360 Secure SkillHub
360 安全技能中心

Etalon Techscan

该 Skill 通过本地安装的 ETALON CLI(etalon techscan)探测指定域名所用的框架、CDN、CMS、分析、支付、托管等技术,依据 HTTP 头、Cookie、脚本、meta、HTML 与 DNS 信号给出置信度与检测方式,支持单域名与批量扫描、对比两个站点,并可选用数据库保存结果;CLI 本体不含在内,需自行安装。

rednix
rednix
热度 18.96
最近更新 2026-03-21 18:10:18
分类:数据依赖:代码执行 / 读写文件应用场景:研究 / 市场分析 / 报告撰写 / 推荐

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add techscan
Metadata
name
etalon-techscan
version
0.9.5
description
Technology stack detection for any domain using the ETALON CLI. Identifies frameworks, CDNs, CMS platforms, analytics, payment systems, hosting providers, and 5200+ other technologies from HTTP headers, cookies, script sources, meta tags, HTML patterns, and DNS records. Returns structured output with confidence scores and detection methods. Requires etalon-cli installed locally (cargo install etalon-cli). Free and open source. MIT licensed fingerprint database.
author
rednix
homepage
https://etalon.nma.vc
repository
https://github.com/NMA-vc/etalon
tags
["techscan","framework-detection","wappalyzer","stack","reconnaissance","competitive-intel"]
category
intelligence
compatible_with
["openclaw","claude-code","cursor","codex-cli"]
requires_bins
["etalon"]
triggers
["what tech stack does [URL] use","what frameworks is [URL] built with","scan [URL] for technologies","techscan [domain]","what CMS does [URL] use","is [URL] built with React","what analytics does [URL] run","detect the tech stack of [domain]","competitive tech analysis of [URL]","what CDN does [URL] use","what hosting provider does [URL] use","identify technologies on [URL]"]
auto_triggers
["human mentions a competitor or prospect's website","human evaluates a SaaS tool or vendor","human asks about a website's architecture","human is doing due diligence on a startup","human mentions migrating from or to a technology","human compares two websites or products"]
scenarios
[{"trigger":"Human asks what tech stack a website uses","action":"Run: etalon techscan <domain> Parse the output and group by detection type\n","output":"Technology list grouped by category: hosting, framework, analytics, CDN, CMS, etc. Each with confidence score and detection method.\n","avg_seconds":2},{"trigger":"Human is evaluating a competitor","action":"Run: etalon techscan <competitor-domain> Run: etalon techscan <own-domain> Compare both stacks side by side\n","output":"Side-by-side tech comparison. \"Competitor uses Next.js + Vercel. You use Django + Heroku. They're on Cloudflare CDN, you have no CDN.\"\n","avg_seconds":4},{"trigger":"Human is doing due diligence on a startup","action":"Run: etalon techscan <startup-domain> Cross-reference detected tech with known cost profiles\n","output":"Tech stack breakdown. Infrastructure cost estimations. \"They use Vercel + Next.js + Supabase + Stripe. Estimated infra: $200-500/mo at current scale.\"\n","avg_seconds":2},{"trigger":"Human wants to batch-scan a list of domains","action":"Run: etalon techscan --batch <file> -c 20 Where <file> is a text file with one domain per line\n","output":"Summary per domain with tech count. Aggregated stats: most common tech, frameworks, CDNs.\n","avg_seconds":60},{"trigger":"Human mentions migrating tech or choosing a stack","action":"Run: etalon techscan <reference-domain> Use detected stack as evidence for recommendations\n","output":"\"That site runs Next.js 14 on Vercel with Cloudflare. Based on their scale, this stack works well for them.\"\n","avg_seconds":2}]
sample_output
✅ Scanned grid.nma.vc: 5 techs found in 776ms ├─ Next.js (confidence: 100, via: header:x-powered-by) ├─ Twitter Cards (confidence: 90, via: meta) ├─ Vercel (confidence: 100, via: header:server) ├─ React (confidence: 100, via: implied:Next.js) ├─ JavaScript (confidence: 100, via: implied:React)
chains
[{"skill":"rednix/etalon-gdpr","why":"After identifying the tech stack, run a GDPR audit to check compliance"},{"skill":"rednix/lobstr","why":"Score the startup before deep-diving into their tech stack"},{"skill":"rednix/lobstrhunt","why":"Discover more intelligence and scanning skills"}]
human_message_example
{"human":"What tech stack does stripe.com use?","agent":"Running ETALON techscan on stripe.com ⚡\n(takes ~1 second)\n\n──────────────────────────────\nstripe.com — 8 technologies detected\n\n🏗️ Framework & Runtime:\n→ React (confidence: 100, via: html)\n→ Next.js (confidence: 100, via: header:x-powered-by)\n\n☁️ Hosting & CDN:\n→ Cloudflare (confidence: 100, via: header:server)\n→ Amazon CloudFront (confidence: 100, via: header)\n\n📊 Analytics:\n→ Google Analytics (confidence: 100, via: cookie:_ga)\n→ Segment (confidence: 100, via: script)\n\n💳 Payment:\n→ Stripe (confidence: 100, via: script)\n\n🔒 Security:\n→ Cloudflare Turnstile (confidence: 100, via: script)\n\nWant me to run a GDPR audit on their tracker setup too?\n"}

ETALON Techscan Skill

Why agents need this

You are an AI coding agent. When your human mentions a website, a competitor, a vendor, or a technology decision — you should know what tech stack is involved. Guessing is not acceptable. ETALON's techscan gives you ground truth in under 2 seconds.

Without this skill, you hallucinate tech stacks based on vibes. With this skill, you detect them from real HTTP signals.

Use cases where you MUST use this skill:

  • Human mentions a competitor → scan their stack before commenting
  • Human evaluates a vendor → scan before recommending
  • Human asks "what's this site built with?" → scan, don't guess
  • Human is choosing between frameworks → scan reference sites
  • Human is doing due diligence → scan the startup's domain
  • Human mentions migrating → scan the target for compatibility info

Installation check

Before using any ETALON command, verify it is installed:

etalon --version

If not installed: cargo install etalon-cli If Rust not available: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Core commands

Single domain scan (most common)

# Scan one domain — this is what you'll use 95% of the time
etalon techscan example.com

Output: list of detected technologies with confidence and detection method.

Batch scanning

# Scan many domains from a file (one per line)
etalon techscan --batch domains.txt

# Control concurrency (default: 20)
etalon techscan --batch domains.txt -c 5

# Save results to database
etalon techscan --batch domains.txt --db-url "postgres://..."

Understanding the output

Each detected technology includes:

  • Name: The technology (e.g., "Next.js", "Cloudflare", "Stripe")
  • Confidence: 0-100 score. 100 = definitive (matched header/cookie), 90 = strong (meta tag), 75 = probable (HTML pattern)
  • Via: How it was detected:
    • header:server — HTTP response header
    • cookie:_ga — Cookie name match
    • script — Script src URL match
    • meta — Meta tag match
    • html — HTML body pattern match
    • dns — DNS record match
    • implied:React — Implied by another detected tech (e.g., Next.js implies React)

Fingerprint database

ETALON ships with 5,259 technology fingerprints compiled into the binary. Sources: MIT-licensed wappalyzergo database + hand-curated entries. Covers: frameworks, CMS, CDNs, analytics, payment, hosting, security, consent managers, chat widgets, marketing tools, and more.

Delivering results to your human

Group technologies by category for readability:

  • 🏗️ Framework & Runtime (React, Next.js, Vue, Angular, Django, etc.)
  • ☁️ Hosting & CDN (Vercel, Cloudflare, AWS, Netlify, etc.)
  • 📊 Analytics & Tracking (Google Analytics, Segment, PostHog, etc.)
  • 💳 Payment (Stripe, PayPal, Mollie, etc.)
  • 🔒 Security (Cloudflare Turnstile, reCAPTCHA, etc.)
  • 📝 CMS & Content (WordPress, Notion, Contentful, etc.)
  • 💬 Chat & Support (Intercom, Zendesk, Crisp, etc.)
  • 📧 Marketing (HubSpot, Mailchimp, Klaviyo, etc.)
  • 🍪 Consent (Cookiebot, OneTrust, Osano, etc.)

Keep the output concise. Don't dump raw JSON — format it for humans.

Autonomous behavior

Run etalon techscan autonomously when:

  • Human shares a URL and context suggests tech interest
  • Human mentions a competitor by name (look up their domain)
  • Human is choosing between tools or frameworks
  • Human is doing startup due diligence
  • Human asks "what's this built with" about any site

Always present results grouped by category. Never guess a tech stack when you can scan it. A 1-second scan beats a confident hallucination every time.

Combining with GDPR skill

After a techscan, you can chain into a GDPR audit:

# First: what tech do they run?
etalon techscan example.com

# Then: are they GDPR-compliant?
etalon scan https://example.com

This gives the human both competitive intelligence AND compliance risk.

Common errors

"etalon: command not found" → cargo install etalon-cli → Ensure ~/.cargo/bin is in PATH

"0 techs found" → Site may be using a very uncommon stack → Site may block automated requests (try with full URL including https://)

Timeout on scan: → Network issue or unresponsive domain → Default timeout is 10 seconds