Active Directory exploitation — BloodHound analysis, Kerberoasting, AS-REP Roasting, AD CS abuse, DCSync, Golden Ticket, Constrained Delegation.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/ad/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete, executable commands across all major AD attack techniques, and it includes a useful Decision Gate for branching on outcomes. Its weaknesses are redundancy between the Quick Reference and detailed sections, missing per-step validation checkpoints for batch operations, and a monolithic structure that underuses the bundled reference file.

Suggestions

Remove the duplication between the 'Quick Reference' section and sections 1-7, keeping either the compact cheatsheet or the detailed sections rather than both.

Add explicit validation checkpoints within each technique (e.g., verify Kerberoast/AS-REP hash files are populated before cracking; confirm the DCSync output file contains expected accounts before extracting krbtgt).

Move the detailed per-technique command reference into references/attack-paths.md and keep SKILL.md as a leaner overview that points to it, improving progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Commands are concrete rather than padded with concepts Claude already knows, but the 'Quick Reference' section duplicates commands fully expanded in sections 1-7 (e.g., BloodHound collection, Kerberoast, AS-REP, DCSync, AD CS enum), so it could be tightened.	2 / 3
Actionability	Provides fully executable commands with concrete flags and placeholders (e.g., impacket-GetUserSPNs, certipy req, mimikatz kerberos::golden, hashcat -m 13100), copy-paste ready and matching the anchor for executable code/commands.	3 / 3
Workflow Clarity	Each technique is sequenced (enumerate -> extract -> crack/use) and the Decision Gate provides outcome branching, but per-step validation checkpoints are absent; batch operations like DCSync and mass Kerberoast cap workflow clarity at 2 per the scoring notes.	2 / 3
Progressive Disclosure	references/attack-paths.md is clearly signaled at one level deep with a when-to-read note and the file exists, but the full command reference is inline in SKILL.md (~415 lines) rather than a lean overview pointing to the reference, so content that should be separate is inline.	2 / 3
	Total	9 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and rich in natural trigger terms, but lacks an explicit 'when to use' clause, leaving the invocation trigger implied rather than stated. Adding a 'Use when...' sentence would raise completeness to the top level.

Suggestions

Append an explicit 'Use when...' clause to the description (e.g., 'Use when the user requests Active Directory exploitation such as kerberoasting, AS-REP roasting, DCSync, golden ticket creation, AD CS abuse, or constrained delegation abuse').

Surface the trigger terms currently buried in metadata.when_to_use directly into the description so the 'when' guidance is visible at the description level rather than only in metadata.

Dimension	Reasoning	Score
Specificity	Lists seven concrete techniques ('BloodHound analysis, Kerberoasting, AS-REP Roasting, AD CS abuse, DCSync, Golden Ticket, Constrained Delegation'), matching the anchor for multiple specific concrete actions rather than vague language.	3 / 3
Completeness	Clearly answers 'what' but has no 'Use when...' clause or equivalent explicit trigger guidance, which per the judging guidelines caps completeness at 2; the 'when' is only implied.	2 / 3
Trigger Term Quality	Uses the natural terms practitioners actually say ('Kerberoasting', 'DCSync', 'Golden Ticket', 'BloodHound', 'Active Directory exploitation'); good domain coverage rather than abstract jargon.	3 / 3
Distinctiveness Conflict Risk	A clear niche (Active Directory exploitation) with distinct technique-specific triggers that are unlikely to overlap with or fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/ad/SKILL.md
Commit: e34afba

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.