Urlscan api

Skill Liberty91LTD/cti-skills/skills/urlscan-api

URLScan.io API reference. URL submission, scanning, and result retrieval.From its SKILL.md

Install

npx -y skills add Liberty91LTD/cti-skills --skill urlscan-api

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

16 stars16 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.0 KB, 556 tokens by cl100k_base, as published. Nobody here has run it

URLScan.io API

Base URL

https://urlscan.io/api/v1

Authentication

Header: API-Key: $URLSCAN_API_KEY

Rate Limits

Free: 100 scans/day, 100 searches/day
Paid: Higher limits based on plan

Key Endpoints

Submit URL for scanning

curl -s -X POST "https://urlscan.io/api/v1/scan/" \
  -H "API-Key: $URLSCAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "visibility": "unlisted"}'

Response: {"uuid": "...", "api": "https://urlscan.io/api/v1/result/UUID/"}

Important: Scan is async. Wait ~30 seconds before retrieving results. Poll the result URL until status is not 404.

Retrieve scan results

curl -s "https://urlscan.io/api/v1/result/{uuid}/" \
  -H "API-Key: $URLSCAN_API_KEY"

Useful response fields:

verdicts.overall — malicious/benign score
page.url — final URL after redirects
page.ip — IP address resolved
page.country — hosting country
page.server — web server
lists.ips — all IPs contacted
lists.domains — all domains contacted
lists.urls — all URLs loaded
stats.tlsPercentage — TLS usage
task.screenshotURL — screenshot of page

Search existing scans

curl -s "https://urlscan.io/api/v1/search/?q=domain:example.com" \
  -H "API-Key: $URLSCAN_API_KEY"

Search operators: domain:, ip:, server:, filename:, hash:, page.url:

Scan Flow

Submit URL → get UUID
Wait 30 seconds
Poll result endpoint (retry on 404, max 5 attempts with 10s delay)
Extract and return key findings

Response Summary Format

url: <scanned URL>
final_url: <after redirects>
verdict: malicious|suspicious|benign|unknown
ip: <resolved IP>
country: <hosting country>
technologies: [<detected technologies>]
domains_contacted: [<list>]
ips_contacted: [<list>]
screenshot: <URL>

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.