Can I monitor an entire corporate domain for breaches?

Yes, the skill provides patterns for 'breacheddomain' searches, allowing you to track all compromised accounts associated with a verified organizational domain.

Does this skill send plain-text passwords to the HIBP API?

No. The skill follows the k-anonymity model where only the first five characters of a SHA-1 hash are sent to the API, ensuring the actual password never leaves your local environment.

Do I need a paid API key to use these features?

While the Pwned Passwords API (for checking passwords) is free and unauthenticated, searching for specific email accounts or domain breaches requires a valid HIBP API subscription key.

How does the skill handle API rate limits?

The skill includes specialized retry logic that monitors HTTP 429 response codes and respects the 'Retry-After' header to maintain smooth integration without being blocked.

Have I Been Pwned Security Integration

Name: Have I Been Pwned Security Integration
Author: rawveg

byrawveg

•

Security & Testing

Integrates the Have I Been Pwned API to check for compromised accounts, passwords, and data breaches within security workflows.

The Have I Been Pwned (HIBP) skill empowers Claude to provide expert guidance on implementing the HIBP API v3 for robust credential security. It specializes in privacy-preserving k-anonymity for password validation, domain-wide breach monitoring, and searching information stealer logs. By providing pre-built implementation patterns for account checking, rate-limit handling, and notification systems, this skill helps developers build applications that proactively protect users from credential stuffing and data exposure risks.

Key Features

01Privacy-first password validation using SHA-1 k-anonymity hashing

02Integration with information stealer logs to detect malware-stolen data

03Domain-wide credential monitoring for organizational security audits

048 GitHub stars

05Comprehensive account breach lookup and historical exposure analysis

06Automated rate-limiting patterns and exponential backoff implementations

Use Cases

01Preventing users from selecting compromised passwords during signup

02Building automated security notification systems for enterprise email domains

03Auditing internal user databases for historical data breach exposure

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add rawveg/skillsforge-marketplace haveibeenpwned

For use in Claude.ai and ChatGPT

Download Skill