# Leakcheck

> Look up emails, usernames, phone numbers, password hashes, SHA-256 hashes, domains, and similar identifiers in LeakCheck.io (10B+ breach and infostealer records). Trigger whenever an email, username, phone, hash, or domain is present in the task — leak check, breach search, dump lookup, haveibeenpwned-style check, stealer-log search, or OSINT enrichment — even if LeakCheck is not named. Public API for sources and field categories; Pro API v2 full records when LEAKCHECK_API_KEY is set.

- Skill: `ibnaleem/leakcheck` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add ibnaleem/leakcheck`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ibnaleem/leakcheck/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: GPL-3.0
- Author: ibnaleem (https://skillmd.com/u/ibnaleem)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ibnaleem/leakcheck

---


# LeakCheck

Query [LeakCheck](https://docs.leakcheck.io/overview) for whether an identifier appears in known breaches and info-stealer logs.

Public API returns **where** it leaked and **which field categories** were exposed — never the values. Pro API v2 returns full rows (names, usernames, passwords, phones, etc.) and remaining quota.

## Route

1. Read `LEAKCHECK_API_KEY`. If unset, also accept the official alias `LEAKCHECK_APIKEY`.
2. Key present → Pro API v2.
3. Key absent → Public API. If the query needs a Pro-only type (phone, domain, keyword, password, origin, phash), stop and say Pro is required instead of calling Public.

Keep the key in the `X-API-Key` header. Query-string `?key=` ends up in logs; skip it. Never print, commit, or echo the key.

Canonical caller: `skills/leakcheck/scripts/lookup.sh <query> [type]`.

## Public API (free)

```text
GET https://leakcheck.io/api/public?check={check}
```

No auth. Type is auto-detected. URL-encode `{check}`. Minimum 3 characters.

Accepted inputs:

| Type | Example | Notes |
| --- | --- | --- |
| Email | `example@example.com` | |
| Email hash | `31c5543c1734d25c7206f5fd` | SHA-256 of the **lower-cased** email; 24-char truncation is valid |
| Username | `example` | Min. 3 characters |

```bash
curl --request GET \
  --url "https://leakcheck.io/api/public?check=$(printf %s "$CHECK" | jq -sRr @uri)" \
  --header "Accept: application/json"
```

200 example:

```json
{
  "success": true,
  "found": 3,
  "fields": ["username", "first_name", "address"],
  "sources": [
    { "name": "Evony.com", "date": "2016-07" },
    { "name": "I-Dressup.com", "date": "2016-08" },
    { "name": "Zynga.com", "date": "2019-09" }
  ]
}
```

- `found` — matching breach count
- `fields` — categories exposed across those breaches, not the values
- `sources[].date` — `YYYY-MM`

Rate limit: **1 request/second**. Space bulk checks. Commercial/public-facing use needs a "Powered by LeakCheck" credit ([terms](https://docs.leakcheck.io/public-api/lookup)).

## Pro API v2 (paid)

```text
GET https://leakcheck.io/api/v2/query/{query}?limit=100
```

```bash
curl --request GET \
  --url "https://leakcheck.io/api/v2/query/$(printf %s "$QUERY" | jq -sRr @uri)?limit=100" \
  --header "Accept: application/json" \
  --header "X-API-Key: $LEAKCHECK_API_KEY"
```

`{query}` is path-encoded, min. 3 characters. Default `limit` is 100 (max 1000). `offset` max 2500.

Optional `?type=` — omit it when auto-detect works (email, username, phone, hash). Set it when auto-detect cannot (domain, keyword, origin, password) or after a 422.

| Type | Sample | Notes |
| --- | --- | --- |
| `auto` | email, username, phone, hash | Default when `type` is omitted |
| `email` | `example@example.com` | |
| `username` | `example` | |
| `phone` | `12063428631` | |
| `hash` | `31c5543c1734d25c7206f5fd` | SHA-256 of lower-cased email; 24-char truncation OK |
| `domain` | `gmail.com` | Must set `type=domain` |
| `keyword` | `example` | Must set `type=keyword` |
| `phash` | SHA-256 of a password | Enterprise |
| `origin` | `example.com` | Info-stealer origin site. Enterprise |
| `password` | `example` | Enterprise |

Found:

```json
{
  "success": true,
  "found": 1,
  "quota": 400,
  "result": [
    {
      "email": "example@example.com",
      "source": {
        "name": "BreachedWebsite.net",
        "breach_date": "2019-07",
        "unverified": 0,
        "passwordless": 0,
        "compilation": 0
      },
      "first_name": "Example",
      "last_name": "Example",
      "username": "leakcheck",
      "fields": ["first_name", "last_name", "username"]
    }
  ]
}
```

Nothing found: `"found": 0`, `"result": []`. Still a success.

Row notes:

- `source.unverified` / `passwordless` / `compilation` are 0/1 flags
- Stealer-log rows may have `collected` (`YYYY-MM-DD` or `"April 2024 or earlier"`) instead of `breach_date`
- Extra keys vary: `username`, `password`, `first_name`, `last_name`, `dob`, `address`, `zip`, `phone`, `name`

Rate limit: **3 requests/second** (raiseable in account settings). `quota` is remaining queries — surface it.

To avoid sending a raw email, SHA-256 the lower-cased address and query with `type=hash`.

## Errors

JSON body plus HTTP status. Surface both; do not retry blindly.

| Error | Status |
| --- | --- |
| Missing X-API-Key header | 401 |
| Invalid X-API-Key | 400 |
| Invalid type / email / query / domain | 400 |
| Too short query (< 3 characters) | 400 |
| Invalid characters in query | 400 |
| Active plan required / Limit reached | 403 |
| Too many requests | 429 |
| Could not determine search type automatically | 422 |

On 429, wait and retry once. On 422, retry once with an explicit `type`. On 403, stop — plan or quota, not a transient blip.

## Report

Do not paraphrase away fields. Quote API data. Mark inferred claims.

```markdown
# LeakCheck: {query}
- Mode: public | pro
- Found: {n}
- Quota: {n}   (pro only)

## Exposed field categories
- …

## Sources
| Name | Date |
| --- | --- |
| … | YYYY-MM |

## Records
(pro only — one block per result row)
```

If Public `found > 0`, say that values are withheld and Pro is needed for full rows.

Treat passwords, hashes, phones, and addresses as sensitive. Put them in the report the user asked for; do not write them into logs, tickets, or world-readable files. Do not attempt logins with leaked credentials.

Docs: https://docs.leakcheck.io/overview