Can I monitor an entire corporate domain for breaches?

Yes, the skill provides patterns for 'breacheddomain' searches, allowing you to track all compromised accounts associated with a verified organizational domain.

Does this skill send plain-text passwords to the HIBP API?

No. The skill follows the k-anonymity model where only the first five characters of a SHA-1 hash are sent to the API, ensuring the actual password never leaves your local environment.

Do I need a paid API key to use these features?

While the Pwned Passwords API (for checking passwords) is free and unauthenticated, searching for specific email accounts or domain breaches requires a valid HIBP API subscription key.

How does the skill handle API rate limits?

The skill includes specialized retry logic that monitors HTTP 429 response codes and respects the 'Retry-After' header to maintain smooth integration without being blocked.

Have I Been Pwned Security Integration

Name: Have I Been Pwned Security Integration
Author: rawveg

byrawveg

•

Security & Testing

Integrates the Have I Been Pwned API to check for compromised accounts, passwords, and data breaches within security workflows.

About

The Have I Been Pwned (HIBP) skill empowers Claude to provide expert guidance on implementing the HIBP API v3 for robust credential security. It specializes in privacy-preserving k-anonymity for password validation, domain-wide breach monitoring, and searching information stealer logs. By providing pre-built implementation patterns for account checking, rate-limit handling, and notification systems, this skill helps developers build applications that proactively protect users from credential stuffing and data exposure risks.

Key Features

Privacy-first password validation using SHA-1 k-anonymity hashing
Integration with information stealer logs to detect malware-stolen data
Domain-wide credential monitoring for organizational security audits
8 GitHub stars
Comprehensive account breach lookup and historical exposure analysis
Automated rate-limiting patterns and exponential backoff implementations

Use Cases

Preventing users from selecting compromised passwords during signup
Building automated security notification systems for enterprise email domains
Auditing internal user databases for historical data breach exposure

About

Key Features

Privacy-first password validation using SHA-1 k-anonymity hashing
Integration with information stealer logs to detect malware-stolen data
Domain-wide credential monitoring for organizational security audits
8 GitHub stars
Comprehensive account breach lookup and historical exposure analysis
Automated rate-limiting patterns and exponential backoff implementations

Use Cases

Preventing users from selecting compromised passwords during signup
Building automated security notification systems for enterprise email domains
Auditing internal user databases for historical data breach exposure