Source profileQuality 89/100Review permissions

Liberty91LTD/cti-skills/skills/lookup-censys/SKILL.md

lookup-censys

Use when you need deep host + certificate reconnaissance for an IP or need to run a Censys search query. Returns services, TLS certificates, ASN, and location. Free tier is severely limited (250 queries/month) — use sparingly. Retrieval only.

Source repository stars: 11
Declared platforms: 0
Static risk flags: 2
Last source update: 2026-08-04
Source checked: 2026-08-04

Decision Compatibility Install Workflow Permissions Evidence Source

Decision brief

What it does—and where it fits

Queries Censys for host and certificate reconnaissance on IPs, or runs a Censys Search query. Retrieval only. Quota-aware — free tier is 250 queries/month.

Best for

Use when you need deep host + certificate reconnaissance for an IP or need to run a Censys search query.

Not for

Tasks that require unconfirmed production actions or broad system permissions.
Environments where the pinned source and install steps cannot be inspected.

Compatibility matrix

Platform support, with evidence labels

Platform	Status	Evidence	What to check
Codex	Not declared	No explicit evidence	Portability before use
Claude Code	Not declared	No explicit evidence	Portability before use
Cursor	Not declared	No explicit evidence	Portability before use
Gemini CLI	Not declared	No explicit evidence	Portability before use

Open the compatibility checker

Installation

Inspect first. Install second.

The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

Source-detected install commandSource

npx skills add https://github.com/Liberty91LTD/cti-skills --skill "skills/lookup-censys"

Safe inspection promptEditorial

Inspect the Agent Skill "lookup-censys" from https://github.com/Liberty91LTD/cti-skills/blob/97d66b3687ba6d32b316a7df3391beb3e2de88de/skills/lookup-censys/SKILL.md at commit 97d66b3687ba6d32b316a7df3391beb3e2de88de. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

Workflow

What the source asks the agent to do

01
How to invoke
Two CLIs are provided. Pick by capability needed.
Aggregate — the unsung hero. Aggregations are free (do not consume query credits) and let you ask "how many hosts in this query break down by country / port / ASN / product?" in a single call. Use this BEFORE a search t…Host timeline — the activity history of a single IP between two timestamps. New in Platform.At-time host view — see what a host looked like at a past timestamp (Platform-only).
02
When to invoke
Do NOT invoke for: - Bulk enrichment (will exhaust quota) - IPs you can get from Shodan first
Shodan wasn't sufficient and deeper host data is neededTLS certificate pivoting (find other hosts sharing a cert)Specific Censys Search query required
03
Basic host + search — Node CLI (legacy Search API)
Requires CENSYSAPIID + CENSYSAPISECRET (legacy). Hits hosts/{ip} or hosts/search.
Requires CENSYSAPIID + CENSYSAPISECRET (legacy). Hits hosts/{ip} or hosts/search.
04
Full Platform surface — Python CLI (new Censys Platform SDK)
Requires CENSYSPAT (new). Self-bootstraps a private venv at tools/clis/.venv-censys/ on first run (installs censys-platform).
Aggregate — the unsung hero. Aggregations are free (do not consume query credits) and let you ask "how many hosts in this query break down by country / port / ASN / product?" in a single call. Use this BEFORE a search t…Host timeline — the activity history of a single IP between two timestamps. New in Platform.At-time host view — see what a host looked like at a past timestamp (Platform-only).
05
Free aggregation: count hosts running Cobalt Strike by country (no credits)
python3 tools/clis/censys.py aggregate \ 'services.product: "Cobalt Strike Team Server"' \ --field location.countrycode
python3 tools/clis/censys.py aggregate \ 'services.product: "Cobalt Strike Team Server"' \ --field location.countrycode

Permission review

Static risk signals and limitations

Network access

medium · line 20

The documentation includes network, browsing, or remote request actions.

**Auth note**: Censys migrated to a single Personal Access Token (PAT) on the new Platform. The Node CLI uses the legacy Search API (HTTP Basic Auth with `CENSYS_API_ID` + `CENSYS_API_SECRET`); the Python CLI uses the new Platform API (Bear

Network access

medium · line 22

The documentation includes network, browsing, or remote request actions.

### Basic host + search — Node CLI (legacy Search API)

Runs scripts

medium · line 25

The documentation asks the agent to run terminal commands or scripts.

node tools/clis/censys.js ip <ip>

Runs scripts

medium · line 26

The documentation asks the agent to run terminal commands or scripts.

node tools/clis/censys.js search "<query>" # Censys Search syntax

Evidence record

Why each signal appears

EvidenceSourceComputedTestedEditorial

Signal	Value	Evidence type	Meaning
Quality score	89/100	Computed	Documentation, specificity, maintenance, and trust rules
Repository stars	11	Source	Repository attention, not individual Skill quality
Compatibility	0 platforms	Source	Declared in the catalog source record
Usage guide	automated source guide	Editorial	Generated or reviewed according to the visible evidence level

Pinned source

Provenance and original SKILL.md

Repository: Liberty91LTD/cti-skills
Skill path: skills/lookup-censys/SKILL.md
Commit: 97d66b3687ba6d32b316a7df3391beb3e2de88de
License: MIT
Collected: 2026-08-04
Default branch: main

View the original SKILL.md

lookup-censys

Queries Censys for host and certificate reconnaissance on IPs, or runs a Censys Search query. Retrieval only. Quota-aware — free tier is 250 queries/month.

When to invoke

Shodan wasn't sufficient and deeper host data is needed
TLS certificate pivoting (find other hosts sharing a cert)
Specific Censys Search query required

Do NOT invoke for:

Bulk enrichment (will exhaust quota)
IPs you can get from Shodan first

How to invoke

Two CLIs are provided. Pick by capability needed.

Auth note: Censys migrated to a single Personal Access Token (PAT) on the new Platform. The Node CLI uses the legacy Search API (HTTP Basic Auth with CENSYS_API_ID + CENSYS_API_SECRET); the Python CLI uses the new Platform API (Bearer auth with CENSYS_PAT). New accounts get a PAT — use the Python CLI. Old accounts may still have working legacy credentials and can use either.

Basic host + search — Node CLI (legacy Search API)

node tools/clis/censys.js ip <ip>
node tools/clis/censys.js search "<query>"      # Censys Search syntax

Requires CENSYS_API_ID + CENSYS_API_SECRET (legacy). Hits hosts/{ip} or hosts/search.

Full Platform surface — Python CLI (new Censys Platform SDK)

python3 tools/clis/censys.py host <ip> [--at-time ISO8601]
python3 tools/clis/censys.py timeline <ip> --start ISO8601 --end ISO8601
python3 tools/clis/censys.py services <ip>
python3 tools/clis/censys.py search "<query>" [--page-size N] [--page-token TOKEN] [--fields F1,F2]
python3 tools/clis/censys.py aggregate "<query>" --field FIELD [--buckets N] [--filter-by-query]
python3 tools/clis/censys.py certs view <cert_id>
python3 tools/clis/censys.py certs list <id1,id2,...>

Requires CENSYS_PAT (new). Self-bootstraps a private venv at tools/clis/.venv-censys/ on first run (installs censys-platform).

Capabilities the Node CLI doesn't have, ordered by CTI value:

Aggregate — the unsung hero. Aggregations are free (do not consume query credits) and let you ask "how many hosts in this query break down by country / port / ASN / product?" in a single call. Use this BEFORE a search to scope the result set without spending credits.
Host timeline — the activity history of a single IP between two timestamps. New in Platform.
At-time host view — see what a host looked like at a past timestamp (Platform-only).
Service listing — enumerate just the services on a host without the full record.
Certificate view by ID + certificate list (bulk) — pull cert detail or batch fetch.
Cursor-based pagination — --page-token for traversing large result sets.

Examples:

# Free aggregation: count hosts running Cobalt Strike by country (no credits)
python3 tools/clis/censys.py aggregate \
  'services.product: "Cobalt Strike Team Server"' \
  --field location.country_code

# Free aggregation: ASN distribution of a JARM-fingerprinted cluster
python3 tools/clis/censys.py aggregate \
  'services.tls.jarm.fingerprint: "1234567890abcdef..."' \
  --field autonomous_system.asn --buckets 50

# What was this IP doing two weeks ago? (Platform-only)
python3 tools/clis/censys.py host 185.220.101.45 \
  --at-time 2026-04-12T00:00:00Z

# Daily activity timeline for an IP
python3 tools/clis/censys.py timeline 185.220.101.45 \
  --start 2026-04-01T00:00:00Z --end 2026-04-26T00:00:00Z

# Certificate view by ID (the SHA-256 fingerprint)
python3 tools/clis/censys.py certs view 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

# Search hosts and only return specific fields (saves payload)
python3 tools/clis/censys.py search \
  'services.tls.certificates.leaf_data.subject.common_name: "*.badcorp.example"' \
  --fields ip,location.country_code,services.port

Both CLIs accept --dry-run. Python CLI exits code 2 if CENSYS_PAT is unset; Node CLI exits code 2 if either of the legacy variables is unset. Report missing credentials; do not fabricate.

Free tier reality check (Platform API)

The new Censys Platform tightened free-tier API access. As of 2026, free Community accounts can call these endpoints only:

host — view host detail by IP ✓
services — list services on a host ✓
timeline — host activity timeline between two timestamps ✓
certs view — certificate by ID ✓

These are restricted on free tier (return 403 "endpoint requires organization ID"):

search — paid plan with organization required
aggregate — paid plan only (no longer free as it was on the legacy API)
certs list — likely same restriction

For search / aggregation / pivoting on a free account, use the Censys web UI at https://platform.censys.io/. The web UI has full access; API access for those endpoints is a paid feature.

For CLI use on free tier, the Python CLI is still useful for per-IP enrichment (host, services, timeline) but won't replace the legacy Search API's free aggregations. If you have a legacy account with CENSYS_API_ID + CENSYS_API_SECRET, the Node CLI may give you better free-tier reach for now.

Credits (free tier)

Each per-IP call on a free account counts against the 250 queries/month quota. Be deliberate.

When to use Censys vs Shodan

For bulk infrastructure mapping, prefer Shodan — its free-membership tier ($49 one-time) gives you proper search access, and count is free. Reserve Censys for high-fidelity per-IP enrichment of indicators you've already found elsewhere.

Response format

source: censys
indicator: <IP or search query>
query_time: <ISO8601>
services:
  - port: <port>
    service: <name>
    banner: <truncated>
certificates:
  - subject_cn: <common name>
    issuer: <issuer>
    sha256: <fingerprint>
autonomous_system:
  asn: <number>
  name: <name>
location:
  country: <country>
  city: <city>
last_updated: <date>

Rate limits

Free tier: 250 queries/month (very limited). Research tier: 10k/month. Paid: unlimited.

Source reliability (Admiralty default)

Default rating for downstream /score-source: A2 (completely reliable, probably true). Censys is an authoritative internet-scan dataset with strong data hygiene.

Operational notes

Quota conservation is critical. Before invoking, consider whether Shodan can answer the question first.
For certificate pivoting specifically, Censys is often the right first call — Shodan has weaker cert data.
Uses HTTP Basic Auth with $CENSYS_API_ID and $CENSYS_API_SECRET.

Related skills

/lookup-shodan — lighter-weight alternative with higher rate limits
/lookup-virustotal — reputation, not reconnaissance
/ip-investigation

Compare before choosing

Computed 9832,606

K-Dense-AI/scientific-agent-skills

dask

Distributed computing for larger-than-RAM pandas/NumPy workflows. Use when you need to scale existing pandas/NumPy code beyond memory or across clusters. Best for parallel file processing, distributed ML, integration with existing pandas code. For out-of-core analytics on single machine use vaex; for in-memory speed use polars.

Computed 9832,606

K-Dense-AI/scientific-agent-skills

medchem

Medicinal chemistry filters for compound triage. Apply drug-likeness rules (Lipinski, Veber, CNS), structural alert catalogs (PAINS, NIBR, ChEMBL), complexity metrics, and the medchem query language for library filtering.

Computed 9832,606

K-Dense-AI/scientific-agent-skills

neurokit2

Use NeuroKit2 to build or audit reproducible research workflows for physiological time-series preprocessing, event/interval analysis, multimodal alignment, variability, and complexity. Trigger when code imports neurokit2 or needs its current APIs, schemas, and method-aware validation—not for diagnosis or device validation.

Computed 986,424

trailofbits/skills

constant-time-analysis

Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

What it does—and where it fits

Best for

Not for

Platform support, with evidence labels

Inspect first. Install second.

What the source asks the agent to do

How to invoke

When to invoke

Basic host + search — Node CLI (legacy Search API)

Full Platform surface — Python CLI (new Censys Platform SDK)

Free aggregation: count hosts running Cobalt Strike by country (no credits)

Static risk signals and limitations

Network access

Network access

Runs scripts

Runs scripts

Why each signal appears

Provenance and original SKILL.md

lookup-censys

When to invoke

How to invoke

Basic host + search — Node CLI (legacy Search API)

Full Platform surface — Python CLI (new Censys Platform SDK)

Free tier reality check (Platform API)

Credits (free tier)

When to use Censys vs Shodan

Response format

Rate limits

Source reliability (Admiralty default)

Operational notes

Related skills

See also

Compare before choosing

dask

medchem

neurokit2

constant-time-analysis