---
title: "Domain Intelligence - Passive OSINT - Air Market"
description: "When you need to learn about a domain, for a security check or an investigation, this gathers what is already out there: its subdomains, its SSL certificates, its registration record and its DNS. It…"
canonical: "https://airmarket.ai/app/domain-intel"
---

[Air Market](/) / [Security](/category/security) / Domain Intelligence - Passive OSINT

Skill by [Nous Research](/@nousresearch)

# Domain Intelligence - Passive OSINT

See what public records reveal about a domain

## What this does

When you need to learn about a domain, for a security check or an investigation, this gathers what is already out there: its subdomains, its SSL certificates, its registration record and its DNS. It works passively, so it looks things up rather than probing the target.

### Top 3 things it does for you

- Find a domain's subdomains
- Look up who registered a domain
- Check a site's SSL certificates

## Information

**Domain Intelligence - Passive OSINT at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Nous Research](/@nousresearch) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Languages | en |
| Version | 1.0.0 |
| Size | 20 KB |
| Licence | MIT |
| Repository | [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent/tree/7113a69248ffe831e4165247553e0f3668c0260a/optional-skills/research/domain-intel) |
| GitHub stars | 261,931 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Domain Intelligence - Passive OSINT and flagged nothing. AIR's verdict: **safe**.

**What Domain Intelligence - Passive OSINT's check was run against**

|  |  |
| --- | --- |
| Commit | 7113a69248ffe831e4165247553e0f3668c0260a |
| Content hash | 24e6dd1d5a73e562a7b7df613f39a24cd59c1829b71038da50b85fa8a1f504cc |
| Files read | [Browse the files at this exact commit](https://github.com/NousResearch/hermes-agent/blob/7113a69248ffe831e4165247553e0f3668c0260a/optional-skills/research/domain-intel/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Domain Intelligence - Passive OSINT](/security/domain-intel)

## About Domain Intelligence - Passive OSINT

Domain Intelligence does passive reconnaissance on a domain. It covers subdomains, SSL certificates, WHOIS registration records and DNS.

## What's inside

- SKILL.md - instructions
- scripts/domain_intel.py - script

## Questions

### Is Domain Intelligence - Passive OSINT safe to install?

AIR scanned this exact version of Domain Intelligence - Passive OSINT and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 7113a69248ff, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/domain-intel.

### How do I install Domain Intelligence - Passive OSINT?

Open https://airmarket.ai/app/domain-intel on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/NousResearch/hermes-agent/tree/7113a69248ffe831e4165247553e0f3668c0260a/optional-skills/research/domain-intel. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Nous Research](/@nousresearch)

---

Canonical URL: <https://airmarket.ai/app/domain-intel>