Trusted by enterprise security teams
PwC Trustwave Teachers Mutual Bank Swire Shipping Defense.com

Install the Skill

Copy the skill into your personal skills folder:

git clone https://github.com/breachsense/breachsense-plugins
mkdir -p ~/.agents/skills
cp -r breachsense-plugins/plugins/breachsense/skills/query ~/.agents/skills/breachsense

Start a new Codex session and ask it which skills it has. You should see query in the list.

To give your whole team the skill, commit the same folder to .agents/skills/ in a shared repo. Codex picks it up for anyone working in that repo.

The skill is open source. The data behind it requires a Breachsense license key, which you set with one environment variable (covered below).

It’s not only for quick lookups. Codex can build on the API for you, such as a dashboard for your team or a monthly exposure report for management. It can also set up your watchlist and webhook alerts, so new leaks reach your SIEM without anyone asking.

api.breachsense.com GET /stealer
$curl -H "lic: $BS_LIC" \
    "https://api.breachsense.com/stealer?s=example.com"
HTTP/1.1 206 Partial Content  ·  4.2s  ·  application/json
{
  "results": [
    { "usr": "k.becker@example.com", "pwd": "V••••••12", "mal": "StealC", "src": "confluence.example.com", "fnd": "20261019" },
    { "usr": "t.nilsson@example.com", "pwd": "U••••••91", "mal": "Vidar", "ccn": "5188••••••••2470", "fnd": "20261019" },
    { "usr": "legal@example.com", "pwd": "C••••••53", "mal": "StealC", "src": "salesforce.example.com", "fnd": "20261018" },
    { "usr": "m.ahmadi@example.com", "pwd": "G••••••48", "mal": "Vidar", "cwa": "0xBe3a17…cD8f49A", "fnd": "20261018" },
    { "usr": "ops@example.com", "pwd": "F••••••76", "mal": "StealC", "ccn": "4716••••••••5103", "fnd": "20261017" },
    { "usr": "n.silva@example.com", "pwd": "B••••••29", "mal": "Vidar", "src": "gitlab.example.com", "fnd": "20261016" },
    { "usr": "finance@example.com", "pwd": "Y••••••84", "mal": "StealC", "src": "sso.example.com", "fnd": "20261015" },
    { "usr": "l.weber@example.com", "pwd": "N••••••62", "mal": "Vidar", "cwa": "0x9aB42c…6f81E2A", "fnd": "20261014" },
    { "usr": "a.osei@example.com", "pwd": "P••••••38", "mal": "StealC", "src": "jenkins.example.com", "fnd": "20261013" },
    { "usr": "hr@example.com", "pwd": "R••••••15", "mal": "Vidar", "ccn": "5247••••••••8842", "fnd": "20261012" },
    { "usr": "d.chen@example.com", "pwd": "K••••••07", "mal": "StealC", "src": "vpn.example.com", "fnd": "20261011" }
  ],
  "more": "850 more records · paginate via p=2"
}

Why Query Breach Data from Codex?

Have It Write the Integration

Ask Codex to write the script that sends Breachsense alerts into Splunk or Sentinel.

Answers, Not Raw JSON

Codex reads the API response for you. Plaintext passwords go in the summary, and leaked session tokens get flagged, because they bypass MFA.

All 11 Endpoints

Ask in plain English. Codex tells you which endpoint it’s querying, then runs it.

What You Can Ask

Some examples:

  • “Show me stealer logs for example.com from the last 30 days.”
  • “Any leaked session tokens for our domain in the last week?”
  • “Find leaked AWS keys associated with example.com.”
  • “Search leaked documents for any mention of Project Falcon.”
  • “Add example.com to my watchlist and send alerts to security@example.com.”

Endpoint Coverage

All 11 Breachsense endpoints are part of the skill.

EndpointWhat it covers
/stealerInfostealer credentials from RedLine, Lumma, StealC, and similar families
/comboCombo lists circulating on hacker forums
/credsThird-party breach credentials and unsecured database dumps
/sessionsSession cookies and auth tokens that bypass MFA
/nhiNon-human identities: API keys, OAuth tokens, service credentials
/darkwebRansomware leak site victim listings
/radarHacker forums and underground marketplaces where credentials get sold
/phishCredentials your users typed into phishing pages
/docsFull-text search across leaked ransomware files, third-party breaches, and unsecured DB dumps
/asmAttack surface: subdomains, exposed services, phishing domains
/accountWatchlist setup, webhook alerts, test alerts, license rotation

License Key Setup

The skill checks two places, in order.

Option 1: Environment variable. Recommended.

echo 'export BREACHSENSE_API_KEY=your-license-key-here' >> ~/.zshrc
source ~/.zshrc

Start a new Codex session after setting it. A running session won’t pick up the new value.

Option 2: License file. Use this if you’d rather not touch your shell config.

mkdir -p ~/.config/breachsense
echo 'your-license-key-here' > ~/.config/breachsense/license.md
chmod 600 ~/.config/breachsense/license.md

If neither is set, the skill loads but every query returns an auth error.

Set Your License Key Once

Export your key as an environment variable, start a new Codex session, and you’re done.

Get Your Key

Export the Env Var

Start a New Session

Start Asking

Book a demo

Frequently Asked Questions

Yes. The skill is open source, but every query hits the Breachsense API, which needs a license key. If you don’t have one yet, book a demo.
Yes. It’s the same skill file. The Claude Code plugin installs it through Claude’s plugin marketplace. In Codex you copy the folder into your skills directory.
Queries go to the Breachsense API over HTTPS, the same backend direct API callers use. The skill reads your key from an environment variable and never prints it.
Yes, through the /account endpoint, and the skill tells Codex to confirm with you first. Read-only queries run without asking.
Yes. It lives at github.com/breachsense/breachsense-plugins. The data behind it is what the license covers.

Related Resources

Dark Web API

The REST API the skill wraps. Same endpoints, called over HTTPS with curl, scripts or your SIEM.

Learn More

Breachsense for Claude Code

The same skill, installed as a Claude Code plugin.

Learn More

Breachsense for GitHub Copilot

The same skill, installed in GitHub Copilot.

Learn More

API Workflows and Use Cases

Endpoint-by-endpoint patterns for credential monitoring and vendor breach investigation.

Learn More

Documentation

Full reference for every endpoint: authentication, parameters and response schemas.

Learn More

Want to Try It? Book a Demo and We’ll Send You a Trial Key

Book a demo