Guide · Agent skill
How to use the TLS Certificate Transparency Auditor agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The TLS Certificate Transparency Auditor is an agent skill that teaches an AI agent how to watch public Certificate Transparency (CT) logs, the public records of TLS certificates issued for a domain. It is aimed at security teams, operators mapping their external attack surface, and developers building a certificate monitoring job. After this guide you will know what the skill does, how to install it, how to ask an agent to use it, and what it needs to run.
TLS Certificate Transparency Auditormukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it so the skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md.
- 2Place the skill folder. Move the unzipped folder into ~/.claude/skills/ for personal use or into a project's .claude/skills/ directory. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Install the Python libraries. Make sure Python 3.10+ is available and install requests, cryptography and pyOpenSSL.
- 4Ask for a baseline. Describe your owned domain and ask the agent to build a baseline of known certificates.
- 5Run a scan. Ask for a one-shot scan. The skill's CLI example uses --domains, --db and --report options.
- 6Review and validate findings. Check flagged certificates and confirm any discovered subdomains through DNS before acting.
- 7Set up alerts if needed. Add SMTP credentials or a webhook URL if you want email or Slack alerts for new issuances.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file and optional scripts and reference files. When it is installed, an AI agent can load these instructions when a request matches the skill's description, and follow the workflow they describe.
This skill is about certificate transparency. Once installed, the agent can build a baseline of known certificates for your domains, check periodically for new ones, and flag issuances from unexpected certificate authorities, unfamiliar subdomains, or look-alike domains that may be used for phishing. It uses the crt.sh API and direct CT log querying based on RFC 6962.
- Build a baseline inventory of certificates for owned domains, stored in a local SQLite database
- Poll crt.sh for new certificates and compare them against the baseline
- Flag issuances from certificate authorities not on your authorized list
- Discover subdomains from certificate SAN data and validate them through DNS
- Generate typosquat permutations of your domains and check CT data for matching certificates
- Send alerts by email (SMTP), Slack webhook, PagerDuty, or write SIEM-compatible JSON logs
What you need before installing
The skill runs scripts and uses the network, so check these requirements first.
- Python 3.10 or newer
- The requests, cryptography and pyOpenSSL Python libraries
- Network access to crt.sh and public CT log servers
- A list of domains you own or are authorised to monitor
- SMTP credentials or a webhook URL, only if you want alerts
How to install the skill
Download the ZIP from this page and unzip it. You can install it in one of two ways.
Option A: personal install. Unzip the folder into ~/.claude/skills/ so the skill is available across your projects.
Option B: project install. Unzip the folder into the .claude/skills/ directory of a specific project so only that project uses it.
Option C: Claude apps. Upload the skill in the Claude apps under Settings → Capabilities → Skills.
How to trigger the skill with natural requests
You do not need a special command. Describe the task in plain language that matches the skill's purpose, such as asking about certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.
Name your domain and say what you want back, for example a baseline, a one-off scan, or a report. The skill's own CLI examples show the shape of a run: a one-shot scan with a database file and a JSON report, or continuous monitoring.
- Set up certificate transparency monitoring for example.com and tell me about any certificate issued by a CA we have not used before
- Run a one-shot CT log scan of example.com and write the results to a JSON report
- Find subdomains of example.com that appear in certificates, then check which ones resolve in DNS
- Check our brand and common typosquat variants of example.com for recently issued certificates
- Build a baseline of known certificates for example.com and alert me when new ones appear
python agent.py --domains example.com --db ct_monitor.db --report report.jsonSafety notes: scripts and network access
This skill runs scripts and makes network requests to crt.sh and CT log servers. Review the scripts/agent.py file before running it, and only monitor domains you own or are authorised to assess.
The skill itself forbids attacking or disrupting certificate authorities or third-party domains. It also warns against heavy scraping of crt.sh beyond its rate limits or terms of service, which may get your access blocked. If you use alerting, the skill needs SMTP credentials or a webhook URL, so store those securely.
Tips for getting reliable results
Do not treat CT data as your only subdomain list. The skill says CT results must be confirmed through DNS, so run the DNS validation step before acting on a finding.
Space out your queries and cache responses. The skill recommends spacing crt.sh queries, caching results, and backing off on HTTP 429 responses.
Keep the authorised CA list up to date, because issuance from a CA outside that list triggers the highest-priority alert. Use the exclude=expired behaviour for current monitoring and a separate historical query for subdomains from expired certificates.
What people use it for
- Security teams checking their own company domains for certificates from unknown certificate authorities
- Operators finding forgotten or unexpected subdomains through certificates in public CT logs
- Spotting look-alike domains that have received certificates and may be used for phishing
- Developers building a scheduled certificate monitoring job that writes to SQLite and sends alerts
- Tracking certificates approaching expiration for critical services
Frequently asked questions
How do I install the TLS Certificate Transparency Auditor agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
What do I need to run it?
You need Python 3.10 or newer, the requests, cryptography and pyOpenSSL libraries, and network access to crt.sh and public CT log servers. SMTP credentials or a webhook URL are only needed for alerting.
Is this skill free to use?
The skill is published under the Apache-2.0 licence. Check the licence file in the repository for the full terms.
Does it work without the crt.sh API?
The skill's documented approach is built around the crt.sh API, with direct CT log querying described as an advanced option. It also mentions a crt.sh Atom feed and PostgreSQL interface for some monitoring setups.
Can I use it to check domains I don't own?
The skill is meant for domains you own or are authorised to monitor. It forbids attacking or disrupting certificate authorities or third-party domains.
Why does the skill say not to rely only on CT data for subdomains?
The skill states that CT data alone is not sufficient for subdomain enumeration, so results should be confirmed through DNS resolution before you act on them.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security teams, attack-surface operators and developers who want a documented workflow for monitoring certificates for their own domains. It is less suitable if you need a managed service with a hosted dashboard, or if you plan to run heavy automated queries against crt.sh outside its rate limits and terms.
Download the skill