Agent skill · security · nousresearch
domain-intel
Passive recon of subdomains, SSL certs, WHOIS, and DNS.
Why this skill is useful
Adds a complete CLI tool for passive domain intelligence operations with multiple executable commands that aren't available in standard tools.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 226,679 stars on the source repository.
What this skill does
Domain Intelligence — Passive OSINT Passive domain reconnaissance using only Python stdlib. Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows. Helper script This skill includes scripts/domainintel.py — a complete CLI tool for all domain intelligence operations. SKILLDIR is the directory containing this SKILL.md file. All output is structured JSON. Available commands Command What it does Data source --------- ------------- ------------- subdomains Find subdomains from certificate logs crt.sh (HTTPS) ssl Inspect TLS certificate details Direct TCP:443 to target whois Registration info, registrar, dates WHOIS servers (TCP:43) dns A, AAAA, MX, NS, TXT, CNAME records System DNS + Google DoH available Check if domain is registered DNS + WHOIS + SSL signals bulk Run multiple checks on multiple domains All of the above When to use this vs built-in tools Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability Use websearch for general research about what a domain/company does Use webextract to get the actual content of a webpage Use terminal with curl -I for a simple "is this URL reachable" check Task Better tool Why ------ ------------- ----- "What does example.com do?" webextract Gets page content, not DNS/WHOIS data "Find info about a company" websearch General research, not domain-specific "Is this website safe?" websearch Reputation checks need web context "Check if a URL is reachable" terminal with curl -I Simple HTTP check "Find subdomains of X" This skill Only passive source for this "When does the SSL cert expire?" This skill Built-in tools can't inspect TLS "Who registered this domain?" This skill WHOIS data not in web search "Is coolstartup.io available?" This skill Passive availability via DNS+WHOIS+SSL Platform compatibility Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures). Works identically on Linux, macOS, and Windows with no dependencies. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills nousresearch/domain-intel