メニュー
Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/yanacuti1121/Yana-AI --skill performing-paste-site-monitoring-for-credentialsコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Sovereign-grade safety OS for AI coding agents. 62 hooks, 2,025 skills, L1 memory, circuit breakers, and cross-engine enforcement — blocks rm -rf, force push, pipe-to-shell, and 40+ attack vectors before they reach your repo.
Use when the user wants to generate or keep repository documentation up to date via OpenWiki (langchain-ai/openwiki) — an LLM-driven CLI that writes a wiki for a codebase (or a personal knowledge base from Notion/Gmail/Slack/X/web search) and keeps it fresh via a scheduled CI pull request. Examples: "set up OpenWiki for this repo", "keep the docs updated automatically", "generate an agent wiki".
Use when implementing the core AR pipeline (camera pose estimation, marker tracking, projection overlay) from first principles — not when just using ARKit/ARCore/Unity's AR framework as a black box. Triggers on: 'build augmented reality from scratch', 'marker-based AR tracking', 'camera pose estimation', 'implement fiducial marker detection', 'AR projection matrix math', 'markerless AR tracking'. Covers marker-based vs markerless tracking, pose estimation, and the projection math to overlay 3D content on a camera feed.
SOC 職業分類に基づく
SKILL.md を表示中
| name | performing-paste-site-monitoring-for-credentials |
| description | Monitor paste sites like Pastebin and GitHub Gists for leaked credentials, API keys, and sensitive data dumps using automated scraping and keyword matching to detect breaches early. |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["paste-monitoring","credential-leak","pastebin","data-breach","threat-intelligence","osint","early-warning"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
| mitre_attack | ["T1591","T1592","T1593","T1589","T1003"] |
| source | https://github.com/mukul975/Anthropic-Cybersecurity-Skills |
| source_commit | 04450304b12645cb2b974ab96d28c0664758a88d |
| note | Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy. |
Paste sites (Pastebin, GitHub Gists, Ghostbin, Dpaste, Hastebin) are frequently used as staging areas for leaked credentials, database dumps, API keys, and sensitive data before wider distribution on dark web forums and Telegram channels. Monitoring these sites provides early breach detection, enabling organizations to respond before stolen data is weaponized. This skill covers building automated paste site monitors using the Pastebin Scraping API, keyword-based alerting, credential pattern matching, and integration with incident response workflows.
requests, beautifulsoup4, regex, pymisp librariesOver 300,000 user credentials are posted on Pastebin annually, averaging 1,000 username/password pairs per leak. Paste sites serve three primary threat intelligence purposes: early breach detection (credentials appear on paste sites before dark web), threat actor profiling (actors use paste sites for C2 configuration, data staging, tool sharing), and malware discovery (encoded payloads, configuration files, C2 addresses).
Active monitoring queries paste site APIs or scraping endpoints at regular intervals. The Pastebin Scraping API provides real-time access to new public pastes. For GitHub, the search API allows monitoring Gists and repository commits for exposed secrets. Passive monitoring uses services like IntelX, Dehashed, or Have I Been Pwned that aggregate paste site data.
Effective monitoring uses regex patterns for email:password combinations, API keys (AWS, Azure, GCP, Stripe, Twilio), database connection strings, private keys (SSH, PGP), JWT tokens, and internal hostnames/URLs. Organization-specific keywords (domain names, product names, employee names) reduce false positives.
requests
re
json
time
datetime datetime
:
SCRAPING_URL =
RAW_URL =
():
.keywords = [k.lower() k keywords]
.output_dir = output_dir
.seen_keys = ()
.credential_patterns = {
: re.(
, re.IGNORECASE),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
),
: re.(
,
re.IGNORECASE),
}
():
params = {: limit}
:
resp = requests.get(.SCRAPING_URL, params=params, timeout=)
resp.status_code == :
pastes = resp.json()
()
pastes
:
()
[]
Exception e:
()
[]
():
params = {: paste_key}
:
resp = requests.get(.RAW_URL, params=params, timeout=)
resp.status_code == :
resp.text
Exception:
():
findings = {
: [],
: {},
: ,
}
content_lower = content.lower()
keyword .keywords:
keyword content_lower:
count = content_lower.count(keyword)
findings[].append({
: keyword,
: count,
})
pattern_name, pattern .credential_patterns.items():
matches = pattern.findall(content)
matches:
findings[][pattern_name] = {
: (matches),
: matches[:],
}
cred_count = (
m[] m findings[].values()
)
findings[] cred_count > :
findings[] =
findings[]:
findings[] =
cred_count > :
findings[] =
cred_count > :
findings[] =
findings
():
count =
iterations count < iterations:
pastes = .fetch_recent_pastes()
alerts = []
paste pastes:
paste_key = paste.get(, )
paste_key .seen_keys:
.seen_keys.add(paste_key)
content = .get_paste_content(paste_key)
content:
findings = .analyze_paste(content, paste)
findings[] != :
alert = {
: paste_key,
: paste.get(, ),
: paste.get(, ),
: paste.get(, ),
: paste.get(, ),
: ,
: findings,
: datetime.now().isoformat(),
}
alerts.append(alert)
(
)
alerts:
._save_alerts(alerts)
count +=
iterations count < iterations:
time.sleep(interval)
alerts
():
filename =
os
os.makedirs(.output_dir, exist_ok=)
(filename, ) f:
json.dump(alerts, f, indent=)
()
monitor = PastebinMonitor(
keywords=[, , ],
)
alerts = monitor.monitor_loop(interval=, iterations=)
class GitHubSecretMonitor:
def __init__(self, github_token, org_keywords):
self.token = github_token
self.keywords = org_keywords
self.headers = {
"Authorization": f"token {github_token}",
"Accept": "application/vnd.github.v3+json",
}
def search_code(self, query, per_page=30):
"""Search GitHub code for leaked secrets."""
url = "https://api.github.com/search/code"
params = {"q": query, "per_page": per_page}
resp = requests.get(url, headers=self.headers, params=params)
if resp.status_code == 200:
results = resp.json().get("items", [])
print(f"[+] GitHub code search: {len(results)} results for '{query}'")
return results
return []
def search_gists(self, keyword):
"""Search public Gists for sensitive data."""
url = "https://api.github.com/gists/public"
params = {"per_page": 100}
resp = requests.get(url, headers=self.headers, params=params)
matches = []
if resp.status_code == 200:
gists = resp.json()
for gist in gists:
description = (gist.get("description") or "").lower()
files = gist.get("files", {})
for filename, file_info in files.items():
if keyword.lower() in description or keyword.lower() in filename.lower():
matches.append({
"gist_id": gist["id"],
"description": gist.get("description", ""),
"filename": filename,
"url": gist["html_url"],
"created_at": gist["created_at"],
})
return matches
def monitor_org_secrets(self, org_domain):
"""Monitor for organization secrets leaked on GitHub."""
queries = [
f'"{org_domain}" password',
f'"{org_domain}" api_key',
f'"{org_domain}" secret',
f'"{org_domain}" token',
f'"{org_domain}" credentials',
]
all_findings = []
for query in queries:
results = self.search_code(query)
for result in results:
all_findings.append({
"query": query,
"repo": result.get("repository", {}).get("full_name", ""),
"path": result.get("path", ""),
"url": result.get("html_url", ""),
"score": result.get("score", 0),
})
time.sleep(10) # GitHub rate limiting
return all_findings
gh_monitor = GitHubSecretMonitor("YOUR_GITHUB_TOKEN", ["mycompany.com"])
findings = gh_monitor.monitor_org_secrets("mycompany.com")
def generate_credential_leak_alert(alert_data):
"""Generate incident alert for credential leak detection."""
alert = {
"title": f"Credential Leak Detected - {alert_data.get('severity', 'unknown').upper()}",
"source": alert_data.get("url", ""),
"detected_at": alert_data.get("detected_at", ""),
"severity": alert_data.get("severity", "medium"),
"summary": f"Paste containing organization keywords and credentials found",
"keyword_matches": alert_data.get("findings", {}).get("keyword_matches", []),
"credential_types": list(alert_data.get("findings", {}).get("credential_matches", {}).keys()),
"recommended_actions": [
"Verify if leaked credentials are valid",
"Force password reset for affected accounts",
"Rotate exposed API keys and tokens",
"Check access logs for unauthorized usage",
"Report paste for takedown",
"Update monitoring keywords if new patterns found",
],
}
return alert