analyzing-certificate-transparency-for-phishing

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-certificate-transparency-for-phishing/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable skill with complete executable code and a clear four-step workflow, weakened by re-explained background concepts, missing inline validation checkpoints for batch monitoring, and underuse of the provided bundle files.

Suggestions

Trim or remove the Overview/Key Concepts exposition of what CT logs and crt.sh are; assume Claude's competence and keep only what is non-obvious.

Add inline validation checkpoints (e.g. verify crt.sh returned data, confirm Certstream connection, retry on timeouts) within the workflow steps.

Reference the bundle files explicitly — point to scripts/agent.py for the full agent and references/api-reference.md for field/API details — instead of inlining the full implementations.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with full code blocks, but the Overview and "Key Concepts" sections re-explain CT logs, crt.sh, and phishing-via-CT — concepts Claude already knows — adding padding that could be trimmed.	3 / 5
Actionability	Four complete, copy-paste-ready Python examples (crt.sh query, Certstream monitoring, subdomain enumeration, report generation) cover the common cases with executable code.	5 / 5
Workflow Clarity	The four-step workflow is clearly sequenced and a Validation Criteria section lists expected outcomes, but batch/monitoring operations lack inline validation checkpoints or error-recovery feedback loops, capping this at 3.	3 / 5
Progressive Disclosure	Section structure is reasonable, but the body inlines four large code blocks while bundle files (scripts/agent.py, references/api-reference.md) that duplicate/extend this content are never referenced, leaving content that belongs in separate files inline.	3 / 5
	Total	14 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinct description that clearly states what the skill does across several concrete actions, but it lacks any explicit "Use when..." trigger guidance, which caps completeness.

Suggestions

Add an explicit trigger clause, e.g. "Use when monitoring for phishing infrastructure, lookalike/typosquatting domains, or unauthorized certificate issuance against your brand."

Include more natural synonyms users would say (SSL certificates, typosquatting, homoglyph/lookalike domains, brand impersonation).

Dimension	Reasoning	Score
Specificity	Names the domain plus multiple concrete actions — "Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance" — giving comprehensive coverage.	5 / 5
Completeness	The "what" is clear and concrete, but there is no "Use when..." clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Good keyword coverage with natural terms ("phishing domains", "lookalike certificates", "unauthorized certificate issuance", crt.sh, Certstream), but misses common synonyms a user might say such as SSL, typosquatting, homoglyph, or brand impersonation.	4 / 5
Distinctiveness Conflict Risk	A clear niche (CT log monitoring for phishing via crt.sh and Certstream) with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-certificate-transparency-for-phishing/SKILL.md
Commit: 54a7988

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.