Third Party Detector

Third-Party Detector Skill

Purpose

Identify third-party services integrated into the target's technology stack including payments, analytics, authentication, CRM, support, and other SaaS tools.

Input

Raw signals from Phase 2:

• javascript_signals - Third-party script URLs, analytics globals
• html_signals - Widget embeds, script tags
• dns_signals - Service verification TXT records
• http_signals - CSP allowed domains
• job_signals - Tool mentions

Service Categories

Payment Processing

Analytics & Tracking

Customer Support

Authentication & Identity

CRM & Marketing

Error & Performance Monitoring

A/B Testing & Experimentation

CDN & Media

Social & Communication

Detection Logic

def detect_third_party_services(signals):
    results = []

    # JavaScript/Script Tag Detection
    for script_url in signals.javascript_signals.script_urls:
        for service in THIRD_PARTY_SERVICES:
            for pattern in service.script_patterns:
                if pattern in script_url:
                    add_service(results, service.name, service.category, {
                        "type": "script_url",
                        "value": script_url,
                        "weight": service.weight
                    })

    # JavaScript Global Detection
    for global_var in signals.javascript_signals.globals:
        for service in THIRD_PARTY_SERVICES:
            if service.global_var and service.global_var in global_var:
                add_service(results, service.name, service.category, {
                    "type": "js_global",
                    "value": global_var,
                    "weight": service.weight
                })

    # CSP Domain Detection
    if signals.http_signals.csp:
        csp_domains = extract_domains(signals.http_signals.csp)
        for domain in csp_domains:
            for service in THIRD_PARTY_SERVICES:
                if any(pattern in domain for pattern in service.domain_patterns):
                    add_service(results, service.name, service.category, {
                        "type": "csp_domain",
                        "value": domain,
                        "weight": service.weight - 10  # Slightly lower weight
                    })

    # DNS TXT Record Detection
    for txt in signals.dns_signals.txt_records:
        for service in THIRD_PARTY_SERVICES:
            if service.txt_pattern and service.txt_pattern in txt:
                add_service(results, service.name, service.category, {
                    "type": "dns_txt",
                    "value": txt,
                    "weight": service.weight
                })

    # Job Posting Detection
    if signals.job_signals:
        for tech_mention in signals.job_signals.tech_mentions:
            for service in THIRD_PARTY_SERVICES:
                if service.name.lower() in tech_mention.technology.lower():
                    add_service(results, service.name, service.category, {
                        "type": "job_posting",
                        "value": f"Mentioned in job postings",
                        "weight": 20  # Lower weight for job signals
                    })

    return results

Output

{
  "skill": "third_party_detector",
  "results": {
    "technologies": [
      {
        "name": "Stripe",
        "category": "Payment Processing",
        "signals": [
          {
            "type": "script_url",
            "value": "https://js.stripe.com/v3/",
            "weight": 40
          },
          {
            "type": "csp_domain",
            "value": "api.stripe.com in CSP",
            "weight": 30
          }
        ],
        "total_weight": 70,
        "integration_type": "Client-side SDK"
      },
      {
        "name": "Google Analytics 4",
        "category": "Analytics",
        "signals": [
          {
            "type": "script_url",
            "value": "https://www.googletagmanager.com/gtag/js",
            "weight": 40
          },
          {
            "type": "js_global",
            "value": "gtag() function detected",
            "weight": 35
          }
        ],
        "total_weight": 75,
        "tracking_id": "G-XXXXXXXXXX"
      },
      {
        "name": "Intercom",
        "category": "Customer Support",
        "signals": [
          {
            "type": "script_url",
            "value": "https://widget.intercom.io/widget/",
            "weight": 40
          }
        ],
        "total_weight": 40,
        "integration_type": "Chat Widget"
      },
      {
        "name": "Sentry",
        "category": "Error Monitoring",
        "signals": [
          {
            "type": "script_url",
            "value": "https://browser.sentry-cdn.com/",
            "weight": 40
          }
        ],
        "total_weight": 40,
        "integration_type": "Client-side SDK"
      },
      {
        "name": "Auth0",
        "category": "Authentication",
        "signals": [
          {
            "type": "csp_domain",
            "value": "*.auth0.com in CSP",
            "weight": 35
          },
          {
            "type": "job_posting",
            "value": "Auth0 mentioned in job requirements",
            "weight": 20
          }
        ],
        "total_weight": 55
      }
    ],
    "services_by_category": {
      "Payment Processing": ["Stripe"],
      "Analytics": ["Google Analytics 4", "Google Tag Manager"],
      "Customer Support": ["Intercom"],
      "Error Monitoring": ["Sentry"],
      "Authentication": ["Auth0"]
    },
    "integration_summary": {
      "total_services": 5,
      "categories_covered": 5,
      "client_side_integrations": 4,
      "server_side_likely": ["Auth0", "Stripe"]
    }
  }
}

Confidence Notes

Third-party detection confidence varies by signal type:

Error Handling

• Missing scripts: May indicate server-side only integration
• Multiple analytics: Common - report all
• Deprecated services: Note if detected