What Leaked About You Skill (useOSINT): Breach Checks

Makes an agent check which data breaches an email, username or phone number appears in, best used on your own accounts, without ever using a leaked password.

Installs: 57.8K; on skills.sh
Stars: 58; on GitHub
Files: 2; besides SKILL.md
Updated: Aug 2026; last repo commit

This is a method skill from useOSINT for breach exposure. It is framed around checking your own data: SKILL.md names auditing your own leaked personal data, calls working on your own data the cleanest footing, and the repo's ETHICS.md rules out stalking, harassment and doxxing. It tells the agent which source to use for what: Have I Been Pwned for the list of breaches an email appears in, the Pwned Passwords range check for a password you hold, and keyed services such as DeHashed, IntelX and Snusbase to search by username, phone, IP or name. It treats the list of services as the main finding.

It has one rule with no exceptions: never use a leaked credential to log in to anything. The skill bundles no scripts. Some sources need their own paid API key, and SKILL.md covers combolists, recycled breaches and a four-level confidence grade.

Good for

People checking their own email, username or phone for leaked personal data
Security teams doing incident response and account-takeover triage on their own organization

Install what-leaked-about-you

Claude Code

Copy this prompt.

Install the what-leaked-about-you skill in Claude Code. Run this command:

/plugin marketplace add useosint/skills
/plugin install useosint@useosint

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route. The Claude Code plugin installs all 29 skills of the repo (plugin.json and marketplace.json say 29, the README text says 28, and the repo tree has 29 skill folders). The plugin folder holds only plugin.json and marketplace.json, with no hooks, agents or MCP servers. The skills CLI and folder routes install just this skill. The README still names the repo useosint/osint-skills; the repo is now useosint/skills and GitHub forwards the old name. install.sh replaces any folder in the target that has the same name as one of the skills (it runs rm -rf on each destination first). Each skill can run on its own, and its sibling skills are called out in its method or its pivot table. There is no Claude app tab because the README documents no upload route and the skill calls for local tools.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Check and interpret data-breach exposure for an email, username, phone or name using Have I Been Pwned, the Pwned Passwords k-anonymity range API, DeHashed, IntelX and Snusbase. Use when checking breach or leak exposure, finding which services an account was registered with, interpreting a combolist or credential dump, assessing credential compromise, or auditing your own leaked personal data. Applies to incident response and account-takeover triage, executive and VIP protection, pre-employment and vendor risk screening, and personal privacy audits. Reference at useosint.com/skills/what-leaked-about-you.

Sections in SKILL.md

What a record actually contains, and what matters
Choosing a source
The rule that has no exceptions
The real pivot: service enumeration
Hashes are out of scope
Where this goes wrong
Confidence grading
Worked example
Pivots
Legal and handling notes

Key facts

Author: useOSINT (plugin.json lists the author as useOSINT; the repo is useosint/skills)
License: MIT (LICENSE file, README badge and plugin.json)
Installs on skills.sh: 57,781 (Nov 2, 2026)
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk warn (Nov 2, 2026)
GitHub stars: 58 for the whole useosint/skills repo (Nov 2, 2026)
Last repo commit: Aug 3, 2026
What it includes: 3 files including SKILL.md (counted from the repo tree): SKILL.md, reference/record-fields.md and reference/source-catalogue.md. It bundles no scripts.
Needs: Access to the breach sources it names; the Have I Been Pwned API, DeHashed, IntelX and Snusbase are keyed services (SKILL.md and reference/source-catalogue.md)
Works in: The README names Cursor and Claude, and says "other agents" can use the skills; the plugin.json and marketplace.json make a Claude Code plugin
Who it is for: Incident response and account-takeover triage, executive and VIP protection, pre-employment and vendor risk screening, personal privacy audits (SKILL.md description)

What it includes

Maps what you hold to the right breach source
A table says to use Have I Been Pwned for an email service list, the Pwned Passwords range API for a password, keyed commercial services for username, phone, IP or name, and find-leaks-in-the-wild for a dump circulating now.
Try: “Which breaches include a.mercer@example.com?”
Read · Choose a source
Checks a password without sending it
SHA-1 hash the password locally, send only the first five hex characters to the range endpoint, and match the returned suffixes locally.
Try: “Check whether this password is in circulation without sending it.”
Network · Pwned Passwords check
Reads the breach list as a map of accounts
Treats each breach as an account the person had, with a registration date and often a username to follow up.
Read · Service enumeration
Notes hash types and stops there
Records hash type to date the breach, never cracks hashes, and records distinctive password patterns as redacted linkage evidence.
Read · Record and hash handling
Grades the breach, not just the row
Grades each hit as confirmed, probable, unconfirmed or rejected, with combolist hits and anonymous dumps at the low end.
Read · Confidence grading
Forbids using any leaked credential
No test logins, password resets, security-question answers or reuse tests, even on a test account.
Read · The no-login rule

From the official docs

Permissions

Medium risk

The skill bundles no scripts, but breach records hold personal data and passwords and lookups go to third-party services. Use it on your own data or with authorization, and keep records out of shared chats.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Breach records are personal data
SKILL.md says breach records need a lawful basis, minimal fields and a retention period under GDPR-style rules, and that holding some stolen data is an offence in some places. Pull only what you need. github.com
Lookups send the identifier to third parties
Searching an email, phone or username sends it to Have I Been Pwned or a keyed service. The Pwned Passwords check sends only the first five characters of a hash. Do not paste a real password into any other tool. github.com
Do not log in with leaked credentials
SKILL.md calls this unauthorized access in most places, even to confirm an account exists. The skill tells the agent not to do it. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. The skill bundles no scripts.
Talks to	haveibeenpwned.com and the Pwned Passwords range API, and the keyed services DeHashed, IntelX and Snusbase, when you use them
Sign-in and keys	Keyed services use your own API key. SKILL.md bundles no scripts and names no storage.
Scopes	Searches third-party breach sources for the email, username, phone or name you give it Handles breach records that can hold personal data and password hashes

Questions

What does what-leaked-about-you do?

It gives the agent a method for checking which breaches an email, username, phone or name appears in, choosing between Have I Been Pwned, the Pwned Passwords range check and keyed services, and grading how reliable each hit is. It never uses a leaked password.

Does it need an API key?

For some sources, yes. SKILL.md says the Have I Been Pwned web lookup is free for a single email but the API is keyed, and DeHashed, IntelX and Snusbase are keyed commercial services. The skill bundles no scripts, so you supply the access.

Can I use it to look up someone else?

The repo's ETHICS.md says the skills are for lawful, authorized, defensive work and not for stalking, harassment or doxxing. SKILL.md says breach records are personal data under GDPR-style rules and to collect the minimum, keep nothing that is a credential, and delete on a schedule. Self-audits are the cleanest footing.

Is it safe to use?

It bundles no scripts, but breach records hold personal data and sometimes passwords. SKILL.md says to pull the minimum fields, not retain credentials, store case data encrypted and never test a password. Our advice: run it on your own addresses, and keep the records out of shared chats.

Does it work in Claude Code, Codex or Cursor?

The install box has Claude Code, Codex, Cursor and standalone tabs. The README names Cursor and Claude and says other agents can use the skills. It documents no Claude app upload.

Does it need the other useOSINT skills?

No install is required for the skill to run. It lists sibling skills (hunt-a-handle, what-an-email-reveals, find-anyone, find-leaks-in-the-wild and others) as optional pivots. The plugin route installs all 29.

Information

updated Nov 2, 2026

Repository: useosint/skills
Folder: skills/what-leaked-about-you

useosint/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

what-leaked-about-you SKILL.md · github.com
useosint/skills README · github.com
useosint/skills LICENSE · github.com
useosint plugin.json · github.com
useosint marketplace.json · github.com
useosint ETHICS.md · github.com
source catalogue · github.com