TLS Certificate Transparency Auditor
Monitors public certificate logs to spot rogue certificates and map a domain's subdomains.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent how to watch public Certificate Transparency logs, the public records of every TLS certificate issued for a domain. Once installed, the agent can build a baseline of known certificates for your domains, check periodically for new ones, and flag issuances from unexpected certificate authorities, unfamiliar subdomains, or look-alike domains that may be used for phishing. It also includes a Python script that stores results in a local SQLite database and can send email alerts.
Great for
- Security teams monitoring their own company domains for unauthorized certificates
- Operators mapping their external attack surface and finding forgotten subdomains
- Developers building a continuous certificate monitoring job with alerting
Skip it if
- Attacking or disrupting certificate authorities or third-party domains, which the skill itself forbids
- Heavy scraping of crt.sh beyond its rate limits or terms of service, which may get the user blocked
- Using CT data as the only subdomain list without confirming results through DNS, since the skill says this is insufficient
Try asking
- “Watch my company's domains and alert me if a certificate is issued by a CA we have never used before”
- “Find subdomains of example.com that appear in certificate transparency logs and check which ones resolve in DNS”
- “Detect certificates issued for typosquat variations of my brand name”
- “Set up a script that polls crt.sh every 30 minutes and emails new certificate findings”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
auditing-tls-certificate-transparency-logs.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip auditing-tls-certificate-transparency-logs.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip auditing-tls-certificate-transparency-logs.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Give the agent an explicit list of owned domains and known authorized CAs so the baseline and alerts are meaningful.
- Review scripts/agent.py before running it, especially the SMTP and network sections, and keep SMTP credentials in environment variables rather than in code.
- Confirm any discovered subdomain or typosquat with DNS checks before treating it as a real threat.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.