AI Skills

censys-ai-skills is a public, Censys-owned repo that contains skills, hooks, helper scripts, tests, and more that leverage the cencli Platform CLI tool. These skills can be added to Claude Code and other AI tools. The skills add the ability to look up assets, run searches, create aggregations, execute pivot analysis jobs, and more.

The censys-ai-skills GitHub repo always contains the most up-to-date information about how to install and use the skills. This document contains general instructions for setup.

Prerequisites

Install and configure cencli prior to installing censys-ai-skills.
- censys-ai-skills requires version 1.0 or newer of cencli.
To use censys-censeye or retrieve certificate history, your organization must have access to the Adversary Investigation module.

Installation

Installation instructions for Claude Code and other tools are provided below. The skills are standalone markdown files that work with any AI coding assistant that supports custom instructions. The Claude Code plugin system handles skill loading and path resolution automatically. Other tools require manual setup.

Run the following commands to install censys-ai-skills.

claude plugin marketplace add censys/censys-ai-skills
claude plugin install censys

Clone the repo.

git clone https://github.com/censys/censys-ai-skills.git

Add individual skill files in your editor's instruction system.

Editor	Instruction file	Include syntax
Cursor	`.cursorrules` or `.cursor/rules/*.md`	Paste skill content or reference the file path
Windsurf	`.windsurfrules`	Paste skill content
Cline	`.clinerules`	Paste skill content
Examples include:

skills/censys-search/SKILL.md and skills/censys-view/SKILL.md for basic queries.
skills/censys-cenql/SKILL.md for query syntax reference.
skills/censys-investigate/SKILL.md for full investigation methodology.

Clone the repo into your project or reference it from your agent's system prompt.

To clone the repo, run the following command.

git clone https://github.com/censys/censys-ai-skills.git

To add skills to your agent's system prompt, add something like the following. Each skill folder is self-contained with its own SKILL.md and references/ directory.

# Example: include in an AGENTS.md or system prompt
@censys-ai-skills/skills/censys-search/SKILL.md
@censys-ai-skills/skills/censys-cenql/SKILL.md

Notes for non-Claude Code harnesses

Path variables: Skills reference files using ${CLAUDE_SKILL_DIR} and ${CLAUDE_PLUGIN_ROOT}. These are Claude Code-specific. On other harnesses, resolve them relative to the skill folder and repo root respectively. The model can typically infer the correct paths from context.
Scripts: The scripts/ directory contains shell helpers censys-count.sh, censys-export.sh, censys-to-sqlite.sh). These work on any harness with bash access. Reference them by their path relative to the repo root.
Hooks: The hooks/ directory provides advisory warnings for Claude Code's hook system. Other harnesses can ignore this directory.
Skill content: The methodology, CenQL syntax, CLI flags, and operational caveats in each skill are plain markdown. They work as reference material regardless of the harness.

Skills included in the repo

The following skills and tools are included in the censys-ai-skills repo.

Layer	Skills	Description
Command skill	`censys-search`	Search Censys data with CenQL queries.
Command skill	`censys-view`	View (look up) hosts, certificates, and web properties.
Command skill	`censys-aggregate`	Aggregate results by field. Equivalent to the Report Builder.
Command skill	`censys-enrich`	Credit-free IP enrichment for SOC triage.
Command skill	`censys-censeye`	Pivot analysis with rarity bounds.
Command skill	`censys-timeline`	Temporal analysis, change detection, and attribution boundaries.
Reference tool	`censys-cenql`	Query language syntax, field paths, operators, known noise. Consulted by other skills when constructing queries.
Methodology and analysis	`censys-investigate`	Investigation methodology, pivoting patterns, and multi-step workflows.
Methodology and analysis	`censys-analyze`	Post-retrieval analysis: jq recipes, SQLite, batch certs, and cross-referencing.

Skills reference each other via cross-reference sections. A methodology skill like censys-investigate will call out to censys-search for pivot queries, censys-timeline for historical analysis, and censys-cenql for field path lookups. The command wrappers are self-contained and can be used independently for one-off tasks.

Censys Credit costs

Each skill wraps one or more cencli subcommands. Most cencli commands will deduct at least one credit from your balance. More credits are consumed if pagination is involved. The censys-investigate tool can invoke 10 to 50 or more calls depending on input. Reference the documentation in GitHub for more information on credit estimates and how to limit credit expenditure.