Agent skill · aliyun
alibabacloud-website-malware-check
Read-only detection of website defacement/hijacking via page source, hidden SEO links, suspicious redirects, and cloaking, corroborated best-effort by Security Center and WAF. Use when a user suspects their website is hacked, reports an unauthorized web compromise, or has malicious code injected; sees abnormal redirects (even refresh-only), hidden black-hat SEO links, mobile vs desktop content differences (cloaking), or a defaced homepage. ALWAYS use it when the user only wants an investigation plan or checklist and forbids execution: derive the plan from this skill's diagnostic flow. Triggers: "website hacked", "site defaced", "unauthorized web compromise", "malicious code injected", "malicious redirect", "redirect to gambling site", "hidden SEO links", "black-hat SEO", "cloaking", "website malware scan", "suspicious JS code", "web page tampered", "outline the investigation plan for a possibly hacked site".
What it needs
About 9k tokens when loaded.
What this skill does
Website Malware Check (Defacement / Hijacking Diagnostics) Diagnose whether a website has been defaced or hijacked: "my site redirects visitors to a gambling page", "mobile users are redirected but desktop looks fine", "an abnormal redirect appears after I refresh the page", "search-engine users land on hidden spam links", "malicious JS was injected into my pages". Core approach: first fetch and analyze the target page locally - page source, hidden SEO links, suspicious redirect code, hidden iframes, and suspicious external resources. If redirect suspicion or device/UA differences remain, run a multi-UA probe matrix to confirm server-side cloaking. Finally, corroborate local findings with best-effort read-only cloud lookups in Security Center (SAS) and WAF. Every step is read-only; the skill never modifies the target website. Core Capabilities This skill declares three capabilities: 1. Static defacement scan - Analyze page source for hidden SEO links, suspicious redirects (meta refresh, JavaScript redirects, hidden iframes), and suspicious external scripts/links; locate malicious JS precisely with a source-mode deep dive over all external script files. 2. Cloaking and multi-UA detection - Compare responses across desktop / mobile / in-app / search-engine User-Agent and Referer combinations to detect server-side cloaking, where the server serves different (malicious) content to specific visitors. 3. Cloud read-only corroboration - Best-effort read-only lookups in Security Center (suspicious events) and WAF (domain access detail) to corroborate local findings. Failures, empty results, or not-enabled services never block the diagnosis; the report states the skip reason and continues. Detailed detection rules, the suspicious-keyword library, and the known-malicious-domain rule base live in references/detection-capabilities.md. Injection classification is defined in references/injection-types.md. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aliyun/alibabacloud-website-malware-check