{
  "$schema": "https://raw.githubusercontent.com/cloudflare/agent-skills-discovery-rfc/main/schema/v0.2.0/index.schema.json",
  "version": "0.2.0",
  "publisher": {
    "name": "PhishDestroy",
    "url": "https://phishdestroy.io"
  },
  "skills": [
    {
      "name": "probe-domain",
      "type": "http",
      "description": "Live-check whether a phishing domain is currently serving content (liveping), follow its redirect chain (redirect), or detect CDN cloaking when public DNS is NXDOMAIN but origin still serves (cdnbypass). Returns JSON with HTTP status, method used, and timestamp.",
      "url": "https://phishdestroy.io/api/probe.php",
      "method": "GET",
      "parameters": [
        { "name": "domain", "in": "query", "required": true, "type": "string" },
        { "name": "type",   "in": "query", "required": true, "type": "string", "enum": ["liveping", "redirect", "cdnbypass"] }
      ]
    },
    {
      "name": "get-platform-stats",
      "type": "http",
      "description": "Retrieve aggregate PhishDestroy platform statistics: total tracked phishing domains, current alive/dead counts, last detection timestamp.",
      "url": "https://phishdestroy.io/api/stats.php",
      "method": "GET"
    },
    {
      "name": "get-cti-stats",
      "type": "http",
      "description": "Retrieve CTI-specific statistics (active campaigns, registrar rankings, geo aggregates).",
      "url": "https://phishdestroy.io/api/stats-cti.php",
      "method": "GET"
    },
    {
      "name": "get-domain-threat-report",
      "type": "http",
      "description": "Get an LLM-readable (markdown) threat report for a specific domain. Replace {domain} with the target. Report includes VT detections, registrar, hosting geography, AI-generated summary, evidence links, blocklist status, kit classification.",
      "url": "https://phishdestroy.io/domain/{domain}/llm.txt",
      "method": "GET",
      "parameters": [
        { "name": "domain", "in": "path", "required": true, "type": "string" }
      ]
    },
    {
      "name": "threat-feed",
      "type": "http",
      "description": "Subscribe to Atom feed of newly detected phishing domains. Filter by brand or registrar via query params.",
      "url": "https://phishdestroy.io/feed-threats.xml",
      "method": "GET",
      "parameters": [
        { "name": "brand",     "in": "query", "required": false, "type": "string" },
        { "name": "registrar", "in": "query", "required": false, "type": "string" }
      ]
    }
  ]
}