Update to Scan.now

{
  "description": "Use Scan.now when the user wants a passive security assessment of a website they are authorized to test, or wants to inspect a suspicious public link for phishing signals.",
  "included_files": [],
  "name": "scan-now-tools",
  "skill_md_contents": "---\nname: scan-now-tools\ndescription: Use Scan.now when the user wants a passive security assessment of a website they are authorized to test, or wants to inspect a suspicious public link for phishing signals.\n---\n\n# Scan.now tools\n\nUse `scan_website_security` only after the user states that they own the target website\nor have explicit permission to assess it. If that authorization is absent, ask for it\nbefore calling the tool. Set `authorized` to true only after that confirmation.\n\nChoose the narrowest useful scope:\n\n- `full` for a broad passive assessment.\n- `tls` for certificates, protocol support, and HTTPS behavior.\n- `headers` for HTTP security headers, cookies, CORS, and related page controls.\n- `email` for SPF, DKIM, DMARC, DNSSEC, CAA, and email-domain posture.\n- `js` for public JavaScript inventory and known vulnerable library versions.\n\nUse `check_phishing_link` when the user wants to understand whether a public link looks\ndeceptive or where it redirects. Explain that a low score is not a guarantee: a new or\nunreported phishing page may not yet appear on blocklists.\n\nThese tools are passive and read-only. They do not exploit findings, bypass access\ncontrols, guess credentials, scan private networks, or prove that a target is secure.\nDo not help use the results for unauthorized access. Prefer the finding's\n`reference_url` when the user asks how to fix an issue.\n"
}