Guide · Agent skill
How to use the TLS Certificate Transparency Log agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the analyzing-tls-certificate-transparency-logs agent skill, which teaches an AI agent to search public Certificate Transparency logs through the crt.sh service. It is written for security analysts and engineers who may be new to agent skills. By the end you will know how to install the skill, ask for useful searches in plain language, and what safety limits to keep in mind.
TLS Certificate Transparency Log Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder.
- 2Or upload it in the Claude apps. Go to Settings, then Capabilities, then Skills, and upload the ZIP.
- 3Install the Python prerequisites. Make sure Python 3.8 or later is available, with the pycrtsh and requests libraries installed.
- 4Confirm authorization and scope. Decide which domains you own or are authorized to investigate before running any search.
- 5Make a natural request. Describe the domain and what you want to find, such as lookalike domains or unexpected certificates.
- 6Review the results. Check each flagged domain yourself, since the skill can miss or misclassify domains.
What does the skill make the agent do?
Certificate Transparency (CT) is a public record of TLS certificates that certificate authorities issue. The skill tells the agent how to query that record through crt.sh for certificates issued to domains that match your organization or brand.
The skill focuses on three kinds of findings: lookalike domains that attackers may register for phishing, certificates issued unexpectedly for your organization, and unknown subdomains. It also describes measuring how close a domain name is to your brand using Levenshtein distance, a standard string-similarity measure.
- Search crt.sh for certificates matching a domain or subdomain pattern
- Flag typosquatting variations of your brand name
- Flag certificates from unexpected certificate authorities
- Watch for wildcard certificates on suspicious subdomains
What do you need before installing?
The skill has real requirements. It runs a bundled Python script and makes network requests, so check these before you start.
The skill's own prerequisites say to have Python 3.8 or later with the required dependencies installed, and to have authorization for any investigation. The source names the pycrtsh and requests Python libraries and needs internet access to crt.sh.
- Python 3.8 or later
- The pycrtsh Python library
- The requests Python library
- Internet access to crt.sh
- Authorization to investigate the target domains
How do you install the skill?
Download the skill ZIP from this page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
How do you trigger the skill with a natural request?
You do not need a special command. Describe the task in plain language and mention the domain you own. The agent should pick up the skill when your request matches its purpose of certificate transparency and phishing domain detection.
Name the domain, say what you want to find, and state that you are authorized to look at it. The more specific the request, the easier it is to review the results.
- Check crt.sh for certificates issued to example.com and its subdomains, and list any that look like typosquats of our brand.
- Look for certificates issued for our organization by a certificate authority we do not normally use.
- Search certificate transparency logs for unknown subdomains of example.com and summarize the issuers.
- Use Levenshtein distance to rank domains similar to example.com that appear in CT logs.
What does the code look like?
The skill's instructions show the pycrtsh library searching by domain and fetching full details for a certificate. The first call returns matches; the second retrieves one record by its ID. The wildcard pattern %.example.com searches subdomains.
The skill also documents a direct crt.sh JSON query and notes the fields returned, including issuer_name, name_value and not_before. Use these as a reference for what the agent will see, not as a finished tool.
from pycrtsh import Crtsh
c = Crtsh()
certs = c.search("%.example.com")
for cert in certs:
print(f"Issuer: {cert.get('issuer_name')}, Domain: {cert.get('name_value')}")What safety limits should you keep in mind?
The skill runs scripts and uses the network. The bundled script, scripts/agent.py, is described in the source as a partial example. The skill's SKILL.md says its prerequisites should be validated in a lab first, so test it on a non-production setup before relying on it.
Only query domains you own or are authorized to investigate. Results can expose third-party infrastructure, and the skill's documentation requires authorization.
The skill depends on a third-party service and on the agent's judgment, so it can miss or misclassify domains. Review every finding before acting on it.
- Test in a lab before production use
- Query only domains you own or have authorization to investigate
- Treat results as leads to verify, not confirmed phishing
What tips help you get better results?
Start with exact domains you own, then widen to wildcard subdomain searches. Ask the agent to explain how it scored each lookalike so you can check its reasoning.
The skill's files are SKILL.md, scripts/agent.py and references/api-reference.md. The API reference is useful if you want to know which pycrtsh calls and crt.sh fields exist.
- Begin with your primary domain before asking for broad searches
- Ask for the Levenshtein distance behind each flagged domain
- Read references/api-reference.md to understand available fields
- Keep a record of what you searched and what you concluded
What people use it for
- Spotting lookalike domains registered to impersonate your brand before they are used in phishing
- Finding certificates issued for your organization by a certificate authority you do not expect
- Discovering unknown subdomains that may represent shadow IT
- Ranking domains by Levenshtein distance to your brand name for triage
Frequently asked questions
How do I install the analyzing-tls-certificate-transparency-logs skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
What do I need to run this skill?
You need Python 3.8 or later, the pycrtsh and requests Python libraries, internet access to crt.sh, and authorization to investigate the target domains. The skill runs a bundled script and uses the network.
Is this skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. The source does not describe pricing, so check the license text for the terms that apply to you.
Does this skill detect all phishing domains?
No. The skill depends on a third-party service and on the agent's judgment, so it can miss or misclassify domains. Use its results as leads to verify, not as complete detection.
Can I use this skill on domains I do not own?
You should not. The skill's documentation requires authorization, and results can expose third-party infrastructure. Only query domains you own or are authorized to investigate.
How does this compare with querying crt.sh directly?
The skill uses crt.sh through the pycrtsh library, and the source also documents a direct crt.sh JSON query. The skill adds agent-driven analysis such as Levenshtein scoring, but its output still needs human review.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security analysts and engineers who already understand certificate transparency and want an agent to run structured searches for lookalike domains and unexpected certificates. It is a poor fit if you need guaranteed phishing detection or unreviewed production monitoring, since the bundled script is a partial example that should be tested in a lab first.
Download the skill