MCP.Market

domain-intel skill

by NousResearch·NousResearch/hermes-agent·263k stars·MIT

Passive recon of subdomains, SSL certs, WHOIS, and DNS.

A100/100content scan

Is the domain-intel skill safe?

Clean: nothing in its files matched our rules. We read 2 files in the folder on 2026-10-25.

No findings.

Install the domain-intel skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. 

git clone --depth 1 https://github.com/NousResearch/hermes-agent.git /tmp/hermes-agent
mkdir -p ~/.claude/skills
cp -r /tmp/hermes-agent/optional-skills/research/domain-intel ~/.claude/skills/domain-intel
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

Domain Intelligence — Passive OSINT

Passive domain reconnaissance using only Python stdlib. Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.

Helper script

This skill includes scripts/domain_intel.py — a complete CLI tool for all domain intelligence operations.

# Subdomain discovery via Certificate Transparency logs
python SKILL_DIR/scripts/domain_intel.py subdomains example.com

# SSL certificate inspection (expiry, cipher, SANs, issuer)
python SKILL_DIR/scripts/domain_intel.py ssl example.com

# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
python SKILL_DIR/scripts/domain_intel.py whois example.com

# DNS records (A, AAAA, MX, NS, TXT, CNAME)
python SKILL_DIR/scripts/domain_intel.py dns example.com

# Domain availability check (passive: DNS + WHOIS + SSL signals)
python SKILL_DIR/scripts/domain_intel.py available coolstartup.io

# Bulk analysis — multiple domains, multiple checks in parallel
python SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
python SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns

SKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.

Available commands

When to use this vs built-in tools

  • Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability
  • Use websearch** for general research about what a domain/company does
  • Use webextract** to get the actual content of a webpage
  • Use terminal with curl -I for a simple "is this URL reachable" check

Platform compatibility

Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures). Works identically on Linux, macOS, and Windows with no dependencies.

  • crt.sh queries use HTTPS (port 443) — works behind most firewalls
  • WHOIS queries use TCP port 43 — may be blocked on restrictive networks
  • DNS queries use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly
  • SSL checks connect to the target on port 443 — the only "active" operation

Data sources

All queries are passive — no port scanning, no vulnerability testing:

  • crt.sh — Certificate Transparency logs (subdomain discovery, HTTPS only)
  • WHOIS servers — Direct TCP to 100+ authoritative TLD registrars
  • Google DNS-over-HTTPS — MX, NS, TXT, CNAME resolution (firewall-friendly)
  • System DNS — A/AAAA record resolution
  • SSL check is the only "active" operation (TCP connection to target:443)

Notes

  • WHOIS queries use TCP port 43 — may be blocked on restrictive networks
  • Some WHOIS servers redact registrant info (GDPR) — mention this to the user
  • crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations
  • The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API

Contributed by @FurkanL0

More skills from NousResearch/hermes-agent

  • A1passwordSet up op CLI, sign in, and read or inject secrets.
  • A3-statement-modelBuild integrated IS/BS/CF financial workbooks in Excel.
  • AaccelerateRun PyTorch training across GPUs with minimal changes.
  • Cactual-setupSet up Actual Computer (actual.inc) inference in Hermes.
  • Aadversarial-ux-testRoleplay a hostile user to find and triage UX pain points.
  • Aagent-merge-conflict-arbiterNeutral arbiter for merge conflicts between two agents.
  • AagentmailUse when an agent needs AgentMail CLI email inboxes.
  • Aai-presenter-videoMake a verified AI presenter video from script + image.
  • AairtableAirtable REST API via curl. Records CRUD, filters, upserts.
  • AanatomyExplain an idea as an interactive isometric machine figure.
  • Cantigravity-cliOperate the Antigravity CLI (agy): plugins, auth, sandbox.
  • Aapple-notesManage Apple Notes via memo CLI: create, search, edit.

All agent skills → · MCP servers