@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/risk-compliance/similar-domain/references/report-template.md

@@ -0,0 +1,93 @@
+# Report template
+
+Save:
+
+```text
+reports/similar-domain/<seed>_cluster.md
+```
+
+Use the first seed's registrable domain as `<seed>`; for multiple seeds
+use a short scope name the user recognises. No Markdown bold in the report
+body. After writing, grep banned strings in
+[terminology.md](terminology.md).
+
+```markdown
+# Domain cluster — <seed or scope>
+
+## Verdict
+## Cluster
+## Evidence matrix
+## Entity chain
+## Outliers
+## Watchlist
+## Coverage and caveats
+## Pivot log
+## Sources
+```
+
+## Chapter requirements
+
+### Verdict
+
+At most three sentences: which domains form a cluster, what the strongest
+evidence is, and which seeds do not belong. No new evidence here.
+
+### Cluster
+
+One row per domain, sorted Confirmed → Probable → Possible. Columns: domain,
+brand, role (parent, mirror, acquired brand), label, registered date,
+current operator (if known), strongest two links. Seeds that are Unrelated
+go in Outliers, not here.
+
+### Evidence matrix
+
+Domains as rows, fingerprints as columns, cell shows the shared value or a
+short marker. Include at least: analytics account, template, mail string
+or platform, nameserver pair, registrar and proxy, registration timestamp,
+licence or entity. Mark platform-level columns as such in the header so a
+reader does not count them as operator evidence. This table is what lets a reader check the labels
+without rerunning the work.
+
+### Entity chain
+
+The operator history with dates: entities, licences, migrations, brand
+acquisitions. Present conflicting operator names as a dated sequence. Cite
+the page for each fact.
+
+### Outliers
+
+Every seed or candidate that was checked and rejected, with the
+fingerprints that differ. "Different brand" is not a reason; "different
+analytics account, different mail platform, different CDN account" is.
+
+### Watchlist
+
+The fingerprints that will catch the operator's next domain after a
+takedown or rebrand. One row per durable operator-level value: the
+value, why it should survive a domain change, and the source class that
+can watch it (page-source index for account IDs, certificate
+transparency and new-registration feeds for naming schemes, company
+register for officers and new companies). Leave platform-level values
+out, including platform addresses and platform-assigned ID ranges, even
+as "candidate generators"; they would flag every customer of the
+platform. If they help narrow a search, mention them under coverage, not
+here.
+
+### Coverage and caveats
+
+What could not be observed and why: geo-blocks, bot challenges, private
+registration, resolver artefacts, pivots not run for budget reasons,
+source classes not available. State the platform tenancy result for each
+hosting address, and the visitor identities a split-delivery check did
+and did not try. State whether the cluster is closed (a full
+pass added nothing) or open.
+
+### Pivot log
+
+One row per pivot: pass, fingerprint, source class, query, hit count,
+domains kept. Empty pivots stay in the log; they are what makes a negative result
+credible.
+
+### Sources
+
+Every external page cited, as links.

package/skills/risk-compliance/similar-domain/references/scoring.md

@@ -0,0 +1,130 @@
+# Scoring
+
+Weight each link by how hard it is to share by accident, count independent
+signals, and label every domain.
+
+## Link strength
+
+| Signal | Strength | Reason |
+|---|---|---|
+| Same analytics, tag-manager, pixel, or error-monitoring account ID | Very strong | One paying account, one admin |
+| Same per-tenant platform account ID or payment account ID | Very strong | One account holder |
+| Same custom page template with non-default literals | Very strong | Shared codebase |
+| Mirror serves the parent's support address or redirects to it | Very strong | Self-declared |
+| Same support-email domain registered by the operator | Strong | One business mailbox domain |
+| Same company officers (not nominees) on both sites' operating entities | Strong | Same people behind both companies |
+| Byte-identical SPF string with three or more vendor includes | Strong | Chosen combination of vendors |
+| Same organisation tenant ID in TXT records | Strong | One tenant |
+| Same registrar + proxy + timestamps within an hour, outside a platform's bundled registrar | Strong | One batch action (see Registration batches) |
+| Licence register lists both domains under one licence | Strong | Authoritative, but lags reality |
+| Same registrar + proxy + identical lock set, days apart | Medium | Same account defaults |
+| Same CDN nameserver pair | Medium | Per account, but pairs are reused |
+| Same legal entity named on both sites' own terms pages | Medium | Text can be copied; stronger when the company record confirms it |
+| Same origin address or ASN outside a CDN, dedicated (tenancy test negative) | Medium | Shared hosting is common |
+| Same office unit for two different entities, not a registered-agent address | Weak to medium | Small operators share offices; check the address against the register first |
+| Same platform vendor, CNAME target, or subdomain scheme | Weak | Vendor-level |
+| Same platform ingress address, theme, asset host, or bundled registrar on platform tenants | Weak | Platform-level: every customer of the platform has it |
+| Same affiliate program | Weak to medium | Some programs serve several operators |
+| Same game providers, bonus wording, licence authority | Weak | Industry-wide |
+| Similar brand name | Candidate only | Names are cheap |
+
+## Independence
+
+Two signals count as independent only if a different party controls
+each. Examples that count once, not twice: analytics token and block-page
+template (same front-end deployment); nameserver pair and CDN analytics
+token (same CDN account); registrar and proxy service (same registrar
+account); platform address, platform theme, and bundled registrar (same
+platform); entity name, address, and support address in one footer (same
+boilerplate; see Footer blocks).
+Examples that count separately: analytics token and SPF string;
+registration batch and page template; licence register and mail tenant.
+
+## Labels
+
+| Label | Rule |
+|---|---|
+| Confirmed | Two independent strong-or-better signals, or one very strong signal plus any medium one |
+| Probable | One strong or very strong signal, or two independent medium signals, or authoritative register listing without technical confirmation yet |
+| Possible | One medium signal, or vendor- or platform-level signals only (however many), or a name-scheme candidate |
+| Unrelated | Checked, and the operator-level fingerprints differ (different analytics accounts, different template, different mail platform, different registrar behaviour) |
+
+Only Confirmed and Probable enter the loop as new seeds. Possible domains
+are parked with the one fingerprint that would promote them, so a later
+pass can pick them up.
+
+Platform co-tenants are a candidate pool, not a cluster. Fingerprint
+each one for operator-level values and score only those.
+
+## Registration batches
+
+Ask who bought the domain, not only when.
+
+- Domains bought through the platform's own registrar (the store
+  domains of tenants) share that registrar by default; tight timestamps
+  among them are medium at most, because the platform may register in
+  bulk for many customers.
+- Domains the operator registered for itself outside the platform
+  (mailbox domains, company domains, landing domains) registered within
+  minutes of each other are one account's batch action: strong, and
+  operator-level, even when the companies named on them differ.
+
+Decide whether a registrar is the platform's own from tenants **outside**
+the suspect set (stores found through the platform's asset host or
+directory, not through the suspect's IP neighbours, which are the network
+under test). If that sample cannot be built, treat the registrar as the
+platform's and say so in the caveats.
+
+## Shared account IDs on many brands
+
+An analytics, tag, or monitoring ID shared by brands that name different
+companies is either one operator behind several companies or a vendor
+inserting its own ID for every client. Check sites outside the suspect
+set that use the same vendor or hosting: if they carry the same ID, it is
+vendor-level; if they carry different IDs, it is operator-level. If no
+such site can be found, keep the ID as very strong but state the vendor
+reading in the caveats and do not let it alone carry a Confirmed.
+
+## Footer blocks
+
+The company name, address, and support address in one footer or terms
+page are one block of text and count as one signal when copied across
+sites. A support-email domain counts as its own signal only after it was
+checked as a domain (registration record, mail records) and found to be
+an operator-registered domain.
+
+## Indirect links
+
+Score each domain on its links to a seed or a Confirmed member. A link
+that reaches only a Probable member caps the domain at Probable, however
+strong the link. Show the chain (domain → linking value → member) in the
+pivot log so a reader can follow it.
+
+## Worked example: one operator, many shells, one platform
+
+Twenty stores sit on one hosted storefront platform; their footers name
+eight different companies. Shared IP, theme, asset host, and the
+platform's registrar are one platform-level signal: every store is
+Possible on that alone. Three stores share one support-email domain the
+operator registered: they link to each other as strong. The mailbox
+domains of five other companies were registered at one registrar outside
+the platform within the same minute as the first mailbox domain: strong,
+operator-level, linking those companies' stores to the first three. The
+company names stay in the entity chain as a dated list; they explain the
+shells, they do not split the cluster.
+
+## Negative evidence
+
+A domain can share medium signals and still be Unrelated. Different mail
+platforms, different CDN accounts, different analytics accounts, and a
+registration years apart together outweigh a shared nameserver pair or
+shared licence authority. Say so explicitly in the outliers section
+rather than leaving the domain unlabelled.
+
+## Conflicts
+
+When technical evidence and corporate evidence disagree, report both and
+date them. Continuous technical evidence across a corporate break usually
+means an entity swap on one platform; continuous corporate evidence across
+a technical break usually means a platform migration. Neither breaks the
+cluster; both belong in the entity chain.

package/skills/risk-compliance/similar-domain/references/terminology.md

@@ -0,0 +1,41 @@
+# Terminology
+
+| Term | Meaning in this skill |
+|---|---|
+| Seed | A domain the user supplied or a Confirmed/Probable domain fed back into the loop |
+| Fingerprint | Any identifier on a domain that is not the brand name and can be shared across domains |
+| Pivot | A reverse query: "which other domains carry this fingerprint?" |
+| Candidate | A domain returned by a pivot or a name scheme, not yet scored |
+| Cluster | The set of Confirmed and Probable domains linked by operator-level fingerprints |
+| Operator-level | A fingerprint tied to one paying account or one codebase (analytics ID, template, mail tenant) |
+| Vendor-level | A fingerprint tied to a platform many operators use (game provider, CDN, chat widget) |
+| Platform tenant | A site hosted on a platform that serves many customers from shared addresses and themes (storefront builder, white-label casino) |
+| Platform-level | A vendor-level fingerprint that every tenant of one hosted platform shares: ingress address, theme, asset host, bundled registrar |
+| Split delivery | Cloaking: different content for crawlers or reviewers than for real visitors |
+| Watchlist | Durable operator-level fingerprints to monitor for the operator's next domain |
+| Mirror | A domain serving or redirecting to a parent brand to evade blocking, usually numbered or hyphenated |
+| Entity chain | The dated sequence of legal operators, licences, and migrations behind a brand |
+| Closed cluster | A full loop pass added no domain |
+| Open cluster | Expansion stopped for budget or access reasons; unexplored pivots are listed |
+
+## Language
+
+- Say "linked", "shares", "same account", "same template" for technical
+  evidence. Say "operated by", "licensed to" only with a cited entity
+  source.
+- Say "not observable" when a source class cannot see the fingerprint;
+  say "absent" only when a source that can see it returned nothing.
+- Say "Unrelated on current evidence" rather than "unrelated"; the
+  negative is bounded by the pivots run.
+- Name the source class, not a product, when describing what was queried,
+  unless the user asked for the tool.
+
+## Banned strings in the report body
+
+- "owned by" or "same company" without an entity citation in the same
+  paragraph
+- "confirmed" applied to ownership (Confirmed is a label for a link, not a
+  legal finding)
+- "definitely", "certainly", "no doubt"
+- "unrelated" without "on current evidence" or an outliers row
+- Any fingerprint value presented without a source

package/skills/risk-compliance/similar-domain/references/workflow.md

@@ -0,0 +1,85 @@
+# Workflow detail
+
+SKILL.md is the index. This file is the procedure those steps run.
+
+## Input
+
+One or more **seed domains** (bare domain or URL) and the question behind
+them. Typical questions:
+
+| Question | What the cluster must answer |
+|---|---|
+| "Are these domains related?" | Which seeds share an operator, and on what evidence |
+| "Who is behind this site?" | Entity chain with dates and licence |
+| "Find the mirrors / sister sites" | Every domain the same operator runs, labelled by confidence |
+| "Merchant background check" | Cluster plus history: licence changes, operator migrations, complaints |
+
+Optional context that changes the work: a transaction file whose descriptor
+URL is the seed, a date range, a jurisdiction of interest, or a list of
+domains the user already believes are related (treat that list as
+hypotheses, not facts).
+
+## Access limits
+
+Expect at least one of these on every gambling, adult, crypto, or
+high-risk-merchant seed:
+
+- **Geo-block page** (403 with a branded page) — the page itself is a
+  fingerprint: template, analytics token, support address, favicon.
+- **Bot challenge** (Cloudflare "Just a moment") — nothing behind it is
+  visible; use subdomains, certificate history, archives, and mirrors
+  instead.
+- **Private registration** — the proxy service, registrar, dates, and lock
+  set are still visible and still cluster.
+- **Local resolver artefacts** — a VPN or proxy on the analyst machine can
+  return fake addresses (for example the 198.18.0.0/15 range). Do not use
+  those as hosting fingerprints; use nameservers, certificates, and
+  third-party passive DNS instead.
+
+Record each limit in the report's coverage caveats.
+
+## Order that must not move
+
+Fingerprint → pivot → expand names → entity → score → loop → report.
+
+Run the platform tenancy test before trusting any hosting fingerprint,
+and fingerprint the seed completely before running any pivot. Pivots run on
+fingerprints, not on brand names; the name scheme (step 3) is a candidate
+generator that must be confirmed by a fingerprint. Entity research (step 4)
+names and dates the cluster but never adds a domain that has no technical
+link unless a licence register or the operator's own terms page lists it
+explicitly. Scoring (step 5) happens before a domain enters the loop, so the
+loop never expands on a Possible.
+
+## Loop discipline
+
+Each pass:
+
+1. Take every domain labelled Confirmed or Probable that has not yet been
+   fingerprinted.
+2. Fingerprint it fully (step 1).
+3. Pivot on any fingerprint not already pivoted (step 2). Skip pivots whose
+   result is already known from an earlier pass. New support-email
+   domains, companies, officers, and account IDs found on new members are
+   new fingerprints.
+4. Score new candidates (step 5).
+5. Log the pass in the pivot log with its number.
+
+Stop when a full pass adds no domain, or when the user's question is
+answered and the remaining candidates are mirrors of brands already in the
+cluster. State the stop reason in the report.
+
+Set a budget before starting: a cluster of a large offshore operator can
+run past a hundred domains. When the budget is hit, report the cluster as
+"open" and list the unexplored pivots.
+
+## What counts as done
+
+- Every seed has a label and a row in the evidence matrix.
+- Every non-seed member has at least one fingerprint link to a seed or to
+  another Confirmed member.
+- The entity chain explains the cluster's history where sources allow.
+- Outliers (seeds that did not join) are explained by absence of shared
+  fingerprints, not just by a different brand.
+- The watchlist names every durable operator-level fingerprint, or says
+  none was found.

package/skills/risk-compliance/similar-domain/release-check.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const WEEK_MS = 7 * DAY_MS;
+const here = dirname(fileURLToPath(import.meta.url));
+
+function readJson(path, fallback = {}) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return fallback; }
+}
+
+function frontmatterValue(text, key) {
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+  const match = new RegExp('^' + key + ':\\s*([^\\n]+)$', 'm').exec(frontmatter);
+  return match?.[1].trim().replace(/^['"]|['"]$/g, '') ?? null;
+}
+
+function repositoryOf(source) {
+  const value = String(source ?? '').trim();
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/.exec(value);
+  return match?.[1] ?? null;
+}
+
+function stableVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(String(value ?? '').trim());
+  return match ? match.slice(1).map(Number) : null;
+}
+
+function newer(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return false;
+}
+
+function writeCache(path, value) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(value));
+  } catch { /* A read-only cache must not block skill use. */ }
+}
+
+function main(now = Date.now()) {
+  if (process.env.ONEABOVEIO_NO_UPDATE_CHECK) return;
+  const skill = readFileSync(join(here, 'SKILL.md'), 'utf8');
+  const name = frontmatterValue(skill, 'name');
+  const localVersion = stableVersion(frontmatterValue(skill, 'release-version'));
+  if (!name || !localVersion) return;
+
+  const lock = readJson(join(process.env.HOME || homedir(), '.agents', '.skill-lock.json'));
+  const entry = lock.skills?.[name];
+  const repository = repositoryOf(entry?.sourceUrl || entry?.source);
+  if (!repository) return;
+
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(process.env.HOME || homedir(), '.cache');
+  const cachePath = join(cacheRoot, '1aboveio-skills', 'release-check.json');
+  const all = readJson(cachePath);
+  const cache = all[repository] && typeof all[repository] === 'object' ? all[repository] : {};
+
+  if (!cache.lastCheck || now - cache.lastCheck >= DAY_MS) {
+    const result = spawnSync('gh', ['api', 'repos/' + repository + '/releases/latest', '--jq', '.tag_name'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 1500,
+    });
+    cache.lastCheck = now;
+    if (result.status === 0 && stableVersion(result.stdout)) cache.latestTag = result.stdout.trim();
+    else delete cache.latestTag;
+    all[repository] = cache;
+    writeCache(cachePath, all);
+  }
+
+  const latestVersion = stableVersion(cache.latestTag);
+  if (!latestVersion || !newer(latestVersion, localVersion)) return;
+  if (cache.notifiedTag === cache.latestTag && cache.notifiedAt && now - cache.notifiedAt < WEEK_MS) return;
+
+  cache.notifiedTag = cache.latestTag;
+  cache.notifiedAt = now;
+  all[repository] = cache;
+  writeCache(cachePath, all);
+  const command = `npx skills@1.5.23 add '${repository}#${cache.latestTag}' --global --agent universal claude-code --skill ${name} --yes`;
+  process.stdout.write(
+    `UPDATE_AVAILABLE: A newer 1AboveIO skills release (${cache.latestTag}) is available; this skill is `
+      + `v${localVersion.join('.')}. Ask once whether to refresh ${name}. On approval run \`${command}\`. `
+      + 'The refreshed instructions apply next session. Either way, continue the current task and do not ask again this session.\n',
+  );
+}
+
+try { main(); } catch { /* Update checks are advisory and always fail silent. */ }

package/skills/risk-compliance/tld-detection/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO