kaminocorp/hermes-alpha/domain-intel

Claude Code and agent skill by kaminocorp/hermes-alpha

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

Passive domain reconnaissance using Python stdlib. Subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, domain availability checks, and bulk multi-domain analysis. No API keys required.

Install

npx vskill@latest install kaminocorp/hermes-alpha/domain-intel

SKILL.md

The same SKILL.md was published earlier as aivrar/portable-hermes-agent/domain-intel.

Domain Intelligence — Passive OSINT

Passive domain reconnaissance using only Python stdlib. Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.

Helper script

This skill includes scripts/domain_intel.py — a complete CLI tool for all domain intelligence operations.

bash
# Subdomain discovery via Certificate Transparency logs
python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com
 
# SSL certificate inspection (expiry, cipher, SANs, issuer)
python3 SKILL_DIR/scripts/domain_intel.py ssl example.com
 
# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
python3 SKILL_DIR/scripts/domain_intel.py whois example.com
 
# DNS records (A, AAAA, MX, NS, TXT, CNAME)
python3 SKILL_DIR/scripts/domain_intel.py dns example.com
 
# Domain availability check (passive: DNS + WHOIS + SSL signals)
python3 SKILL_DIR/scripts/domain_intel.py available coolstartup.io
 
# Bulk analysis — multiple domains, multiple checks in parallel
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns

SKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.

Available commands

CommandWhat it doesData source
subdomainsFind subdomains from certificate logscrt.sh (HTTPS)
sslInspect TLS certificate detailsDirect TCP:443 to target
whoisRegistration info, registrar, datesWHOIS servers (TCP:43)
dnsA, AAAA, MX, NS, TXT, CNAME recordsSystem DNS + Google DoH
availableCheck if domain is registeredDNS + WHOIS + SSL signals
bulkRun multiple checks on multiple domainsAll of the above

When to use this vs built-in tools

  • Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability
  • Use `web_search` for general research about what a domain/company does
  • Use `web_extract` to get the actual content of a webpage
  • Use `terminal` with `curl -I` for a simple "is this URL reachable" check
TaskBetter toolWhy
"What does example.com do?"web_extractGets page content, not DNS/WHOIS data
"Find info about a company"web_searchGeneral research, not domain-specific
"Is this website safe?"web_searchReputation checks need web context
"Check if a URL is reachable"terminal with curl -ISimple HTTP check
"Find subdomains of X"This skillOnly passive source for this
"When does the SSL cert expire?"This skillBuilt-in tools can't inspect TLS
"Who registered this domain?"This skillWHOIS data not in web search
"Is coolstartup.io available?"This skillPassive availability via DNS+WHOIS+SSL

Platform compatibility

Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures). Works identically on Linux, macOS, and Windows with no dependencies.

  • crt.sh queries use HTTPS (port 443) — works behind most firewalls
  • WHOIS queries use TCP port 43 — may be blocked on restrictive networks
  • DNS queries use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly
  • SSL checks connect to the target on port 443 — the only "active" operation

Data sources

All queries are passive — no port scanning, no vulnerability testing:

  • crt.sh — Certificate Transparency logs (subdomain discovery, HTTPS only)
  • WHOIS servers — Direct TCP to 100+ authoritative TLD registrars
  • Google DNS-over-HTTPS — MX, NS, TXT, CNAME resolution (firewall-friendly)
  • System DNS — A/AAAA record resolution
  • SSL check is the only "active" operation (TCP connection to target:443)

Notes

  • WHOIS queries use TCP port 43 — may be blocked on restrictive networks
  • Some WHOIS servers redact registrant info (GDPR) — mention this to the user
  • crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations
  • The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API

Contributed by [@FurkanL0](https://github.com/FurkanL0)

Security

  • Security scanPassed, 95 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
228
Repository forks
34
7-day trend score
27

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/kaminocorp/hermes-alpha/domain-intel/badge)](https://verified-skill.com/skills/kaminocorp/hermes-alpha/domain-intel)

Something wrong with this skill or its page? Tell us.