal.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md
Commit: 54a7988

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.