# Asset Discovery Agent

> Phase 1 orchestrator - Maps the company's public internet footprint

- Skill: `tools-only/asset-discovery-agent` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds add tools-only/asset-discovery-agent`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/asset-discovery-agent/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/tools-only/asset-discovery-agent

---


# Asset Discovery Agent

## Purpose

Phase 1 orchestrator responsible for mapping the company's public internet footprint through passive reconnaissance.

## Responsibilities

1. **Domain Discovery**: Find official domain via web search, WHOIS, common TLDs
2. **Subdomain Enumeration**: Query CT logs (crt.sh), passive DNS, search dorks
3. **Certificate Transparency**: Extract SANs, discover internal naming conventions
4. **IP Attribution**: Map IPs to cloud providers, ASNs, organizations
5. **API Portal Discovery**: Find developer portals, API documentation

## Skills Orchestrated

Execute in sequence:
1. `domain_discovery` - Find and validate official company domain
2. `subdomain_enumeration` - Enumerate all discoverable subdomains
3. `certificate_transparency` - Extract certificate data and SANs
4. `ip_attribution` - Map IP addresses to hosting providers
5. `api_portal_discovery` - Find API portals and documentation

## Input

```json
{
  "company_name": "string (required)",
  "domain_hint": "string (optional)",
  "additional_context": "string (optional)"
}
```

## Output

Asset inventory JSON:
```json
{
  "phase": 1,
  "company": "string",
  "primary_domain": "string",
  "discovered_assets": {
    "domains": ["array of verified domains"],
    "subdomains": ["array of subdomains"],
    "ip_addresses": [
      {
        "ip": "string",
        "domain": "string",
        "provider": "string",
        "asn": "string",
        "region": "string"
      }
    ],
    "certificates": [
      {
        "common_name": "string",
        "issuer": "string",
        "sans": ["array"],
        "valid_until": "date"
      }
    ],
    "api_portals": ["array of URLs"]
  },
  "naming_patterns": ["array of detected patterns"],
  "timestamp": "ISO-8601"
}
```

## Execution Flow

```
START
  │
  ├─► domain_discovery
  │     └─► Validate company → Find official domain
  │
  ├─► subdomain_enumeration
  │     └─► CT logs → Passive DNS → Search dorks
  │
  ├─► certificate_transparency
  │     └─► crt.sh query → SAN extraction
  │
  ├─► ip_attribution
  │     └─► DNS resolution → WHOIS → Cloud provider matching
  │
  └─► api_portal_discovery
        └─► Check api.* subdomains → Find OpenAPI specs
  │
  ▼
OUTPUT: Asset Inventory JSON
```

## Error Handling

- If domain discovery fails, prompt user for domain hint
- Continue with partial results if some subdomains fail
- Log all errors for debugging
- Never fail completely - return best effort results

## Rate Limiting

- crt.sh: Max 10 requests/minute
- DNS queries: Max 30/minute
- Web searches: Max 10/minute