Guide · Agent skill
How to use the Certificate Transparency Phishing Monitor agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the analyzing-certificate-transparency-for-phishing agent skill, which lets an AI agent search public Certificate Transparency (CT) logs for certificates issued to domains that imitate your organization or brand. It is written for security analysts, brand-protection staff and developers who may not have used agent skills before. By the end you will know what the skill does, how to add it to your agent, how to ask for it in plain language, and what you need before it will run.
Certificate Transparency Phishing Monitormukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder.
- 2Or upload in the Claude apps. In the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- 3Install Python libraries. Install requests, certstream, tldextract and Levenshtein in Python 3.9 or newer.
- 4Prepare your domain list. List the organisation domains and brand keywords you want monitored.
- 5Ask the agent in plain language. Describe the task, such as checking crt.sh for lookalike certificates on your brand.
- 6Review the candidates. Check each flagged certificate manually before deciding on any action.
What does the skill make the agent do?
Certificate Transparency logs are public records of SSL/TLS certificates issued by major certificate authorities. Attackers often obtain a certificate for a lookalike domain before a phishing campaign starts, so these logs can show early signals.
Once installed, the skill has the agent query crt.sh for certificates matching your domains, and monitor the Certstream live feed for new certificates. It flags suspicious patterns: target names appearing inside other domains, brand keywords, and certificates from Let's Encrypt. It can also write findings up for a threat intelligence workflow.
- Historical searches of crt.sh, including wildcard queries
- Real-time watching of the Certstream feed with name-similarity checks (Levenshtein distance)
- Flags for target-name strings, brand keywords and free Let's Encrypt certificates
- Structured findings with crt.sh links for review
Install the skill from the ZIP download
Download the skill ZIP from this page and unzip it. The package contains SKILL.md, scripts/agent.py and references/api-reference.md.
For a personal install, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills → upload
Install the Python requirements
The skill needs Python 3.9 or newer and four libraries: requests, certstream, tldextract and Levenshtein. Install them in the Python environment your agent uses. The skill also needs network access to crt.sh and certstream.calidog.io, and a list of your organisation's domains and brand keywords.
- Python 3.9+
- requests, certstream, tldextract, Levenshtein
- Network access to crt.sh and certstream.calidog.io
pip install requests certstream tldextract LevenshteinHow do you trigger the skill with a natural request?
You do not need to name the skill exactly. Describe the task and mention certificates, CT logs or lookalike domains. Give the agent your domains and brand keywords in the same message, or make sure they are available to it.
- Check crt.sh for certificates issued for *.mycompany.com and flag anything that looks like a brand impersonation.
- Watch the Certstream feed for lookalike certificates containing the keyword mybrand and summarise the alerts.
- Search CT logs for Let's Encrypt certificates on domains containing mycompany and write a findings report with crt.sh links.
What should you check before trusting results?
The skill detects and reports candidates. It does not block or take down sites. Name similarity is a heuristic, so false positives are likely; a flagged domain needs human review before any action. Certificates from public services can also be legitimate, owned by your own organisation.
The skill runs scripts and uses the network. Read scripts/agent.py before running it, and run it in an environment where outbound requests to crt.sh and certstream.calidog.io are acceptable. Both are third-party public services that may throttle requests or change, so plan query volume.
- Review every flagged domain manually
- Do not treat flags as confirmed phishing
- Plan rate limits for long-running Certstream monitoring
- Inspect the scripts before running them
What people use it for
- Early warning for lookalike phishing domains that obtain free certificates before a campaign
- Brand-protection checks for certificates issued to unauthorized domains that contain your brand name
- Threat intelligence write-ups summarising suspicious certificates with crt.sh links
- A starting point for a lightweight CT log monitoring script
Frequently asked questions
How do I install the mukul975 analyzing-certificate-transparency-for-phishing skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings, then Capabilities, then Skills.
What do I need to run this skill?
Python 3.9 or newer, the requests, certstream, tldextract and Levenshtein libraries, network access to crt.sh and certstream.calidog.io, and a list of your organisation's domains and brand keywords.
Is this skill free to use?
The skill is released under the Apache-2.0 licence. The crt.sh and Certstream services it queries are public third-party services, and this page does not state any pricing for them.
Does the skill block phishing sites?
No. It only detects and reports candidate domains. Name similarity is a heuristic, so false positives are likely and each flag needs human review.
What are the alternatives to this skill?
The source does not compare this skill with other tools. You can query crt.sh directly in a browser or with its JSON output, or write your own Certstream client, which the skill's reference file shows in basic form.
Why does the monitor fail or return nothing?
The skill depends on public services, crt.sh and Certstream, which may throttle requests or change. Check your network access to both hosts, confirm the four Python libraries are installed, and reduce query volume.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security analyst, SOC team member, or brand-protection staff who wants early warning of lookalike domains and can review results yourself. Pick something else if you need automatic takedowns or a non-technical tool, since the skill only reports candidates and requires Python and security knowledge.
Download the skill