Censys Introduces AI Assistant Skills for Scaling Security Investigations

Summary

Censys introduced nine skills that help AI coding assistants use its cencli to support security investigations, including infrastructure pivots, vulnerability exposure checks, and phishing-site discovery.

Key points

The skills are markdown instructions for AI coding assistants to operate Censys’s open-source cencli, and can be used with several assistant platforms.
Six command-wrapper skills cover CLI subcommands; one provides Censys query-language reference; two guide investigation and analysis workflows.
The investigation skill estimates API calls and offers a lighter pass before starting; standard investigations may use 20–50 calls, with deep pivots sometimes exceeding 100.
Examples show how analysts could investigate suspicious infrastructure, assess whether internet-exposed GitLab properties fall within affected version ranges, and find related phishing pages.
The article advises analysts to count matching hosts before pivots, examine raw responses, document negative findings, and distinguish meaningful signals from provider defaults or noise.
The skills require cencli 1.0 or later. CensEye pivots and certificate history require access to Censys’s Adversary Investigation module.

Article Details

Event Type: Censys introduced nine AI skills that teach coding assistants to use the cencli open-source CLI for security investigations.
Impact: The skills are intended to help security teams automate repeatable investigation tasks, including enrichment, infrastructure pivoting, and monitoring. The article reports no confirmed customer impact or real-world incident resulting from the release.

Indicators of compromise

Type	Indicator	Context
IPV4	`85[.]137[.]243[.]49`	Censys rated this live host suspicious; the article describes it as serving a hidden iframe injector.
SHA256	`50582f8d52e49f549615ec7cd68629b9f939a0cfc5c5408f324b2f1cff070e99`	SHA-256 body hash of the hidden injector page, used to find related instances.