Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 26zl/cybersec-toolkit --skill auditing-tls-certificate-transparency-logsgit clone --depth 1 https://github.com/26zl/cybersec-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/26zl/cybersec-toolkit/auditing-tls-certificate-transparency-logs)<a href="https://agentmods.dev/skills/26zl/cybersec-toolkit/auditing-tls-certificate-transparency-logs"><img src="https://agentmods.dev/badge/skills/26zl/cybersec-toolkit/auditing-tls-certificate-transparency-logs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/26zl/cybersec-toolkit/auditing-tls-certificate-transparency-logs"><img src="https://agentmods.dev/badge/skills/26zl/cybersec-toolkit/auditing-tls-certificate-transparency-logs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.03373 |
| Opus 5 | $0.00052 | $0.01687 |
| Sonnet 5 | $0.00021 | $0.00675 |
| Haiku 4.5 | $0.00010 | $0.00337 |
Grade A, and why
auditing-tls-certificate-transparency-logs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- auditing-tls-certificate-transparency-logs — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auditing TLS Certificate Transparency Logs
When to Use
- Monitoring owned domains for unauthorized or unexpected certificate issuance by unknown Certificate Authorities
- Discovering subdomains and hidden services through certificates logged in public CT logs
- Detecting phishing infrastructure that uses look-alike domain certificates (typosquatting, homograph attacks)
- Auditing Certificate Authority compliance by verifying all issued certificates appear in CT logs as required by browser policies
- Building continuous certificate monitoring into a security operations pipeline with alerting for new issuances
Do not use for attacking or disrupting Certificate Authorities, for scraping CT logs in violation of rate limits or terms of service, or as the sole method of subdomain enumeration without corroborating results through DNS verification.
Prerequisites
- Python 3.10+ with
requests,cryptography, andpyOpenSSLlibraries installed - Network access to crt.sh (HTTPS) and public CT log servers
- A list of domains to monitor (owned domains, brand variations, typosquat candidates)
- SMTP credentials or webhook URL for alerting on new certificate discoveries
- Basic understanding of X.509 certificate structure and TLS certificate chain validation
Workflow
Step 1: Domain Inventory and Baseline
Build the initial certificate inventory for monitored domains:
- Define monitoring scope: List all owned root domains, registered brand names, and known subsidiaries. Include wildcard patterns (
%.example.com) for comprehensive subdomain coverage. - Query crt.sh for historical certificates: Use the crt.sh JSON API to retrieve all known certificates for each domain. The API endpoint
https://crt.sh/?q=%.example.com&output=jsonreturns certificates matching the wildcard pattern with fields includingissuer_ca_id,issuer_name,common_name,name_value,not_before,not_after, andserial_number. - Build baseline database: Store the initial certificate set in a local SQLite database with columns for certificate ID, domain, issuer, validity dates, SANs (Subject Alternative Names), and first-seen timestamp. This baseline prevents alerting on already-known certificates.
- Identify authorized CAs: From the baseline, extract the set of Certificate Authorities that have legitimately issued certificates for your domains. Any future issuance from a CA not in this set triggers a high-priority alert.
- Map subdomains: Extract all unique subdomains from the
name_valuefield across all certificates to build an initial subdomain inventory.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 204 lines · 104 tokens per session scan A 9885e9fb0f54
auditing-tls-certificate-transparency-logs is a skill published in the GitHub repository 26zl/cybersec-toolkit (54 stars, last pushed yesterday), licensed MIT. It adds 104 tokens to every session and 3,373 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
auditing-tls-certificate-transparency-logs
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue…
analyzing-certificate-transparency-for-phishing
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
analyzing-certificate-transparency-for-phishing
Use when monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization. Use when monitoring certificate transparency logs using crt.sh and certstream to detect.
analyzing-tls-certificate-transparency-logs
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
analyzing-certificate-transparency-for-phishing
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
analyzing-certificate-transparency-for-phishing
A guide to monitoring Certificate Transparency logs, public records of issued website security certificates, to find suspicious or unauthorized domains and certificates. It uses crt.sh for historical searches and Certstream for live monitoring.