> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Introducing Censys CLI Skills: AI-Assisted Investigations at Scale - URL: https://f4n6.co.uk/security-feed/introducing-censys-cli-skills-ai-assisted-investigations-at-scale/ - Published: 2026-09-24T18:32:44.000Z - Updated: 2026-09-24T18:32:44.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Censys published a blog post on 24 September 2026 announcing nine markdown "skills" that teach an AI coding assistant to drive cencli, the vendor's open source command line client, and shipped them as a Claude Code plugin. The post is a product and methodology announcement, not a report of an intrusion, and it carries no verified threat intelligence: the four investigations it walks through are explicitly hypothetical examples. The audience is SOC, CTI, vulnerability management and brand protection teams, which is the same population that runs triage inside EMEA financial services. Direct risk to a client is low. The operational risk sits in adopting AI-driven query automation without governance over API credentials, query cost, and the analyst's ownership of the confidence call. Two of the worked examples do describe reusable detection patterns, a Mythic default TLS certificate subject and a hidden iframe injector, that are worth testing whether or not the tooling is adopted. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The item is a vendor tooling announcement; the only incident-shaped content is a hypothetical GitLab CVE walkthrough that describes no incident at any client and no third-party dependency a client has taken on. Mapping DORA Art. 28 or NIS2 Art. 21(2)(d) to a blog post about an open source CLI would be a generic match that fits every advisory and changes nothing a client must do. ## 3\. Technical analysis & attack chain The finding is that Censys has released an investigation methodology as machine-readable instructions, and that the methodology's worked examples contain two detection patterns worth extracting. Nothing in the post describes an observed intrusion. ### What the skills are and how they load A skill is a markdown file with instructions. Nine ship in the release, in three layers. Six are command wrappers, one per cencli subcommand: search, view, aggregate, enrich, censeye, timeline. Each turns a request into the right command, flags and output handling, and is self-contained enough for one-off lookups. One is a reference skill, censys-cenql, covering query syntax, field paths, operators and a catalogue of known noise that produces wasted investigations. The remaining skills are investigative: censys-investigate runs a fixed baseline and then branches through decision trees, and censys-analyze uses jq and SQLite to pull values out of deeply nested JSON, where a single host record can run to hundreds of lines. Only a skill's frontmatter description sits in the assistant's context until a trigger phrase matches. Each description ends by naming the skills it is not, which is the guard against an assistant kicking off a fifty-call investigation from an ambiguous prompt. The investigation skill confirms the target and the estimated API call count before it runs and offers a lighter pass; a standard run is 20 to 50 calls, and deep pivoting can pass 100. Installation and prerequisites, as given in the source: ``` brew install --cask censys/tap/cencli censys version # should print JSON with a 1.x version censys auth login # OAuth, interactive censys config auth add # or a PAT, non-interactive censys config org-id # needed for enrich claude plugin marketplace add censys/censys-ai-skills claude plugin install censys ``` cencli 1.0 or later is required, from Homebrew or a release binary. The source states that `pip install censys` installs the legacy Python wrapper and is the incorrect command. CensEye pivots and certificate history require Adversary Investigation module access; everything else runs on any account with API privileges. The files are plain markdown and the source claims they work with Cursor, Windsurf, Cline, Codex or any harness that takes custom instructions, though the plugin packaging is Claude Code specific. ### The data model the skills drive Censys scans the Internet, resolves DNS, and applies vulnerability and threat labels. Four object types are searchable: hosts (IP, ports, services, software versions, OS, TLS, certificates, known vulnerabilities, ASN, geography), web properties (hostname and port serving HTTP, with titles, response bodies and their hashes, headers, favicons, redirect chains, detected web software), certificates (subject, issuer, names, validation level, CT records), and names (an FQDN with its A, AAAA, CNAME, MX, NS, SOA and TXT records, each stamped with first and last seen). Three operations sit on top: pivot from one observable to the rest of the infrastructure, rescan to confirm a fact is still true before writing a rule around it, and monitor a pattern over time through a Censys Collection. ### Guardrails the source encodes The population count runs before any pivot: zero to five matching hosts is treated as unique, twenty-five or more as broad. The source notes the obvious ways to count are wrong, because asking for one page of one result returns a record and no total, and summing a breakdown's buckets undercounts whatever fell off the capped list. Negative findings are to be documented with the same rigour as positive ones, since roughly half of the example investigations went into proving a signal was not operator-specific. One caveat the source raises: some fields only index services that are currently listening, so zero hits can mean "not currently visible" rather than "unique to this host", and the field must be checked as populated before uniqueness is claimed. The confidence call, high, moderate, low or unrelated, stays with the analyst, as does the judgement of whether a signal is tradecraft or provider noise. Three failure modes are named. An agent put AnyDesk on port 7070 into an operator profile when the seed host never ran AnyDesk. A certificate CN shared by 3,475 hosts was called operationally significant when it was a hosting-provider image artefact. And in one session more than fifteen queries went into banner and body hash pivots while a globally unique meta description sat unsearched in the response body. ### Worked example: Mythic default certificate An EDR flags a workstation making an outbound TLS connection to a VPS on port 7443\. Enrichment returns the certificate, whose subject organisation reads O=Mythic. Mythic is an open source, plugin-based command-and-control framework with a web operator UI, used by red teams on authorised engagements and by threat actors on unauthorised ones, which the source notes makes it interesting rather than conclusive. Censys ARC profiled 115 hosts carrying O=Mythic or O=Mythic C2 as the certificate subject organisation; that is the installer default and most operators never change it. The pivot is `host.services.cert.parsed.subject_dn: "O=Mythic"`. ### Worked example: 689-byte hidden iframe injector A report arrives with twelve indicators, most already sinkholed, parked or reassigned. One is still live: 85.137.243.49, four services (SSH on 22, HTTP on 80, nginx on 887 and 888 both returning 403), a Hong Kong hosting provider, one DNS name, Censys score 0.66 and labelled suspicious. The port 80 response body is 689 bytes with the title "Test Page". It builds an iframe, sets it to one pixel square at one percent opacity, positions it absolutely at `left: -9999px`, points it at `frame.html` with a random query string to defeat caching, and appends it to the document. A developer comment in Russian was left in the source. A visitor sees nothing; a scanner sees a test page. The IP is disposable, the injector is a build, and builds get reused. Pivoting on the body hash `web.endpoints.http.body_hash_sha256 = "50582f8d52e49f549615ec7cd68629b9f939a0cfc5c5408f324b2f1cff070e99"` returns 231 results, the shape of a shared kit deployed across infrastructure that does not all belong to one person. A second constraint narrows it: the SSH host key, generated once at install and unique per machine, returns two hosts, only one of which serves the injector. Two machines sharing host key material indicates a cloned disk image or a shared template, and the pivot produced a host that was not in the original report. ### Worked example: version-scoped exposure counting A CISO forwards a news article about CVE-2026-85706, described as a path traversal flaw in the repository commits API of self-managed GitLab, CVSS 10.0, unauthenticated arbitrary file read. The source states GitLab shipped fixes on 10 September, Internet-wide probing started the next morning, and CISA added it to the Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of 14 September. Affected branches are given as 18.7 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1; fixed in 19.1.8, 19.2.6 and 19.3.2\. A query for all GitLab web properties returns 208,000; narrowing to the affected ranges returns about 32,800\. The point of the example is the pair of sentences, not the dashboard. ### Worked example: brand impersonation pivot A customer forwards a phishing login page wearing the brand. The pivot order is favicon, then response body, then certificate, each narrowing the next, because a favicon is a file the operator copied and rarely changes, a body hash breaks on any edit, and the certificate shows issuer and coverage. The query shape is the favicon hash AND `web.labels.value = "LOGIN_PAGE"` AND NOT `web.labels.value = "DEFAULT_LANDING_PAGE"` AND the client's own hostnames excluded. ### Confidence caveat on all of the above Every investigation in this post is a hypothetical walkthrough written by the vendor. CVE-2026-85706, its CVSS 10.0, its KEV listing and the 14 September deadline are the source's claims and nothing more; Adverse Trace has not verified that the CVE exists, that it is in KEV, or that any of the IPs, hashes or certificate subjects correspond to live adversary infrastructure. The whole item is single-sourced to Censys. Do not blocklist on the strength of this advisory, and do not treat the GitLab version ranges as a patch instruction until the CVE is independently confirmed. ## 4\. Mitigation & containment **P1 (within 24 hours).** If any team has installed or is evaluating the Censys skills, confirm the credential model before anything else. cencli authenticates either interactively through `censys auth login` (OAuth) or non-interactively through `censys config auth add` (a personal access token). Confirm which was used, that the token is scoped to the minimum required privileges, and that it is not captured in shell history, agent transcripts or shared runbooks. Confirm whether the account carries Adversary Investigation module access, because CensEye pivots and certificate history depend on it and will fail or degrade silently without it. **P2 (within 72 hours).** Deploy the two detection rules in §6 to the telemetry that can carry them. For TLS, alert on certificate subject organisation containing O=Mythic or O=Mythic C2; the source reports 115 hosts carrying the installer default, so expect authorised red team hits and --- [Read the original source →](https://censys.com/blog/introducing-censys-cli-skills/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*