Azure Firewall
vinayaklatthe/microsoft-security-skills
Guidance for Azure Firewall — managed cloud-native L3-L7 stateful network firewall for centralised egress, east-west, and ingress control.
Passive domain reconnaissance using Python stdlib. An agent skill from Tommy-yw/RunbookHermes.
Install Domain Intel
$ npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Tommy-yw/RunbookHermes domain-intel --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Tommy-yw/RunbookHermes.git skills-src && mkdir -p .claude/skills && cp -r skills-src/optional-skills/research/domain-intel .claude/skills/domain-intel && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "domain-intel" agent skill from https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intel into .claude/skills/domain-intel/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "domain-intel", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intelType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Tommy-yw/RunbookHermes domain-intel --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Tommy-yw/RunbookHermes.git skills-src && mkdir -p .agents/skills && cp -r skills-src/optional-skills/research/domain-intel .agents/skills/domain-intel && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "domain-intel" agent skill from https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intel into .agents/skills/domain-intel/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "domain-intel", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Tommy-yw/RunbookHermes domain-intel --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Tommy-yw/RunbookHermes.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/optional-skills/research/domain-intel .cursor/skills/domain-intel && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "domain-intel" agent skill from https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intel into .cursor/skills/domain-intel/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "domain-intel", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Tommy-yw/RunbookHermes.git --path optional-skills/research/domain-intel--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Tommy-yw/RunbookHermes domain-intel --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Tommy-yw/RunbookHermes.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/optional-skills/research/domain-intel .gemini/skills/domain-intel && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "domain-intel" agent skill from https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intel into .gemini/skills/domain-intel/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "domain-intel", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Tommy-yw/RunbookHermes domain-intelInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Tommy-yw/RunbookHermes.git skills-src && mkdir -p .github/skills && cp -r skills-src/optional-skills/research/domain-intel .github/skills/domain-intel && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "domain-intel" agent skill from https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intel into .github/skills/domain-intel/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "domain-intel", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Tommy-yw/RunbookHermes domain-intel --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Tommy-yw/RunbookHermes.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/optional-skills/research/domain-intel .opencode/skills/domain-intel && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "domain-intel" agent skill from https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intel into .opencode/skills/domain-intel/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "domain-intel", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
domain-intel- GitHub stars
- 546
- Used in
- 1 other repo
- Token cost
- ~1.1k tokens
- SKILL.md length
- 435 words
- Files
- 2 (incl. scripts)
- Skills in repo
- 38
- Repo updated
- First seen
- Licence
- MIT
At a glance
Passive domain reconnaissance using Python stdlib. An agent skill from Tommy-yw/RunbookHermes.
- Tasks that involve Cloud networking
- SKILL.md covers Helper script, Available commands, When to use this vs built-in… and Platform compatibility, plus 2 more sections
- Runs Python scripts from its folder; calls python3 and curl
- Tasks that involve OSINT
What it does
Domain Intel is an agent skill from Tommy-yw/RunbookHermes. Passive domain reconnaissance using Python stdlib. Subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, domain availability checks, and bulk multi-domain analysis. No API keys required.
Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including scripts (for example `scripts/domain_intel.py`).
It sits in Security, covering Cloud networking and OSINT. It works with Python. The repository describes itself as: Hermes-native AIOps agent for evidence-driven incident response, approval-gated remediation, and runbook learning. The licence is MIT.
When your agent uses it
- Tasks that involve Cloud networking
- Tasks that involve OSINT
Example prompts
- “/domain-intel”
Requirements
- Python 3
What it can do on your machine
Read from SKILL.md and the folder at commit 7fd2b9a. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
python3curl
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Domain Intel loads about 1.1k tokens when it runs. Until then it costs about 56 tokens; SKILL.md has 435 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from Tommy-yw/RunbookHermes at commit 7fd2b9a, republished under its MIT licence (© Tommy-yw). 435 words, ~1,121 tokens.
Download SKILL.mdSave it as
.claude/skills/domain-intel/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- domain-intel
- description
- Passive domain reconnaissance using Python stdlib. Subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, domain availability checks, and bulk multi-domain analysis. No API keys required.
Domain Intelligence — Passive OSINT
Passive domain reconnaissance using only Python stdlib. Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.
Helper script
This skill includes scripts/domain_intel.py — a complete CLI tool for all domain intelligence operations.
# Subdomain discovery via Certificate Transparency logs
python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com
# SSL certificate inspection (expiry, cipher, SANs, issuer)
python3 SKILL_DIR/scripts/domain_intel.py ssl example.com
# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
python3 SKILL_DIR/scripts/domain_intel.py whois example.com
# DNS records (A, AAAA, MX, NS, TXT, CNAME)
python3 SKILL_DIR/scripts/domain_intel.py dns example.com
# Domain availability check (passive: DNS + WHOIS + SSL signals)
python3 SKILL_DIR/scripts/domain_intel.py available coolstartup.io
# Bulk analysis — multiple domains, multiple checks in parallel
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dnsSKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.
Available commands
| Command | What it does | Data source |
|---|---|---|
subdomains | Find subdomains from certificate logs | crt.sh (HTTPS) |
ssl | Inspect TLS certificate details | Direct TCP:443 to target |
whois | Registration info, registrar, dates | WHOIS servers (TCP:43) |
dns | A, AAAA, MX, NS, TXT, CNAME records | System DNS + Google DoH |
available | Check if domain is registered | DNS + WHOIS + SSL signals |
bulk | Run multiple checks on multiple domains | All of the above |
When to use this vs built-in tools
- Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability
- Use
web_searchfor general research about what a domain/company does - Use
web_extractto get the actual content of a webpage - Use
terminalwithcurl -Ifor a simple "is this URL reachable" check
| Task | Better tool | Why |
|---|---|---|
| "What does example.com do?" | web_extract | Gets page content, not DNS/WHOIS data |
| "Find info about a company" | web_search | General research, not domain-specific |
| "Is this website safe?" | web_search | Reputation checks need web context |
| "Check if a URL is reachable" | terminal with curl -I | Simple HTTP check |
| "Find subdomains of X" | This skill | Only passive source for this |
| "When does the SSL cert expire?" | This skill | Built-in tools can't inspect TLS |
| "Who registered this domain?" | This skill | WHOIS data not in web search |
| "Is coolstartup.io available?" | This skill | Passive availability via DNS+WHOIS+SSL |
Show full SKILL.md (173 more words)Show less
Platform compatibility
Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures).
Works identically on Linux, macOS, and Windows with no dependencies.
- crt.sh queries use HTTPS (port 443) — works behind most firewalls
- WHOIS queries use TCP port 43 — may be blocked on restrictive networks
- DNS queries use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly
- SSL checks connect to the target on port 443 — the only "active" operation
Data sources
All queries are passive — no port scanning, no vulnerability testing:
- crt.sh — Certificate Transparency logs (subdomain discovery, HTTPS only)
- WHOIS servers — Direct TCP to 100+ authoritative TLD registrars
- Google DNS-over-HTTPS — MX, NS, TXT, CNAME resolution (firewall-friendly)
- System DNS — A/AAAA record resolution
- SSL check is the only "active" operation (TCP connection to target:443)
Notes
- WHOIS queries use TCP port 43 — may be blocked on restrictive networks
- Some WHOIS servers redact registrant info (GDPR) — mention this to the user
- crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations
- The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API
Contributed by @FurkanL0
© Tommy-yw, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (scripts) in optional-skills/research/domain-intel of Tommy-yw/RunbookHermes.
- SKILL.md
- scripts/domain_intel.py
Open the folder on GitHubat commit 7fd2b9a
Used in 1 other repository
We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in Tommy-yw/RunbookHermes, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Domain Intel next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Domain Intel this skillTommy-yw/RunbookHermes | 546 | 1 repos | ~1.1k | Automated safety check: Pass | MIT | |
| Azure Firewallvinayaklatthe/microsoft-security-skills | 175 | — | ~1.7k | Automated safety check: Pass | MIT | |
| Osint Investigationjohnson7788/MultiUserClaw | 327 | — | ~3k | Automated safety check: Pass | MIT | |
| Implementing Stix Taxii Feed Integrationmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.7k | Automated safety check: Pass | Apache-2.0 | |
| Automating Ioc Enrichmentmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.2k | Automated safety check: Pass | Apache-2.0 | |
| Building Adversary Infrastructure Tracking Systemmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.7k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Osint Investigation
johnson7788/MultiUserClaw
Public-records OSINT investigation framework — SEC EDGAR filings, USAspending contracts, Senate lobbying, OFAC sanctions, ICIJ offshore leaks, NYC property records (ACRIS), OpenCorporates…
Implementing Stix Taxii Feed Integration
mukul975/Anthropic-Cybersecurity-Skills
Implements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server discovery, collection polling, parsing STIX bundles with the stix2 library, and…
Automating Ioc Enrichment
mukul975/Anthropic-Cybersecurity-Skills
Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and…
Building Adversary Infrastructure Tracking System
mukul975/Anthropic-Cybersecurity-Skills
Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP…
Building Attack Pattern Library From Cti Reports
mukul975/Anthropic-Cybersecurity-Skills
Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs…
More from Tommy-yw/RunbookHermes
All 38 skills in this repoFastmcp
Tommy-yw/RunbookHermes
Build, test, inspect, install, and deploy MCP servers with FastMCP in Python.
Drug Discovery
Tommy-yw/RunbookHermes
Pharmaceutical research assistant for drug discovery workflows.
Youtube Content
Tommy-yw/RunbookHermes
Fetch YouTube video transcripts and transform them into structured content (chapters, summaries, threads, blog posts).
Oss Forensics
Tommy-yw/RunbookHermes
Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories.
P5js
Tommy-yw/RunbookHermes
Production pipeline for interactive and generative visual art using p5.js.
Touchdesigner MCP
Tommy-yw/RunbookHermes
Control a running TouchDesigner instance via twozero MCP — create operators, set parameters, wire connections, execute Python, build real-time visuals.
Related
Works with
Categories
Questions about Domain Intel
What does Domain Intel do?
Passive domain reconnaissance using Python stdlib. An agent skill from Tommy-yw/RunbookHermes. Domain Intel is an agent skill from Tommy-yw/RunbookHermes. Passive domain reconnaissance using Python stdlib.
When should I use Domain Intel?
Domain Intel fits situations like: tasks that involve Cloud networking; tasks that involve OSINT.
How do I install Domain Intel in Claude Code?
Run `npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a claude-code`. Or copy the skill folder (optional-skills/research/domain-intel in Tommy-yw/RunbookHermes) into .claude/skills/domain-intel in your project. Claude Code loads it when a task matches its description.
How do I install Domain Intel in Codex?
Run `npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a codex`. Or copy the skill folder (optional-skills/research/domain-intel in Tommy-yw/RunbookHermes) into .agents/skills/domain-intel in your project. Codex loads it when a task matches its description.
Can I use Domain Intel in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Tommy-yw/RunbookHermes --skill domain-intel -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/domain-intel, .gemini/skills/domain-intel, .github/skills/domain-intel and .opencode/skills/domain-intel in your project.
What does Domain Intel need to run?
Going by SKILL.md and its folder, Domain Intel needs Python for the scripts in its folder and the command-line tools its instructions call (python3 and curl). Our summary lists: Python 3.
Does Domain Intel access the network?
SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.
Is Domain Intel safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Domain Intel use?
Domain Intel is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Domain Intel use?
About 1.1k tokens (SKILL.md is roughly 4.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Domain Intel?
Skills that share tags, products or a category with Domain Intel: Azure Firewall (vinayaklatthe/microsoft-security-skills, 175 stars), Osint Investigation (johnson7788/MultiUserClaw, 327 stars), Implementing Stix Taxii Feed Integration (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Automating Ioc Enrichment (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Domain Intel?
Tommy-yw (a GitHub user) maintains it in Tommy-yw/RunbookHermes, which has 546 GitHub stars. The repository holds 38 skills in this directory. The repository was last updated on May 18, 2026.
Source: Tommy-yw/RunbookHermes on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.