SKILLoptionalHermes Optional Skills

Domain Intel

Name: Domain Intel
Author: FurkanL0, Hermes Agent

Passive recon of subdomains, SSL certs, WHOIS, and DNS

DomainsOSINTDNSResearchOptionalHermes skill

Last registry verification2026-08-18v1.0.0FurkanL0, Hermes Agent

Open original source ↗اقرأ بالعربية

Plain meaning

What does it add to Hermes?

Passive recon of subdomains, SSL certs, WHOIS, and DNS

Domain Intel is a skill related to research and sources. It gives the agent a way to find external information and sources instead of relying only on model memory.

This plain-language explanation is based on the publisher description. The original text remains visible for verification.

Use it when

Use it when your goal in research and sources is clear and you can limit it to the data and actions it actually needs.

Skip it when

Do not add it merely to experiment when Hermes already has a simpler path, or when you cannot review its source and permissions.

Who is it for?

Best for users who want a repeatable way of working inside Hermes.

Safe first test

Ask for one recent fact with two sources, then open both links and verify dates and evidence.

Original publisher description

Passive recon of subdomains, SSL certs, WHOIS, and DNS

✓

Data source

This entry was indexed from Hermes Optional Skills. Our explanation interprets the type and domain without inventing a capability not present upstream.

Security review

The source is official or editorially reviewed, but you still need to review permissions and version compatibility.

Safe setup path

Inspect, install, then test.

01
Open the source
Match the publisher, license, and description to your need. Check the real update history.
02
Review permissions and secrets
Never paste a secret value into this site. Use environment-variable names and grant the smallest scope.
03
Copy setup only after review
The controls below copy text. They do not execute commands on your device.
04
Test with a non-sensitive task
Inspect the visible tools, then exclude write or delete tools you do not need.

Install command

Review the command, then copy it.

hermes skills install domain-intel

Hermes Belarabi does not execute this command. Installation happens on your device and remains subject to Hermes scanning and your review.

The full skill definition

Exactly what Hermes loads when this skill runs.

Reproduced from the official documentation. Read it before enabling the skill: this text becomes the agent's instructions.

Passive recon of subdomains, SSL certs, WHOIS, and DNS.

Skill metadata

A lookup table. Do not read it all; find the row that applies to you.

Source	Optional — install with `hermes skills install official/research/domain-intel`
Path	`optional-skills/research/domain-intel`
Version	`1.0.0`
Author	FurkanL0, Hermes Agent
License	MIT
Platforms	linux, macos, windows
Tags	`Domains`, `OSINT`, `DNS`, `Research`

Reference: full SKILL.md

Explains the idea itself. Read it slowly; the later sections build on it.

Passive domain reconnaissance using only Python stdlib. Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.

Helper script

Settings you configure once. Change one at a time so you can see what each does. Set SKILL_DIR in your environment, not in the chat.

This skill includes scripts/domain_intel.py — a complete CLI tool for all domain intelligence operations.

Shell18 lines

# Subdomain discovery via Certificate Transparency logs
python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com

# SSL certificate inspection (expiry, cipher, SANs, issuer)
python3 SKILL_DIR/scripts/domain_intel.py ssl example.com

# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
python3 SKILL_DIR/scripts/domain_intel.py whois example.com

# DNS records (A, AAAA, MX, NS, TXT, CNAME)
python3 SKILL_DIR/scripts/domain_intel.py dns example.com

# Domain availability check (passive: DNS + WHOIS + SSL signals)
python3 SKILL_DIR/scripts/domain_intel.py available coolstartup.io

# Bulk analysis — multiple domains, multiple checks in parallel
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns

SKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.

Available commands

A lookup table. Do not read it all; find the row that applies to you.

Command	What it does	Data source
`subdomains`	Find subdomains from certificate logs	crt.sh (HTTPS)
`ssl`	Inspect TLS certificate details	Direct TCP:443 to target
`whois`	Registration info, registrar, dates	WHOIS servers (TCP:43)
`dns`	A, AAAA, MX, NS, TXT, CNAME records	System DNS + Google DoH
`available`	Check if domain is registered	DNS + WHOIS + SSL signals
`bulk`	Run multiple checks on multiple domains	All of the above

When to use this vs built-in tools

A lookup table. Do not read it all; find the row that applies to you.

Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability
Use web_search for general research about what a domain/company does
Use web_extract to get the actual content of a webpage
Use terminal with curl -I for a simple "is this URL reachable" check

Task	Better tool	Why
"What does example.com do?"	`web_extract`	Gets page content, not DNS/WHOIS data
"Find info about a company"	`web_search`	General research, not domain-specific
"Is this website safe?"	`web_search`	Reputation checks need web context
"Check if a URL is reachable"	`terminal` with `curl -I`	Simple HTTP check
"Find subdomains of X"	This skill	Only passive source for this
"When does the SSL cert expire?"	This skill	Built-in tools can't inspect TLS
"Who registered this domain?"	This skill	WHOIS data not in web search
"Is coolstartup.io available?"	This skill	Passive availability via DNS+WHOIS+SSL

Platform compatibility

Explains the idea itself. Read it slowly; the later sections build on it.

Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures). Works identically on Linux, macOS, and Windows with no dependencies.

crt.sh queries use HTTPS (port 443) — works behind most firewalls
WHOIS queries use TCP port 43 — may be blocked on restrictive networks
DNS queries use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly
SSL checks connect to the target on port 443 — the only "active" operation

Data sources

Explains the idea itself. Read it slowly; the later sections build on it.

All queries are passive — no port scanning, no vulnerability testing:

crt.sh — Certificate Transparency logs (subdomain discovery, HTTPS only)
WHOIS servers — Direct TCP to 100+ authoritative TLD registrars
Google DNS-over-HTTPS — MX, NS, TXT, CNAME resolution (firewall-friendly)
System DNS — A/AAAA record resolution
SSL check is the only "active" operation (TCP connection to target:443)

Notes

Explains the idea itself. Read it slowly; the later sections build on it.

WHOIS queries use TCP port 43 — may be blocked on restrictive networks
Some WHOIS servers redact registrant info (GDPR) — mention this to the user
crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations
The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API

---

Contributed by @FurkanL0 ↗