analyzing-typosquatting-domains-with-dnstwist

Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with complete executable code and a clear step sequence, but it is held back by redundancy between inline Key Concepts and the orphaned api-reference bundle file, plus missing validation checkpoints for the batch/destructive takedown and blocklist operations. Linking the bundle files and trimming duplicated explanation would lift the weaker dimensions.

Suggestions

Link the existing bundle files in the body — e.g., under Key Concepts add 'See [api-reference.md](references/api-reference.md) for the full fuzzing-technique table and output fields' and reference scripts/agent.py for the standalone agent — instead of inlining that material.

Add explicit validation checkpoints to the batch/destructive steps: before exporting the blocklist, require a human review of high-risk entries, and before issuing takedowns, verify the takedown_report against legitimate infrastructure to avoid false positives (validate -> review -> proceed).

Trim the 'Key Concepts' permutation-technique enumeration and the Overview/Fuzzy Hashing prose, which duplicate content already in references/api-reference.md, to improve token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with concrete code, but the 'Key Concepts' section re-explains permutation techniques (addition, bitsquatting, homoglyph, etc.) already tabulated in references/api-reference.md, and the Overview/Fuzzy Hashing prose restates tool behavior that could be trimmed — fitting the score-2 'mostly efficient but includes some unnecessary explanation' anchor rather than the lean score-3 anchor.	2 / 3
Actionability	Four complete, executable Python blocks with specific dnstwist CLI flags and concrete thresholds (ssdeep_score > 50, age_days < 30, risk_score >= 50) are copy-paste ready, matching the score-3 'fully executable code/commands' anchor rather than the pseudocode score-2 anchor.	3 / 3
Workflow Clarity	Steps 1-4 are clearly sequenced, but this is a batch/destructive workflow (blocklist deployment to firewall/proxy and outward-facing takedown requests) with no embedded validate->fix->retry checkpoints; the 'Validation Criteria' section lists outcomes rather than in-workflow checkpoints, so per the batch-operations guideline workflow clarity is capped at 2.	2 / 3
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist but are never linked or signaled in the body, and API-reference material (permutation techniques, output behavior) is inlined in 'Key Concepts' instead of pointed to the reference file — matching the score-2 'content that should be separate is inline' and 'references present but not clearly signaled' anchors; it avoids score 1 because sections are well organized with no deep nesting.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, concrete, and complete: it names specific actions, provides natural trigger terms, and explicitly pairs what-it-does with a Use-when clause in third-person voice. It is a strong, low-conflict description with no notable weaknesses.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Generate domain permutations with dnstwist', 'check DNS resolution', and 'detect typosquatting, homograph phishing, and brand impersonation' — matching the multi-action anchor rather than the partial score-2 anchor.	3 / 3
Completeness	Explicitly states what it does (generate permutations, check DNS, detect impersonation) and adds an explicit 'Use when asked to monitor... investigate... or assess...' trigger clause, satisfying both the what and the when; not capped at 2 because the Use-when clause is present.	3 / 3
Trigger Term Quality	Natural user phrases are well covered: 'monitor for lookalike domains', 'investigate a phishing domain', and 'assess brand-impersonation risk' are exactly how a requester would phrase the need, clearing the score-3 bar over the score-2 'some keywords' anchor.	3 / 3
Distinctiveness Conflict Risk	The dnstwist typosquatting/homograph/brand-impersonation niche with lookalike-domain and phishing triggers is clearly distinct and unlikely to fire for unrelated skills, matching the score-3 'clear niche with distinct triggers' anchor.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-typosquatting-domains-with-dnstwist/SKILL.md
Commit: e612f49

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.