Skip to content
Get packs

Analyzing Malicious URLs with urlscan.io

Investigate suspicious or phishing URLs safely using urlscan.io scans, screenshots and IOC extraction

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

When this skill is installed, the agent follows a structured procedure for investigating suspicious links. It submits a URL to urlscan.io, which loads the page in an isolated browser, then helps review the screenshot, redirect chain, page code, network requests and SSL certificate to spot phishing or credential-harvesting pages. It can also list indicators of compromise (domains, IPs, file hashes) and suggest cross-checking them against other threat intelligence services. The bundled Python scripts can automate submitting URLs and pulling results via the urlscan.io API.

Great for

  • SOC analysts and security teams triaging phishing reports
  • Email security staff checking links reported by users
  • Developers building automated URL-checking pipelines who want a starting template

Skip it if

  • Confirming a link is safe: scan results are a signal, not proof, and the skill does not itself verify safety
  • Scanning sensitive or internal URLs with the public service, since submissions may be visible to others unless kept private and the target may be exposed to the scanner

Try asking

  • “Submit this suspicious login link to urlscan.io and tell me whether it impersonates a bank”
  • “Extract the domains, IPs and hashes contacted by this phishing page as an IOC list”
  • “Summarize the redirect chain and final destination of this shortened URL”
  • “Check this URL against urlscan.io and cross-reference with VirusTotal and PhishTank”
Step-by-step guide: how to use Analyzing Malicious URLs with urlscan.ioInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    analyzing-malicious-url-with-urlscan.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-malicious-url-with-urlscan.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-malicious-url-with-urlscan.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Keep scans set to private visibility unless you intend to publish them, and never submit internal or confidential URLs to a public service
  • Review the scripts before running them and supply API keys via environment variables rather than hard-coding them
  • Treat verdicts as one input and cross-check at least two independent sources before acting on a result

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.