Name: dark-web-monitoring
Author: Pranith-Jain

Instruction file imported from Pranith-Jain/cti-ai-skills (.cursor/rules/dark-web-monitoring.mdc). Copyright stays with the author.

description: Monitor dark web sources for leaked credentials, stolen data, threat actor communications, and emerging threats. globs: .txt,.csv,*.json

Access Tor hidden services via SOCKS5 proxy (localhost:9050); crawl with caution
Monitor Telegram public channels via t.me/ or MTProto API for credential dumps and exploit announcements
Classify dark web content: credential leaks, data sales, access sales, malware/tools, exploit listings, C2 listings, services
Extract: email:password pairs, database dumps, session cookies, VPN/SSH/RDP creds, source code, PII
Alert immediately on: org credentials, access for sale, internal source code, executive PII, zero-days affecting tech stack
Maintain chain of custody: timestamped screenshots, full HTML preservation, source URL, file hashes, timeline
Never engage directly with threat actors unless authorized
Use separate infrastructure for dark web access (never corporate networks)
Verify claims before escalating — many dumps repackage older breaches
Cross-reference samples to confirm actual org impact

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

{ "ocm": "1", "id": "pranith-jain-cti-ai-skills-dark-web-monitoring-rule", "kind": "skill", "name": "dark-web-monitoring", "description": "description: Monitor dark web sources for leaked credentials, stolen data, threat actor communications, and emerging threats. globs: *.txt,*.csv,*.json --- - Access Tor hidden services via SOCKS5 proxy (localhost:9050); crawl with caution - Monitor Telegram public channels via t.me/ or MTProto API for credential dumps and exploit announcements - Classify dark web content: credential leaks, data sales, access sales, malware/tools, exploit listings, C2 listings, services - Extract: email:password pairs, database dumps, session cookies, VPN/SSH/RDP creds, source code, PII - Alert immediately on: org credentials, access for sale, internal source code, executive PII, zero-days affecting tech stack - Maintain chain of custody: timestamped screenshots, full HTML preservation, source URL, file hashes, timeline - Never engage directly with threat actors unless authorized - Use separate infrastructure for dark web access (never corporate networks) - Verify claims before escalating — many dumps repackage older breaches ", "publisher": "Pranith-Jain", "version": "1.0.0", "capabilities": { "domains": [ "coding", "data_analysis" ], "tags": [ "skill-md", "github-cursor-rules" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "description: Monitor dark web sources for leaked credentials, stolen data, threat actor communications, and emerging threats. globs: *.txt,*.csv,*.json --- - Access Tor hidden services via SOCKS5 proxy (localhost:9050); crawl with caution - Monitor Telegram public channels via t.me/ or MTProto API for credential dumps and exploit announcements - Classify dark web content: credential leaks, data sales, access sales, malware/tools, exploit listings, C2 listings, services - Extract: email:password pairs, database dumps, session cookies, VPN/SSH/RDP creds, source code, PII - Alert immediately on: org credentials, access for sale, internal source code, executive PII, zero-days affecting tech stack - Maintain chain of custody: timestamped screenshots, full HTML preservation, source URL, file hashes, timeline - Never engage directly with threat actors unless authorized - Use separate infrastructure for dark web access (never corporate networks) - Verify claims before escalating — many dumps repackage older breaches " ], "primary": false, "metadata": { "source": { "provider": "github-cursor-rules", "repository": "https://github.com/Pranith-Jain/cti-ai-skills", "path": ".cursor/rules/dark-web-monitoring.mdc", "ref": "ad4f46d951ebaf8976c8ba0039b13b3876d9ebca", "url": "https://github.com/Pranith-Jain/cti-ai-skills/blob/ad4f46d951ebaf8976c8ba0039b13b3876d9ebca/.cursor/rules/dark-web-monitoring.mdc", "key": "Pranith-Jain/cti-ai-skills/.cursor/rules/dark-web-monitoring.mdc" } }, "instructions": "---\ndescription: Monitor dark web sources for leaked credentials, stolen data, threat actor communications, and emerging threats.\nglobs: *.txt,*.csv,*.json\n---\n- Access Tor hidden services via SOCKS5 proxy (localhost:9050); crawl with caution\n- Monitor Telegram public channels via t.me/ or MTProto API for credential dumps and exploit announcements\n- Classify dark web content: credential leaks, data sales, access sales, malware/tools, exploit listings, C2 listings, services\n- Extract: email:password pairs, database dumps, session cookies, VPN/SSH/RDP creds, source code, PII\n- Alert immediately ", "cost": { "context_tokens": 270 } }

dark-web-monitoring

About

description: Monitor dark web sources for leaked credentials, stolen data, threat actor communications, and emerging threats. globs: .txt,.csv,*.json

Use it

Manifest

Reviews