What types of tokens can this Claude Code skill deploy?

This skill supports the creation of web bugs (HTTP), DNS tokens, MS Word document tokens, and AWS API key tokens.

Do I need a paid Thinkst Canary account to use this?

It requires an API auth token from either a Thinkst Canary Console or a canarytokens.org account.

How does this skill assist with security compliance?

The skill aligns with NIST CSF 2.0 controls (DE.CM-01, DE.AE-06, PR.IR-01) by implementing continuous monitoring and deceptive detection capabilities.

Can I see a history of which tokens were triggered?

Yes, the skill can query recent alerts and generate a JSON report listing all active tokens and their complete trigger history.

Deception-Based Breach Detection with Canarytokens

Name: Deception-Based Breach Detection with Canarytokens
Author: mukul975

bymukul975

•

4,121

•

Security & Testing

Deploys and monitors Thinkst Canary Tokens to create automated tripwires for early-warning breach detection and security monitoring.

This skill empowers security professionals to implement sophisticated deception technology by programmatically managing Canary Tokens via the Thinkst Canary REST API. It enables the creation and deployment of diverse token types—including web bugs, DNS sensors, MS Word documents, and AWS API keys—across strategic network locations. By automating the monitoring of triggered alerts and generating coverage reports, this skill provides a proactive defense layer that detects unauthorized access and lateral movement, aligning with NIST CSF 2.0 and MITRE ATT&CK frameworks.

Key Features

01Real-time monitoring and querying of triggered alert events

02Programmatic token deployment via Thinkst Canary REST API

03Comprehensive deception coverage and deployment reporting

044,121 GitHub stars

05Automated creation of Web, DNS, MS Word, and AWS Canary Tokens

06Mapping to NIST CSF and MITRE ATT&CK security controls

Use Cases

01Setting up DNS-based tripwires to monitor for unauthorized network reconnaissance

02Deploying honey-documents on file shares to detect internal data theft

03Creating fake AWS credentials to identify compromised developer environments

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills implementing-deception-based-detection-with-canarytoken

For use in Claude.ai and ChatGPT

Key Features

01Real-time monitoring and querying of triggered alert events

02Programmatic token deployment via Thinkst Canary REST API

03Comprehensive deception coverage and deployment reporting

044,121 GitHub stars

05Automated creation of Web, DNS, MS Word, and AWS Canary Tokens

06Mapping to NIST CSF and MITRE ATT&CK security controls

Use Cases

01Setting up DNS-based tripwires to monitor for unauthorized network reconnaissance

02Deploying honey-documents on file shares to detect internal data theft

03Creating fake AWS credentials to identify compromised developer environments

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills implementing-deception-based-detection-with-canarytoken

For use in Claude.ai and ChatGPT