Verified:GitHub

what-leaked-about-you

Name: what-leaked-about-you
Availability: InStock
Author: UseOSINT

Check and interpret data-breach exposure for emails, usernames, phones, and names using HIBP and commercial breach databases.

38|2|Updated Aug 2, 2026

Search Tags:#data breach #threat intelligence #osint #credential exposure #privacy audit #have i been pwned #dehashed

Ready to run

npx skills add https://github.com/UseOSINT/Skills --skill what-leaked-about-you-useosint

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: what-leaked-about-you
Source: https://github.com/UseOSINT/Skills/tree/main/skills/what-leaked-about-you
Command: npx skills add https://github.com/UseOSINT/Skills --skill what-leaked-about-you-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Investigators and security teams need to know which services an identity was registered with and whether its credentials are circulating, but breach data is fragmented across curated sources, commercial databases, and unverified combolists that are easy to misinterpret. ## Core Features & Use Cases - Service Enumeration: Turn an email address into a map of registered services, registration dates, and recovered usernames using Have I Been Pwned and record-level sources like DeHashed, IntelX, and Snusbase. - Safe Password Checking: Verify whether a password is in circulation via the Pwned Passwords k-anonymity range API without ever transmitting the credential. - Source Grading and Pitfall Detection: Distinguish verified breaches from combolists, recycled dumps, and scraped data relabelled as breaches, with a four-level confidence grading scheme. - Use Case: During an executive protection review, check a VIP's email against HIBP, recover a forgotten username from an old forum breach, pivot it into a handle search, and grade each finding with provenance before writing the report. ## Quick Start Ask the agent to check what breach exposure exists for the email address [email protected] and interpret the results.

Frequently Asked Questions about what-leaked-about-you

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check if an email address appeared in a data breach?▼

Start with Have I Been Pwned, which verifies and attributes breaches before listing them and labels each with its data classes. For record-level detail or searches by username, phone, or name, use keyed commercial services such as DeHashed, IntelX, or Snusbase.

How do I check if a password has been leaked without exposing it?▼

Use the Pwned Passwords range API: hash the password locally with SHA-1, send only the first five hex characters, and match the returned suffixes locally. The service never learns the password or the full hash.

What is the difference between Have I Been Pwned and DeHashed?▼

Have I Been Pwned is curated and returns breach membership and data classes but never credentials. DeHashed is a commercial record-level service supporting multi-selector search that returns actual field values, with broader but less curated coverage.

Can I use a leaked password to verify an account exists?▼

No. Using a leaked credential to authenticate is unauthorized access under computer-misuse law in most jurisdictions, regardless of how public the dump was. The same prohibition covers password resets and testing reuse on other services.

Why is a combolist hit less reliable than a named breach?▼

Combolists are aggregated, deduplicated credential collections stripped of provenance, so a hit cannot be attributed to any specific service. That destroys the service-enumeration value and means the finding should be graded unconfirmed.

Does absence from breach databases mean an identity is safe?▼

No. Absence only means the person's services were not breached, the breach was never published, or the source does not carry it. Non-appearance in any corpus proves nothing about actual exposure.