analyzing-tls-certificate-transparency-logs
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
54
61%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/analyzing-tls-certificate-transparency-logs/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong skill description that clearly articulates specific capabilities (CT log querying, phishing detection, typosquatting monitoring), names concrete tools (crt.sh, pycrtsh, Levenshtein distance), and provides explicit usage triggers. It occupies a very distinct niche in certificate transparency and phishing domain detection, making it easy to distinguish from other skills. The 'Use for' clause could be slightly more expansive with additional trigger phrases, but overall this is well-crafted.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: querying Certificate Transparency logs via crt.sh and pycrtsh, detecting phishing domains, detecting unauthorized certificate issuance, detecting shadow IT, monitoring for typosquatting and brand impersonation using Levenshtein distance. | 3 / 3 |
Completeness | Clearly answers both 'what' (queries CT logs, detects phishing domains, monitors certificates for typosquatting) and 'when' ('Use for proactive phishing domain detection and certificate monitoring'). The 'Use for...' clause serves as an explicit trigger guidance. | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'Certificate Transparency', 'crt.sh', 'pycrtsh', 'phishing domains', 'typosquatting', 'brand impersonation', 'certificate monitoring', 'shadow IT', 'Levenshtein distance'. These are terms a security professional would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche focusing specifically on Certificate Transparency logs, crt.sh, and phishing domain detection via certificate monitoring. Very unlikely to conflict with other skills given the specialized domain and specific tools mentioned. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
22%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill provides a basic starting point for querying crt.sh but fails to deliver on its core promises of typosquatting detection via Levenshtein distance, CA validation, and phishing infrastructure cross-referencing. The boilerplate sections waste tokens on generic content Claude already knows, while the actually novel and valuable parts (the detection logic) are left as vague bullet points without implementation.
Suggestions
Remove the generic 'When to Use' and 'Prerequisites' sections and replace with a one-line scope statement; Claude doesn't need to be told about 'familiarity with security operations concepts'.
Add executable code for the Levenshtein distance typosquatting detection, which is the skill's primary differentiator — e.g., using `python-Levenshtein` to compare discovered domains against the target brand.
Implement concrete validation steps: what constitutes a suspicious certificate, threshold values for Levenshtein distance, how to flag unexpected CAs with specific code, and what action to take on findings.
Add error handling for crt.sh API failures (rate limiting, timeouts) and a feedback loop for iterating on results.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The 'When to Use' and 'Prerequisites' sections are padded with generic boilerplate that Claude already knows (e.g., 'Familiarity with security operations concepts', 'Access to a test or lab environment'). The description of what Certificate Transparency is and how crt.sh works could be omitted entirely since Claude knows these concepts. | 1 / 3 |
Actionability | The code examples are real and executable using pycrtsh, but critical pieces are missing: there's no concrete implementation of Levenshtein distance comparison for typosquatting detection (a key claimed feature), no code for flagging unexpected CAs, and the 'Key analysis steps' are described abstractly rather than with executable code. | 2 / 3 |
Workflow Clarity | The 5 'key analysis steps' are listed but lack sequencing detail, validation checkpoints, and error handling. Steps 2-5 are vague descriptions with no concrete implementation. There's no feedback loop for verifying results or handling API failures, and no guidance on what to do when suspicious certificates are found. | 1 / 3 |
Progressive Disclosure | The content is organized into reasonable sections (When to Use, Prerequisites, Instructions, Examples), but there are no references to external files for advanced topics like Levenshtein distance implementation or CA validation rules. The content is relatively short so a monolithic structure is acceptable, but the inline boilerplate sections hurt organization. | 2 / 3 |
Total | 6 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
0445030
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.