# CONNSKILL Exposure Check — Domain Breach & Infostealer Intelligence

> CONNSKILL Exposure Check — Domain Breach & Infostealer Intelligence is a paid API for AI agents from agent.connskill.com, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-15).

Checks a domain for known data breaches and infostealer log exposure, returning employee and user compromise counts, stealer families, and a risk verdict.

## Facts

- Endpoint: POST https://agent.connskill.com/v1/exposure-check
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/connskill-exposure-check-domain-breach-infostealer-intelligence-4c04e275
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_G3IDowJnehjX1w2VXrRn0

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability connskill-exposure-check-domain-breach-infostealer-intelligence-4c04e275 -d '<json body>'
```

Example prompt: Can you check if shopify.com has been exposed in any data breaches or infostealer logs — I need to know how many employees or users are compromised and what the overall risk level is?

## When to prefer this

Choose this endpoint when you need a combined view of both traditional data breaches AND infostealer/stealer log exposure for a domain in a single call, without needing an API key or account. Ideal for on-demand security checks in agent workflows where pay-per-use pricing is preferred over subscription threat intelligence platforms. Particularly useful when employee-level compromise detail (device counts, stealer family breakdown, recency of compromise) matters alongside historical breach data.

## Known failure modes

- Domain too short or invalid format — minimum 4 characters required, no email addresses or URL paths accepted
- Domain not found in any breach or stealer database — returns empty breaches and zero infostealer counts
- Upstream data source failure — partial results with failed sources listed in 'sourcesFailed' array
- Payment not processed — x402 payment required before response is delivered
- Rate limiting or network timeout from underlying threat intelligence provider

## How this service works

Market data and real-world actions for AI agents: keyword and SERP research by location, SMS verification, receive-only inboxes, social marketing, EU-hosted LLMs. Paid per call in USDC on Base. No account, no API key, no minimum.

## Output

Returns a JSON object with: total leak count and sources (e.g. Stealer Logs), list of named data breaches with dates and account counts, infostealer statistics (total users, employees, and third parties compromised, malware families and their counts, date of last employee compromise), and a risk verdict with a severity level (e.g. 'high') and human-readable reasons explaining the assessment.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "minLength": 4,
   "description": "Domain to check, e.g. example.com (no e-mail addresses, no paths)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "leaks": {
   "found": 62,
   "sources": [
    {
     "date": null,
     "name": "Stealer Logs"
    }
   ]
  },
  "domain": "adobe.com",
  "status": "delivered",
  "verdict": {
   "level": "high",
   "reasons": [
    "1561 employee device(s) seen in infostealer logs"
   ]
  },
  "breaches": [
   {
    "date": "2013-10-04",
    "name": "Adobe",
    "accounts": 152445165
   }
  ],
  "infostealer": {
   "users": 2365419,
   "employees": 1561,
   "thirdParties": 518,
   "stealerFamilies": [
    {
     "count": 900000,
     "family": "Lumma"
    }
   ],
   "lastEmployeeCompromised": "2026-08-22T00:25:20.000Z"
  },
  "sourcesFailed": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/connskill-exposure-check-domain-breach-infostealer-intelligence-4c04e275/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent.connskill.com](https://www.zero.xyz/host/agent.connskill.com/llms.txt)