analyzing-tls-certificate-transparency-logs

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-tls-certificate-transparency-logs/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, mostly actionable skill body with a clear numbered procedure, but it omits validation checkpoints for the batch analysis and fails to link the bundled API reference from the main body.

Suggestions

Add a verification/validation step to the workflow (e.g., confirm matched domains against a known-good allowlist before flagging) to satisfy the batch-operation feedback-loop requirement.

Provide an executable snippet for the Levenshtein typosquatting comparison rather than describing it only in prose.

Link to references/api-reference.md from the body (e.g., under an 'Advanced features' or 'API reference' section) so the bundled detail is clearly signaled.

Dimension	Reasoning	Score
Conciseness	The body is lean with short executable code and a compact step list, assuming Claude's competence; the second code block partially overlaps the first, a minor instance of content that could be trimmed.	4 / 5
Actionability	Provides executable pycrtsh code and a concrete numbered procedure, but the typosquatting/Levenshtein and cross-referencing steps are described rather than implemented, leaving minor gaps in copy-paste-ready guidance.	4 / 5
Workflow Clarity	Five analysis steps are sequenced, but this batch operation (flagging and cross-referencing certificates) lacks any validation or verification checkpoint, capping workflow clarity per the destructive/batch feedback-loop rule.	3 / 5
Progressive Disclosure	A bundle file (references/api-reference.md) with richer pycrtsh/crt.sh/certstream detail exists, but the body never signals or links to it, leaving the reference present but not clearly navigated.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that concretely states multiple capabilities and provides an explicit 'Use for' trigger clause. It is comprehensive and distinct, with only minor room for more natural-synonym keyword coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — querying CT logs via crt.sh/pycrtsh, detecting phishing domains/unauthorized issuance/shadow IT, monitoring new certs, and typosquatting detection via Levenshtein distance — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly answers both 'what' (queries CT logs to detect phishing/typosquatting/shadow IT) and 'when' via the concrete 'Use for proactive phishing domain detection and certificate monitoring' trigger clause.	5 / 5
Trigger Term Quality	Includes natural security terms a SOC user would say ('phishing domains', 'typosquatting', 'brand impersonation', 'certificate monitoring', 'shadow IT') with good coverage, though it leans on domain jargon and misses some common synonyms or variations.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (Certificate Transparency log analysis for phishing/typosquatting detection) with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-tls-certificate-transparency-logs/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.