EdgeIQ Phishing Kit Detector

Detects phishing kit artifacts, brand impersonation, suspicious JavaScript, and infrastructure on URLs or local HTML to identify phishing kit clones.

Security Scan

The skill largely matches its stated purpose (phishing-kit detection) but contains several inconsistencies around licensing, undeclared config/env access, and provenance that warrant caution before installing or running it.

Purpose & Capability

The code implements phishing detection functionality (URL fetch, HTML/JS analysis, brand signatures) consistent with the description. However the skill metadata declares no required env vars/config paths while the runtime uses a license file (~/.edgeiq/license.key) and an EDGEIQ_EMAIL environment variable to enable Pro/Bundle features, which is not declared in the registry metadata.

Instruction Scope

SKILL.md instructs running the scanner (including examples that set EDGEIQ_EMAIL) and to copy files into the OpenClaw skills directory. The runtime code reads files under the user's home (~/.edgeiq/*) and will fetch remote URLs (exposes the agent's IP to targets). The instructions do not explicitly document the license-file read behavior or the hardcoded developer email that grants bundle access, giving the agent/distributor discretion not disclosed in metadata.

Install Mechanism

No install spec is provided (instruction-only plus bundled Python files). There are no downloads, archive extractions, or third-party package installs in the manifest — this reduces install-time risk. The README references a GitHub repo for cloning, but the packaged files are present so no external installer is required.

Credentials

Metadata lists no required environment variables or config paths, but the code uses EDGEIQ_EMAIL and checks a per-user license file in the home directory (~/.edgeiq/license.key and related files). Additionally, the licensing code includes a hardcoded email ([e-mail]) that will unlock Pro/Bundle features if that email is set, which is an unexpected and disproportionate means of elevating feature access.

Persistence & Privilege

The skill does not request 'always' presence and appears not to modify other skills or system-wide settings. It does read files from the user's home (~/.edgeiq/*) which is a persistent per-user path not declared in requirements — this is noteworthy but not an elevated privilege by itself.

What to consider before installing

This tool appears to perform the phishing scans it claims to, but there are a few red flags you should consider before installing or running it: - Licensing/backdoor: The shipped licensing logic contains a hardcoded developer email ([e-mail]) that grants Pro/Bundle features if you set EDGEIQ_EMAIL to that value. That is an unexpected backdoor for unlocking premium features and could be abused or indicate sloppy/unaudited code. - Undeclared config access: The scanner reads a per-user license file under ~/.edgeiq/license.key and possibly other files in ~/.edgeiq, but the skill metadata declares no required config paths. If you care about privacy or potential collisions with other tools, inspect or sandbox this behavior. - Provenance: The skill’s source is listed as 'unknown' and the README points to a third-party GitHub username. If you rely on this tool for sensitive analysis, prefer packages with clear provenance, signed releases, or review the entire codebase yourself. - Network/operational risk: The scanner will perform network requests to any URL you scan. Scanning remote sites reveals your IP and may trigger retaliatory or tracking behavior from malicious infrastructures. For risky targets, prefer offline/local HTML dumps and run the tool in an isolated environment. - Inconsistencies: The SKILL.md, README, and included licensing code show inconsistent pricing/links and multiple variations of license-check logic — this suggests the project may have been cobbled together from versions and hasn't been audited. Recommendations: - Inspect the full phishing_detector.py and edgeiq_licensing.py files yourself (or have a trusted reviewer do so). The manifest includes the source; look specifically for any network calls beyond fetching the target, filesystem writes, or hardcoded external endpoints. - Do not set EDGEIQ_EMAIL to the developer email to 'unlock' Pro features — that defeats licensing and could indicate malicious intent. - Run the tool in a sandbox or isolated VM when testing (so the scanner's network/disk access is contained). - Prefer a skill with a clear source repo, signed releases, or a maintainer you can verify if you plan to use it operationally. If you want, I can (1) scan the rest of phishing_detector.py for patterns that read other sensitive files or contact unexpected endpoints, or (2) produce a short list of specific lines to inspect in the licensing module and network code.

Phishing Kit Detector

Skill Name: phishing-kit-detector Version: 1.0.0 Category: Security / Phishing / OSINT Price: Free (basic) / Pro ($19/mo) / Bundle ($39/mo) Author: EdgeIQ Labs OpenClaw Compatible: Yes — Python 3, pure stdlib, WSL + Linux

---

What It Does

Detects phishing kit artifacts, brand impersonation, form action URLs, stolen branding, suspicious JavaScript, and credential harvesting infrastructure. Analyzes live URLs or local HTML dumps to determine if a page is a phishing kit clone.

⚠️ Legal Notice: Only analyze domains you own or have explicit written authorization to audit. Not for unauthorized scanning of third-party sites.

---

Features

• Phishing artifact detection — form action URLs pointing to credential capture endpoints, hidden fields, credential autocomplete
• Brand impersonation analysis — detects brand logos, CSS frameworks, and imagery copied from legitimate sites
• Infrastructure fingerprinting — shared/free hosting detection, suspicious TLDs, URL path patterns
• JavaScript analysis — credential harvesting scripts, redirect chains, keyloggers, obfuscated callbacks
• Stolen branding detection — references to legitimate brand assets, fake SSL badges, trust seals
• URL structure analysis — phishing-specific URL path patterns (login, account, verify, secure)
• JSON export — structured forensic report

---

Tier Comparison

Feature	Free	Pro ($19/mo)	Bundle ($39/mo)
URL scan	✅ (5 scans)	✅ (50 scans)	✅ (unlimited)
Local file scan	✅	✅	✅
Brand impersonation check	—	✅	✅
JS analysis	—	✅	✅
Infrastructure fingerprinting	—	✅	✅
Stolen branding detection	—	✅	✅
JSON export	—	✅	✅

---

Installation

cp -r /home/guy/.openclaw/workspace/apps/phishing-kit-detector ~/.openclaw/skills/phishing-kit-detector

---

Usage

Basic URL scan (free tier)

python3 phishing_detector.py --url "https://suspicious-site.com/login"

Local HTML file scan (Pro)

EDGEIQ_EMAIL=[e-mail] python3 phishing_detector.py \
  --file /path/to/phishing_page.html --pro

Brand impersonation check (Pro)

python3 phishing_detector.py --url "https://fake-paypal.com" \
  --brands paypal,amazon,apple --pro

Full bundle analysis + JSON export

EDGEIQ_EMAIL=[e-mail] python3 phishing_detector.py \
  --url "https://phishing-site.net" --bundle --output report.json

---

Parameters

Flag	Type	Default	Description
--url	string	—	Phishing URL to analyze
--file	string	—	Path to local HTML file
--brands	string	—	Comma-separated brand list (paypal,amazon,apple,google,microsoft,facebook,instagram,twitter,netflix,linkedin)
--pro	flag	False	Enable Pro features
--bundle	flag	False	Enable Bundle features
--output	string	—	Write JSON report to file

---

Brand List

Supported brands for impersonation detection: paypal · amazon · apple · google · microsoft · facebook · instagram · twitter · netflix · linkedin · ebay · salesforce · dropbox · slack · zoom · steam · epic games · steam · yahoo · cnn · chase · bank of america · wells fargo · capital one

---

Output Example

=== Phishing Kit Detector ===
Analyzing: https://fake-paypal.com/account/verify

  🔴 PHISHING KIT DETECTED (98% confidence)
  
  Artifact Analysis:
    Form action → credential harvest endpoint detected
    Hidden field → password re-entry field (credential capture)
    Credential autocomplete → enabled on sensitive fields
    Multiple forms → login + payment + PIN entry

  Brand Impersonation:
    Detected: PayPal (logo, CSS framework, brand colors)
    Stolen assets: 3 CSS files, 2 images from paypal.com
    Fake SSL badge detected

  Infrastructure:
    Free hosting provider detected (Freenom .tk domain)
    Suspicious TLD: .tk — commonly used in phishing
    Redirect chain: 2 hops before landing page
    Shared hosting IP — multiple malicious sites on same IP

  JavaScript Findings:
    Credential harvester script detected
    Keylogger injection found
    Redirect to: paypal.com.legit-site.ru

  Threat Level: CRITICAL — Sophisticated phishing kit with credential harvesting + keylogger

---

Pro Upgrade

Full phishing kit analysis + brand impersonation + JS analysis + infrastructure fingerprinting:

👉 Upgrade to Pro — $19/mo

---

Support

Open a ticket in #edgeiq-support or email [e-mail]