adcs-esc1

Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, concise offensive guide with executable commands and a clear numbered workflow. The main gaps are the absence of explicit verify-before-proceed feedback loops around destructive DA operations and the lack of any progressive-disclosure structure for reference material.

Suggestions

Add explicit validation checkpoints before destructive steps, e.g. after 'certipy auth' verify the ccache/NT hash was obtained before running secretsdump.py or psexec.py, with a fallback if PKINIT auth fails.

Move the ESC variants quick-ref table, CVSS, and defender remediation into a separate reference file (e.g. ESC-VARIANTS.md) linked from the body, keeping the core ESC1 chain lean.

Add a brief verification step that confirms the requested cert carries the spoofed UPN (e.g. inspect the PFX subject) before attempting authentication.

Dimension	Reasoning	Score
Conciseness	The body is lean and tactical — code blocks, a compact checklist, and a quick-ref table carry the weight, and prose like the PKINIT NT-hash detail adds ADCS-specific knowledge Claude would not reliably know rather than padding.	3 / 3
Actionability	Commands are fully executable with consistent placeholder conventions (USER@DOM, DC_IP, VULNERABLE_TEMPLATE) across certipy find/req/auth, secretsdump.py, psexec.py, and kg_add_node — copy-paste ready.	3 / 3
Workflow Clarity	The six-step sequence is clearly numbered and step 2 gates on a vulnerability checklist, but there are no explicit validation/verification checkpoints before destructive steps (DCSync, psexec shell), which caps clarity at 2 per the feedback-loop guideline.	2 / 3
Progressive Disclosure	Sections are well-organized but the skill is a monolithic single file with no one-level-deep references; reference-style material (the ESC variants table, CVSS, and defender remediation) is inline rather than split out for discovery.	2 / 3
	Total	10 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted description for a narrow offensive-security skill, with strong trigger terms and low conflict risk. Its only weakness is the absence of an explicit 'Use when...' clause, which leaves the 'when to use' guidance implied rather than stated.

Suggestions

Add an explicit 'Use when ...' clause, e.g. 'Use when assessing ADCS for ESC1 misconfigurations, template misconfiguration review, or when the user mentions certipy, PKINIT, or SAN-based impersonation.'

Surface a few more natural trigger variations (e.g. 'certificate template', 'ENROLLEE_SUPPLIES_SUBJECT', 'PKINIT') so users phrasing the request differently still match.

Dimension	Reasoning	Score
Specificity	Lists a concrete action chain — 'Exploit ... ESC1', 'vulnerable template allows arbitrary SAN', 'enabling user impersonation up to domain admin' — naming specific capabilities rather than vague language.	3 / 3
Completeness	It clearly answers 'what' (exploit ESC1 for user impersonation to DA) but lacks any explicit 'Use when...' trigger clause, which caps completeness at 2 per the judging guidelines.	2 / 3
Trigger Term Quality	Natural terms a user would say when they need this skill are present: 'Active Directory Certificate Services', 'ADCS ESC1', and 'domain admin' give good coverage of the niche vocabulary.	3 / 3
Distinctiveness Conflict Risk	The 'ADCS ESC1' / 'Active Directory Certificate Services' niche is highly specific and unlikely to trigger for the wrong skill.	3 / 3
	Total	11 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ad/adcs-esc1/SKILL.md
Commit: 5e34a6d

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.