abuseipdb-api
FreeAbuseIPDB API reference. IP reputation and abuse report lookups.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
FreePublished on GitHub
censys-api
Censys API v2 reference. Host reconnaissance and certificate data.
The English summary is being prepared. Showing the original description.
See how to installFiles included (1)
- SKILL.md2.3 KB
SKILL.md (original)
Review the instructions the agent will receive before you install.
Censys API v2
Base URL
https://search.censys.io/api/v2
Authentication
Basic Auth: $CENSYS_API_ID:$CENSYS_API_SECRET
curl -s "https://search.censys.io/api/v2/hosts/{ip}" \
-u "$CENSYS_API_ID:$CENSYS_API_SECRET"
Rate Limits
- Free: 250 queries/month, 5 results/query
- Paid: Higher limits based on plan
Important: Free tier is very limited. Use selectively — prioritise high-value lookups.
Key Endpoints
View Host
curl -s "https://search.censys.io/api/v2/hosts/{ip}" \
-u "$CENSYS_API_ID:$CENSYS_API_SECRET"
Useful fields:
result.services[]— port, service_name, transport_protocol, bannerresult.services[].tls.certificates— TLS certificate chainresult.autonomous_system— ASN inforesult.location— geographic locationresult.operating_system— OS detectionresult.last_updated_at— scan freshness
Search Hosts
curl -s "https://search.censys.io/api/v2/hosts/search?q={query}" \
-u "$CENSYS_API_ID:$CENSYS_API_SECRET"
Search syntax: services.port: 443 AND services.tls.certificates.leaf_data.subject.common_name: example.com
View Certificate
curl -s "https://search.censys.io/api/v2/certificates/{fingerprint}" \
-u "$CENSYS_API_ID:$CENSYS_API_SECRET"
Common Search Queries
ip: {ip}— specific hostservices.tls.certificates.leaf_data.subject.common_name: {domain}— hosts with cert for domainservices.http.response.body_hash: {hash}— hosts serving same contentservices.jarm.fingerprint: {jarm}— hosts with same JARM fingerprint (C2 detection)labels: {label}— Censys-labeled hosts
CTI Value
Censys excels at:
- Certificate transparency analysis (finding related infrastructure)
- JARM fingerprinting (identifying C2 frameworks)
- Service banner analysis
- Historical infrastructure changes
Response Summary Format
ip: <IP>
services:
- port: <port>
service: <name>
banner: <truncated>
certificates:
- subject_cn: <common name>
issuer: <issuer>
valid_from: <date>
valid_to: <date>
autonomous_system:
asn: <number>
name: <name>
location:
country: <country>
city: <city>
last_updated: <date>
Reviews
No reviews yet. Tell others what you thought.
Comments
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
More skills from this repository
ach
FreeAnalysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026
claim-extraction
FreeUse when a report or article needs to be split into individual claims before it is graded, cited or used as evidence — the user asks "what does this report actually claim?", "split this into claims", "separate the facts from the judgements", or another skill needs a claim list. Turns one document into five to twelve atomic claims, each typed (observation, attribution, assessment, actor claim, victim disclosure) and anchored to the verbatim sentence it rests on, so every extraction can be checked against the source. Preserves the source's own hedging. Does not grade. Invoked by /quality-of-information-check; its output feeds /ach, /key-assumptions-check, /intelligence-writing, /writing-assessments and /threat-actor-profiling.
The English summary is being prepared. Showing the original description.
Liberty91LTD/cti-skills27Updated Sep 30, 2026