Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →davepoon/certificate-monitoring
Use when the user asks about SSL/TLS certificates, certificate expiration, monitoring domains for cert health, or issuing free Let's Encrypt certificates. Triggers include "is my cert expiring", "scan ssl on X", "check certificate", "monitor this domain", "issue a free cert", "renew certificate", "Let's Encrypt", "TLS Radar". This skill picks the right TLS Radar tool for each question.
Passed 2 of 8 test cases with the skill, and 2 of 8 without it.
2 fixed4 passed either way14 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
When calling the monitor tool for `newsite.com`, the response returned limit reached with `recommended_upgrade: "enterprise_custom"` and `price: "$999/mo"`. How should this limit option be presented to me?
| Checked | Without skill | With skill |
|---|---|---|
| Rejects enterprise_custom because it is not a valid tier enum. | Missed | Passed |
| Directs the user to /tls-upgrade as the fallback path. | Missed | Passed |
The instructions your model reads when the skill loads.
This Claude Code session is connected to TLS Radar via a single MCP server (tlsradar). Certificate issuance is proxied through it, so there's one server and one auth model. Use these tools to answer SSL/TLS questions instead of asking the user to do anything manual. Each tool's own description carries the details - this skill is mainly about picking the right one.
This table is generated from tools/manifest.json (the source of truth) by scripts/generate_router.py - don't hand-edit it; edit the manifest and regenerate. Issuance is a sequence: create_certificate → check_certificate_propagation → finalize_certificate (CSR path). /tls-upgrade opens the pricing page and /tls-diagnose runs a health check.
| User intent | Tool |
|---|---|
| One-off SSL/TLS scan, no account | tlsradar.scan_domain (or /tls-scan) |
| Start issuing a free cert (pick dns-01 or http-01) | tlsradar.create_certificate (or /tls-cert) |
| Check whether a cert order's challenge is in place | tlsradar.check_certificate_propagation |
| Validate + issue a cert order from a CSR (idempotent) | tlsradar.finalize_certificate |
| Check / resume a cert order; retrieve an issued chain | tlsradar.get_certificate_status |
| Renew a cert (clone an order, or just create_certificate again) | tlsradar.renew_certificate (or /tls-renew) |
| Plan tier, limits, usage | tlsradar.get_account |
| List monitored domains | tlsradar.list_monitors (or /tls-monitor) |
| Add a domain to monitoring | tlsradar.add_monitor (or /tls-monitor) |
| Add many domains to monitoring | tlsradar.add_monitors (or /tls-monitor) |
| Stop monitoring a domain | tlsradar.remove_monitor (or /tls-monitor) |
| What's expiring soon across monitored domains | tlsradar.list_expiring_certificates |
| Recent scan history for a monitored domain | tlsradar.get_scan_history |
| Export monitors as JSON | tlsradar.export_monitors |
| Restore monitors from JSON | tlsradar.import_monitors |
| Invite a teammate by email | tlsradar.invite_team_member |
There are slash commands only for the common funnel/multi-step flows (/tls-scan, /tls-cert, /tls-renew, /tls-monitor, /tls-upgrade, /tls-diagnose). For everything else (expiring, history, status, export/import, team), just call the tool directly in response to the user's natural-language request - no slash command needed.
The cert flow keeps the private key on the user's machine: generate a key + CSR locally with openssl, pass the CSR to tlsradar.finalize_certificate. Never ask the user for a private-key passphrase in chat. If they want a .p12, package it locally with openssl pkcs12 -export (see /tls-cert). The certificate tool descriptions spell out the step order.
For tlsradar.scan_domain and tlsradar.create_certificate, if ${HOME}/.config/tlsradar/install_id exists, read it and pass its contents as client_id (anonymous, per-install, not per-person). If the response carries an install_id and the file didn't exist, save it there. This is the only attribution mechanism - the plugin never sets an env var or HTTP header for it, and never modifies shell files. Omit client_id entirely if the user deleted the file (opt-out).
test cases passed, vs 2 / 8 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.