ad-ntlm-relay

NTLM relay deep-dive — `ntlmrelayx` configuration matrix (SMB, LDAP, LDAPS, HTTP, RPC, IMAP, MSSQL), SMB-signing bypass, target selection (DC for DCSync, ADCS for cert, LAPS reader for cleartext), session relay vs cracking trade-off, multi-relay (forward auth from one victim to many).

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/ad/ntlm-relay/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable reference for NTLM relaying with excellent conciseness and concrete commands. The main gap is the absence of validation/verification checkpoints in destructive relay workflows, which caps workflow clarity.

Suggestions

Add explicit validation checkpoints after each destructive chain (e.g., verify the S4U2Proxy TGS grants access before declaring takeover; confirm msDS-KeyCredentialLink was written before auth-as-victim).

Inline or briefly summarize the ADCS relay chain instead of only deferring to the ad-certipy-esc-chain skill, so the primary relay-to-cert path is self-contained.

Consider moving the detailed per-chain command recipes and the mitigation/bypass table into reference files to improve progressive disclosure for a skill of this size.

Dimension	Reasoning	Score
Conciseness	Lean and operational; assumes Claude's knowledge of AD/NTLM concepts with no 'what is NTLM' padding, and every line (matrices, commands, OPSEC notes) earns its place.	5 / 5
Actionability	Provides copy-paste-ready, executable commands with real flags across the common chains; the ADCS chain is deferred to a sibling skill rather than shown inline, a minor gap.	4 / 5
Workflow Clarity	Chains are sequenced (listener -> coerce -> S4U2Proxy), but this destructive/batch offensive skill has no validation checkpoints (e.g., confirm relay success, verify the ticket grants DA), so the destructive-operations cap of 3 applies.	3 / 5
Progressive Disclosure	Well-organized single file with clear section headers and a one-level-deep external references list; no bundle files exist, but some per-chain recipes and the mitigation table could arguably split into reference files, and cross-skill pointers are textual rather than linked.	4 / 5
	Total	16 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, highly specific description that crisply enumerates the skill's offensive NTLM-relay capabilities. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness.

Suggestions

Append an explicit trigger clause such as 'Use when relaying captured NTLM authentication, configuring ntlmrelayx, or planning SMB-signing-aware target selection.'

Add a couple of plain-language phrasings (e.g., 'relay NTLM authentication', 'MITM NTLM') alongside the tool/protocol jargon to broaden natural trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities with comprehensive coverage: 'ntlmrelayx configuration matrix (SMB, LDAP, LDAPS, HTTP, RPC, IMAP, MSSQL)', 'SMB-signing bypass', 'target selection (DC for DCSync, ADCS for cert, LAPS reader for cleartext)', and 'multi-relay'.	5 / 5
Completeness	Has a clear and detailed 'what', but no explicit 'Use when...' or equivalent trigger guidance; the 'when' is only weakly implied, so the missing-trigger-clause cap of 3 applies.	3 / 5
Trigger Term Quality	Strong keyword coverage including natural tool/protocol terms a user would say ('ntlm relay', 'ntlmrelayx', 'smb signing', 'ldap', 'adcs', 'mssql', 'impacket'), but slightly jargon-heavy and missing some common plain phrasings.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (NTLM relay via ntlmrelayx) with distinct triggers and minimal overlap risk with unrelated skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ad/ntlm-relay/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.