whisper-skills

Run typosquatting and brand-protection sweeps with the WhisperGraph MCP server. Use when the user wants to find lookalike or typosquatted domains of a brand, asks which fake domains impersonate their company, or mentions brand protection, domain monitoring, phishing-domain discovery, or takedown preparation. Generates registered lookalikes with the domain_variants tool, screens which are weaponized against threat feeds, pivots to the registrant via WHOIS, and formats a prioritized monitoring and takedown report.

Write efficient, valid Cypher queries against the WhisperGraph MCP server's internet graph (20 node labels, 29 edge types covering DNS, BGP, WHOIS, GeoIP, email, and threat intelligence). Use when the user wants to query, analyze, or explore WhisperGraph, asks how to traverse the graph, hits a query that was rejected or timed out, asks about the schema or edge directions, or needs analytical or aggregate graph questions answered. Bundles the full schema reference, a validated query cookbook organized by analyst persona, and the server's seven validation rules so queries return in milliseconds instead of being rejected.

Investigate IPs, domains, hostnames, ASNs, or CIDRs for threats using the WhisperGraph MCP server's internet infrastructure graph (7.4B nodes, 39B edges, 5.6M threat-intel edges across DNS, BGP, WHOIS, web links, and threat feeds). Use when the user asks whether an IP or domain is malicious, says to investigate an indicator, asks who is behind a domain, wants to pivot from an IOC, or mentions threat triage, IOC enrichment, WHOIS or BGP history, or attack-surface mapping from an indicator. Chains the explain_indicator, whisper_history, and query tools in the right order and avoids Cypher patterns that time out on billion-node labels.