agent security skill risk: medium
Canary Token Deployment for Deception Detection
Provides steps to authenticate with the Thinkst Canary API, create web bug, DNS, and document tokens, list tokens, query alerts, and generate deception coverage reports.
- Policy sensitive
- Human review
- External action: high
SKILL 4 files · 2 folders
SKILL.md
--- name: implementing-deception-based-detection-with-canarytoken description: "Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug" --- # Implementing Deception-Based Detection with Canarytoken ## Overview Canary Tokens are lightweight tripwire mechanisms that alert when an attacker accesses a resource. This skill uses the Thinkst Canary REST API to programmatically create tokens (web bugs, DNS tokens, MS Word documents, AWS API keys), deploy them to strategic locations, monitor for triggered alerts, and generate deception coverage reports. ## When to Use - When deploying or configuring implementing deception based detection with canarytoken capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation ## Prerequisites - Thinkst Canary Console or canarytokens.org account - API auth token from Canary Console - Python 3.9+ with `requests` - File system access for deploying document and file tokens ## Steps 1. Authenticate to the Canary Console API using auth_token 2. Create web bug (HTTP) tokens for embedding in documents and web pages 3. Create DNS tokens for monitoring DNS resolution attempts 4. Create MS Word document tokens for file share deployment 5. List all active tokens and their trigger history 6. Query recent alerts for triggered token events 7. Generate deception coverage report with deployment recommendations ## Expected Output - JSON report listing all deployed Canary Tokens, trigger history, alert details, and coverage analysis - Deployment map showing token types across network segments
REQUIRED CONTEXT
- Thinkst Canary Console or canarytokens.org account
- API auth token from Canary Console
- Python 3.9+ with requests library
- File system access for deploying tokens
EXPECTED OUTPUT
- Format
- structured_report
- Schema
- json_report · deployed Canary Tokens, trigger history, alert details, coverage analysis, Deployment map
- Constraints
-
- JSON report listing all deployed Canary Tokens, trigger history, alert details, and coverage analysis
- Include deployment map showing token types across network segments
SUCCESS CRITERIA
- Deploy and monitor Canary Tokens via the Thinkst Canary API
- Generate deception coverage report with deployment recommendations
CAVEATS
- Dependencies
-
- Thinkst Canary Console or canarytokens.org account
- API auth token from Canary Console
- Python 3.9+ with `requests`
- File system access for deploying document and file tokens
- Missing context
-
- Exact API authentication details and token format
- Output format specification beyond high-level JSON description
- Error handling or retry logic
- Ambiguities
-
- Awkward phrasing in 'When deploying or configuring implementing deception based detection with canarytoken capabilities'
- Does not specify exact API endpoints or request formats
- Steps list high-level actions without parameters or examples
QUALITY
- OVERALL
- 0.58
- CLARITY
- 0.72
- SPECIFICITY
- 0.55
- REUSABILITY
- 0.48
- COMPLETENESS
- 0.62
IMPROVEMENT SUGGESTIONS
- Replace the redundant 'When to Use' bullet with concise trigger conditions
- Add concrete code examples or curl snippets for each step
- Define the structure of the expected JSON report explicitly
USAGE
Copy the prompt above and paste it into your AI of choice — Claude, ChatGPT, Gemini, or anywhere else you're working. Replace any placeholder sections with your own context, then ask for the output.
MORE FOR AGENT
- MoltPass Client for AI Agent Identities agent security
- Supply Chain Dependency Risk Auditor agent security
- Supply Chain Dependency Risk Auditor agent security
- Threat Modeling Security Expert agent security
- Security Bluebook Policy Builder agent security
- Security Bluebook Policy Builder agent security
- Security Blue Book Policy Builder agent security
- Threat Modeling Security Architecture Expert agent security
- Supply Chain Dependency Risk Auditor agent security
- Threat Modeling Security Expert agent security
- SIEM Detection Rule Tuning Guide agent security
- AI File Metadata Compliance Auditor agent security
- Azure Storage Misconfiguration Audit Reporter agent security
- Implementing PAM for Database Access agent security
- AFL++ Coverage-Guided Fuzzing Procedure agent security
- Supply Chain Attack Simulation Detector agent security
- Security Audit Fix Verifier agent security
- Active Directory ACL Abuse Analyzer agent security
- Privileged Access Workstation Implementation Guide agent security
- SSRF Vulnerability Testing and Reporting Guide agent security
- Security Audit Fix Reviewer agent security
- AWS IAM Privilege Escalation Detector agent security
- SSL/TLS Security Assessment with Sslyze agent security
- GCP Penetration Testing with GCPBucketBrute agent security
- AWS CloudTrail Anomaly Detection Guide agent security