ad-overview

Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a tight, actionable routing catalog with concrete commands and clean progressive disclosure. Its main gap is workflow clarity: the multi-step attack pipeline lacks explicit validation checkpoints between dependent steps.

Suggestions

Add validation checkpoints between dependent steps (e.g., confirm the BloodHound zip ingested successfully before running dcsync_check / kg_query).

Add a brief error-recovery note for likely failures (ingestion errors, empty query results, certipy auth failures) so Claude knows how to retry.

Dimension	Reasoning	Score
Conciseness	The body is lean — a playbooks table, a numbered workflow, and a crown-jewels block — with no concept explanations Claude already knows; every line earns its place.	3 / 3
Actionability	Concrete executable invocations are given throughout ('bash("bloodhound-python -u user -p pass -d DOMAIN -c all --zip")', 'bh_ingest_zip("/workspace/bh.zip")', 'kg_query(kind="user")', 'certipy find …', 'kg_add_node(...)'), copy-paste ready.	3 / 3
Workflow Clarity	A clear 7-step sequence exists with one conditional checkpoint (step 3), but there are no explicit validation/verification steps or error-recovery feedback loops for the dependent multi-step pipeline.	2 / 3
Progressive Disclosure	As a simple overview catalog it points one level deep to seven playbook SKILL.md files in a well-signaled table, with clean sections and no nested references.	3 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and rich in natural trigger terms, but it omits an explicit 'Use when…' usage clause, leaving the 'when' only implied. Adding a trigger clause would raise completeness to the top anchor.

Suggestions

Append an explicit trigger clause such as 'Use when the user wants to compromise an Active Directory domain — BloodHound/Kerberoasting/DCSync/LAPS/ADCS work' to satisfy the completeness 'when' requirement.

Include common phrasings users might say ('domain admin', 'roast service accounts', 'dump krbtgt') to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction' — rather than vague language, matching the multiple-specific-actions anchor.	3 / 3
Completeness	It clearly states what the skill does but lacks any 'Use when…' clause or equivalent explicit trigger guidance, which per the guidelines caps completeness at 2.	2 / 3
Trigger Term Quality	BloodHound, Kerberoasting, ADCS, DCSync, and LAPS are the exact natural terms a user would say when requesting AD attack work, giving good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	'Active Directory attack lane' paired with named techniques carves a clear niche with distinct triggers unlikely to conflict with other skills.	3 / 3
	Total	11 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ad/SKILL.md
Commit: 5e34a6d

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.