analyzing-tls-certificate-transparency-logs
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
74
68%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/analyzing-tls-certificate-transparency-logs/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong, well-crafted description that clearly identifies a specialized security skill. It lists concrete actions, names specific tools (crt.sh, pycrtsh, Levenshtein distance), and includes a 'Use for' clause with relevant trigger terms. The description is concise, uses third person voice, and occupies a clear niche that would be easily distinguishable from other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: querying Certificate Transparency logs via crt.sh and pycrtsh, detecting phishing domains, detecting unauthorized certificate issuance, detecting shadow IT, monitoring for typosquatting and brand impersonation using Levenshtein distance. | 3 / 3 |
Completeness | Clearly answers both what (queries CT logs, detects phishing domains, monitors certificates for typosquatting using Levenshtein distance) and when ('Use for proactive phishing domain detection and certificate monitoring'), providing explicit trigger guidance. | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'Certificate Transparency', 'crt.sh', 'phishing domains', 'typosquatting', 'brand impersonation', 'certificate monitoring', 'shadow IT', 'unauthorized certificate issuance'. These cover the domain well with terms security professionals would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche: Certificate Transparency log querying via crt.sh/pycrtsh with specific techniques like Levenshtein distance for typosquatting detection. Very unlikely to conflict with other skills given the specialized domain. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
37%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill provides a basic starting point for querying crt.sh but fails to deliver on its core promise of phishing domain detection via typosquatting analysis and certificate monitoring. The most valuable analysis steps (Levenshtein distance, CA flagging, cross-referencing) are described abstractly without executable code. Boilerplate sections waste tokens on information Claude already knows.
Suggestions
Add executable code for Levenshtein distance-based typosquatting detection (e.g., using python-Levenshtein or difflib) with a concrete example comparing discovered domains against a brand name.
Provide concrete code for flagging unexpected Certificate Authorities, such as comparing cert['issuer_name'] against an allowlist.
Remove the generic 'When to Use' and 'Prerequisites' boilerplate sections—Claude already understands when to apply security analysis skills and what Python prerequisites mean.
Add validation/error handling for crt.sh API queries (rate limiting, empty results, connection failures) to improve workflow robustness.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The 'When to Use' and 'Prerequisites' sections are largely boilerplate that Claude already knows (e.g., 'Familiarity with security operations concepts'). The core instructions are reasonably lean, but the surrounding padding wastes tokens. | 2 / 3 |
Actionability | Provides executable code for querying crt.sh, but the critical analysis steps (Levenshtein distance calculation, flagging unexpected CAs, cross-referencing phishing infrastructure) are described abstractly without concrete code or commands. The typosquatting detection—a key feature per the description—has no implementation. | 2 / 3 |
Workflow Clarity | The 5 'key analysis steps' are listed but lack sequencing detail, validation checkpoints, or error handling. Steps 2-5 are vague directives with no concrete guidance on how to execute them, and there's no feedback loop for verifying results or handling API failures. | 1 / 3 |
Progressive Disclosure | The content is organized into sections (When to Use, Prerequisites, Instructions, Examples), which provides some structure. However, the boilerplate sections add noise, and there are no references to deeper materials for the advanced analysis techniques mentioned (Levenshtein distance, CA validation, phishing infrastructure cross-referencing). | 2 / 3 |
Total | 7 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.