skills.rest
InverterNetwork
InverterNetworkOFFICIAL
Explore all skills by this author →
Website𝕏@inverternetworkGitHub

domain-intel

Perform passive domain reconnaissance with subdomain discovery, SSL inspection, WHOIS, and DNS resolution.

Updated May 4, 2026
Search Tags:#security#reconnaissance#dns#ssl#domain#osint
One-click install
npx skills add https://github.com/InverterNetwork/hermes-agent --skill domain-intel-inverternetwork
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/InverterNetwork/hermes-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/InverterNetwork/hermes-agent --skill domain-intel-inverternetwork

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill solves the problem of gathering reconnaissance data on domains without triggering active security alerts or requiring external API keys.

Core Features & Use Cases

  • Passive Reconnaissance: Discover subdomains, inspect SSL certificates, and perform WHOIS and DNS lookups using only Python standard libraries.
  • Infrastructure Auditing: Quickly verify domain availability, check SSL expiry status, and map DNS records for multiple domains in bulk.
  • Use Case: Use this tool to audit a list of company domains to identify expiring SSL certificates or to map out the external attack surface of a target organization during a security assessment.

Quick Start

Use the domain-intel skill to perform a full DNS and SSL check on example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without triggering security alerts?▼

Passive domain reconnaissance gathers subdomains, SSL certificates, WHOIS data, and DNS records without active scanning. This skill uses native Python libraries to query public infrastructure data, ensuring firewall-friendly operation that avoids triggering target security alerts.

Can I check SSL certificate expiry and DNS records for multiple domains in bulk?▼

Yes, you can perform bulk infrastructure auditing to check SSL certificate expiry and map DNS records for multiple domains. The skill processes domain lists and outputs structured JSON, allowing you to quickly verify availability and identify expiring certificates across your organization.

Do I need external API keys or dependencies to run subdomain discovery and WHOIS lookups?▼

No external API keys or dependencies are required for subdomain discovery or WHOIS lookups. The skill utilizes native Python socket and ssl modules exclusively, ensuring zero-dependency execution across Linux, macOS, and Windows environments.

What is the best way to map an organization's external attack surface using OSINT?▼

Mapping an external attack surface with OSINT involves discovering subdomains and resolving DNS records passively. This skill provides structured JSON output of the target organization's infrastructure, enabling security assessments without active probing or external API authentication.

Does passive reconnaissance work across different operating systems like Windows and Linux?▼

Passive reconnaissance operates across Linux, macOS, and Windows environments. By using standard Python libraries for DNS resolution and SSL inspection, the skill ensures consistent, cross-platform execution without requiring environment-specific dependencies or configurations.

Why does passive DNS resolution avoid triggering firewall alerts compared to active scanning?▼

Passive DNS resolution queries standard infrastructure records rather than sending direct probe packets to target hosts. This skill leverages native Python socket requests to gather SSL and WHOIS data, avoiding the intrusive traffic patterns that firewalls detect during active network scanning.

Related Skills

Explore More Software Engineering Skills→
cxnaivecxnaive

domain-intel

Perform passive domain reconnaissance using Python standard library modules.

Community
Intermediate
AcczdyAcczdy
2

performing-subdomain-enumeration-with-subfinder

Enumerate target domain subdomains with Subfinder and output JSON/MD reports.

Community
Intermediate
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced