Skip to main content
Passive recon of subdomains, SSL certs, WHOIS, and DNS.

​
Skill metadata

​
Reference: full SKILL.md

The following is the complete skill definition that Mibyan loads when this skill is triggered. This is what the agent sees as instructions when the skill is active.

​
Domain Intelligence — Passive OSINT

Passive domain reconnaissance using only Python stdlib. Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.

​
Helper script

This skill includes scripts/domain_intel.py — a complete CLI tool for all domain intelligence operations.
SKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.

​
Available commands

​
When to use this vs built-in tools

  • Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability
  • Use web_search for general research about what a domain/company does
  • Use web_extract to get the actual content of a webpage
  • Use terminal with curl -I for a simple “is this URL reachable” check

​
Platform compatibility

Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures). Works identically on Linux, macOS, and Windows with no dependencies.
  • crt.sh queries use HTTPS (port 443) — works behind most firewalls
  • WHOIS queries use TCP port 43 — may be blocked on restrictive networks
  • DNS queries use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly
  • SSL checks connect to the target on port 443 — the only “active” operation

​
Data sources

All queries are passive — no port scanning, no vulnerability testing:
  • crt.sh — Certificate Transparency logs (subdomain discovery, HTTPS only)
  • WHOIS servers — Direct TCP to 100+ authoritative TLD registrars
  • Google DNS-over-HTTPS — MX, NS, TXT, CNAME resolution (firewall-friendly)
  • System DNS — A/AAAA record resolution
  • SSL check is the only “active” operation (TCP connection to target:443)

​
Notes

  • WHOIS queries use TCP port 43 — may be blocked on restrictive networks
  • Some WHOIS servers redact registrant info (GDPR) — mention this to the user
  • crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations
  • The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API
Contributed by @FurkanL0