auditing-tls-certificate-transparency-logs

Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue certificates, track CA behavior, and map the external attack surface. Activates for requests involving certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/auditing-tls-certificate-transparency-logs/SKILL.md

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured as a conceptual walkthrough but reads like reference documentation inlined into SKILL.md: verbose, descriptive rather than executable, and duplicative of the bundled api-reference.md and agent.py it fails to reference. Workflow steps lack validation checkpoints and the heavy glossary/tools sections pad the token budget with knowledge Claude already has.

Suggestions

Replace explanatory prose (the Key Concepts glossary, Tools & Systems descriptions, and RFC/CT background) with terse pointers, or move them into references/api-reference.md and link from the body.

Add executable examples that call scripts/agent.py with the actual flags, and reference references/api-reference.md for the full CLI/endpoint catalog instead of restating API details inline.

Insert explicit validation checkpoints into the workflow (e.g. verify CAA records after setting them, confirm baseline DB schema before alerting, re-resolve DNS before flagging takeover) so batch/destructive operations have feedback loops.

Dimension	Reasoning	Score
Conciseness	Noticeably verbose — the body extensively explains concepts Claude already knows (e.g. what CT is, how Merkle Trees work, what a precertificate poison OID is, what CAA records are) and pads each workflow bullet with background exposition rather than terse actionable instruction.	2 / 5
Actionability	Provides concrete API endpoints and parameters (crt.sh URL, get-sth, get-sth-consistency, CAA record syntax) but offers almost no executable code; guidance is descriptive prose rather than copy-paste-ready commands, and the bundled agent.py / api-reference.md are never invoked from the body.	3 / 5
Workflow Clarity	A clear five-step sequence with sub-bullets exists, but it is a descriptive procedure with no explicit validation checkpoints or feedback loops for the destructive/batch operations (revocation requests, bulk typosquat querying, baseline mutation) the skill describes.	3 / 5
Progressive Disclosure	The SKILL.md is a monolithic ~200-line body that inlines an API-style reference, a full glossary, tools list, and detailed scenarios, while the existing references/api-reference.md and scripts/agent.py bundle files are never linked or signaled from the body.	2 / 5
	Total	10 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states capabilities and includes an explicit 'Activates for ...' trigger clause covering both what and when. Slightly jargon-heavy on trigger phrasing, keeping it just short of fully natural keyword coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'detect unauthorized certificate issuance', 'discover subdomains via CT data', 'alert on suspicious certificate activity', 'track CA behavior', and 'map the external attack surface' — providing comprehensive coverage of capabilities.	5 / 5
Completeness	Explicitly answers both 'what' (monitors CT logs, detects issuance, discovers subdomains, alerts) and 'when' via the concrete 'Activates for requests involving ...' trigger clause enumerating specific use cases.	5 / 5
Trigger Term Quality	Includes natural phrases users would say ('certificate transparency monitoring', 'subdomain discovery via certificates', 'certificate issuance alerting') but leans on domain jargon and omits common synonyms/extensions a user might naturally invoke.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear narrow niche (CT log auditing via crt.sh / RFC 6962) with distinct triggers unlikely to fire for unrelated skills; minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/auditing-tls-certificate-transparency-logs/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.