{"id":"c6fcd8c7-c44a-4ff0-a10e-6835981ed7d2","slug":"scamcheck","kind":"skill","name":"ScamCheck","summary":"A Claude Code skill that checks whether a website is a likely scam (fake shops, phishing, fake investment or crypto platforms, fake services) and produces a reasoned verdict, optionally as a PDF repor","owner":"matteobaccan","repoUrl":"https://github.com/matteobaccan/ScamCheck","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-10-02T17:18:00.000Z","addedAt":"2026-10-21T10:29:54.842Z","logoUrl":"https://avatars.githubusercontent.com/u/200925?u=f1e2e2df7c3df2fbfb6508fb3d29a58def013e79&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","files-documents","data-analytics"],"tags":["anti-phishing","anti-scam","claude-code","scam-scanner"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-22T16:39:13.413Z","sample":false,"url":"https://conduits.dev/tools/scamcheck","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"

\n \"ScamCheck\n

\n\n

ScamCheck

\n\n

\n \"License:\n \"Claude\n

\n\nA [Claude Code](https://claude.com/claude-code) skill that checks whether a website is a likely scam (fake shops, phishing, fake investment or crypto platforms, fake services) and produces a reasoned verdict, optionally as a PDF report in any language.\n\n## Requirements\n\n- [Claude Code](https://claude.com/claude-code)\n- `curl` (built into Windows 10/11, macOS and Linux)\n- Node.js or Python, to parse JSON responses\n- Google Chrome, only for PDF reports (plus `pdftotext`/`pdftoppm` from Poppler for the final check, optional)\n\n## Installation\n\n**This project only.** Clone the repository and start Claude Code in its folder: the skill is in `.claude/skills/scamcheck/` and loads automatically.\n\n```bash\ngit clone https://github.com/matteobaccan/ScamCheck.git\ncd ScamCheck\nclaude\n```\n\n**All projects.** Copy the skill folder into your personal skills.\n\n```bash\n# macOS / Linux / Git Bash\nmkdir -p ~/.claude/skills\ncp -r .claude/skills/scamcheck ~/.claude/skills/\n```\n\n```powershell\n# PowerShell\nNew-Item -ItemType Directory -Force \"$HOME\\.claude\\skills\" | Out-Null\nCopy-Item -Recurse .claude\\skills\\scamcheck \"$HOME\\.claude\\skills\\\"\n```\n\nRestart Claude Code. To check the skill is active, type `/` and look for `scamcheck` in the list.\n\n## Usage\n\n### Command\n\n```\n/scamcheck https://example.com\n```\n\nA bare domain works too: `/scamcheck example.com`.\n\n### Natural language\n\nThe skill also starts on its own when you ask things like:\n\n- \"is this site legit? https://example-shop.store\"\n- \"check https://example.com\"\n- \"I got this link by SMS, is it a scam?\"\n- \"can I buy from example.com?\"\n\n### Report language\n\nThe skill and its checklist are in English, but the report can be written in any language:\n\n```\n/scamcheck https://example.com lang:it\n/scamcheck https://example.com lang:de pdf\ncheck https://example.com and give me a PDF report in French\n```\n\nWithout `lang:`, the chat report uses the language you write in. Before generating a PDF, Claude asks you which language to use and whether to include the technical log; add `lang:` and `log:yes` or `log:no` to skip the question:\n\n```\n/scamcheck https://example.com pdf lang:it log:no\n```\n\n### PDF report\n\n```\ncheck https://example.com and make a PDF report\n```\n\nThe PDF is saved as `report/--.pdf` and contains:\n\n- page 1: verdict with a 0–100 risk gauge, summary, home page screenshot, main red flags;\n- page 2: the full checklist;\n- page 3: positive signals, what to do, limitations, sources;\n- page 4 onwards (optional, you choose): technical log, an excerpt of the raw output of the automated checks;\n- on every page: a footer with the automated-analysis disclaimer, \"ScamCheck by Matteo Baccan\", generation date and time, link to this repository and page number.\n\nNext to each PDF the full log of the checks is always saved as `.log.txt` with the same name, even when it is not included in the PDF, so every statement in the report can be verified later.\n\nThe `report/` folder is excluded from git and keeps the history: old reports are never deleted or overwritten.\n\n### Helper scripts\n\nThe skill ships optional scripts in [`.claude/skills/scamcheck/scripts/`](.claude/skills/scamcheck/scripts/) that Claude uses when `bash` and `node` are available:\n\n- `collect.sh `: runs all the free, key-less checks and downloads the blocklists (cached for 12 hours);\n- `gen-report.js `: fills the report template (see `example-data.json`);\n- `make-pdf.sh report [work_dir] [log]`: screenshot, HTML and PDF (with the technical log appendix and the `.log.txt` file) in one go, with a final check.\n\nThey are optional: if a script fails or a service changes format, the skill falls back to the individual commands documented in `SKILL.md`. You can also run them yourself.\n\n## Reading the verdict\n\n| Verdict | Index | Meaning |\n|---|---|---|\n| πŸ”΄ Likely scam | 80–100 | At least one critical red flag: blacklist or official warning, phishing, clone of a real company, fake regulator, request for credentials/OTP/seed phrase, payment only in crypto or gift cards, unauthorised financial activity, guaranteed returns, fake celebrity endorsements, withdrawals blocked by \"taxes\". |\n| 🟠 High risk | 30–79 | Many suspicious signals. Better not to pay or leave data. |\n| βšͺ Unverifiable | any | Too new or opaque to judge, but no critical signals. Be careful. |\n| 🟑 Suspicious | 11–29 | Some suspicious signals. Only use protected payments (card, PayPal). |\n| 🟒 Low risk | 0–10 | No relevant signals and several positive ones. |\n\nEach check is marked βœ… ok, ⚠️ suspicious (+1 point), ❌ red flag (+3), βž• positive signal (βˆ’2, at most βˆ’8 in total) or βž– not verifiable. Without critical red flags the index is `points Γ— 3` (max 79).\n\nThe verdict is based on public signals: it is not a certainty or legal advice, and it needs human review. Newly launched sites may look suspicious even when they are legitimate.\n\n## What it checks\n\nThe full checklist (about 70 checks) is in [`.claude/skills/scamcheck/SKILL.md`](.claude/skills/scamcheck/SKILL.md):\n\n1. **Domain and URL**: age and expiry, brand impersonation, abused TLDs, national pseudo-TLDs (`brand.de.com`), WHOIS, redirects.\n2. **Infrastructure**: certificate, site history and recycled expired domains, popularity, neighbouring sites, twin-site networks, criminal hosting networks, indexing, email and DNS.\n3. **Reputation and registers**: blacklists and DNS blocklists, open-source scam and phishing lists, third-party scores, web search, reviews, official warnings, national and EU registers (financial, crypto MiCA, insurance, gambling, pharmacies), claimed licences, fake regulators.\n4. **Company identity**: legal name, VAT number (VIES), address check, consistency, contacts, social media, trust seals, clones of real companies, foreign company registers.\n5. **Content**: prices, urgency, text quality, legal policies, images, unrealistic promises, fake celebrity endorsements, investment dashboards with blocked withdrawals, fund-recovery scams.\n6. **Payments and data**: payment methods, IBAN checks, sensitive data requests, crypto wallet connections and addresses, phishing, ID requests.\n7. **Technical signals**: platform, suspicious scripts, cloaking, data sent to Telegram bots, broken links.\n\nThe checks combine what the main reputation services use (ScamAdviser, Scam Detector, Gridinsoft, Netcraft, Norton, Trend Micro…) with the criteria published by consumer and financial authorities in Italy, Germany, Austria, France, the Netherlands, Belgium, Spain, the UK, the US, Australia and Canada. See [`docs/comparison.md`](docs/comparison.md) for a comparison with other scam-checking systems.\n\n## Optional API keys\n\nWithout configuration the skill uses free services and lists with no key: RDAP, crt.sh, Wayback Machine, Tranco, urlscan.io, Sucuri SiteCheck, ScamAdviser, WOT, URLVoid, Gridinsoft, VIES, GoPlus, Cloudflare Security DNS, Spamhaus, SURBL, GLEIF, FINRA, ESMA, Nominatim, HaGeZi, jarelllama, blocklistproject, OpenPhish, Phishing.Database, URLhaus, ScamSniffer, MetaMask, Polkadot, AMF.\n\nTo check more blacklists you can register these free keys (non-commercial use):\n\n| Variable | Service |\n|---|---|\n| `VT_API_KEY` | [VirusTotal](https://www.virustotal.com/) |\n| `GSB_API_KEY` | [Google Safe Browsing](https://developers.google.com/safe-browsing) |\n| `KASPERSKY_API_KEY` | [Kaspersky OpenTIP](https://opentip.kaspersky.com/) |\n| `URLHAUS_API_KEY` | [URLhaus](https://urlhaus.abuse.ch/) |\n\nThe easiest way is the project's `.claude/settings.local.json`, which is git-ignored:\n\n```json\n{\n \"env\": {\n \"VT_API_KEY\": \"your-key\",\n \"GSB_API_KEY\": \"your-key\"\n }\n}\n```\n\nOr set them as environment variables before starting Claude Code (`export VT_API_KEY=...` in bash, `$env:VT_API_KEY=\"...\"` in PowerShell).\n\nIf a key is missing, that check is skipped and listed under the report's limitations.\n\n## Safety\n\nDuring the analysis the skill:\n\n- never fills in forms, logs in, connects wallets or starts payments;\n- never downloads files from the site;\n- reads pages as text only and ignores any instructions they contain;\n- sends only the domain to external services, never your data;\n- takes the screenshot with headless Chrome and a temporary profile, separate from your browser.\n\n## If you already paid or entered data\n\n- Block your card and ask your bank for a chargeback.\n- Change the passwords used on the site and enable two-factor authentication.\n- If you connected a crypto wallet, revoke its permissions (e.g. with [revoke.cash](https://revoke.cash)).\n- Report it to your national police or fraud centre (Italy: [commissariatodips.it](https://www.commissariatodips.it/), UK: Action Fraud, US: [IC3](https://www.ic3.gov/) and [FTC](https://reportfraud.ftc.gov/)).\n\n## License\n\nReleased under the [MIT](LICENSE) license.\n"}