bloodhound-bhce

Operate BloodHound Community Edition v9.2.2 via Decepticon's bhce_* tools — health check, Cypher passthrough, SharpHound ZIP ingest. Replaces the in-house ingest + ESC* post-process pipeline per ADR-0005.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable body with concrete Cypher queries, validation checkpoints, and pinned failure diagnostics. It is well-structured and lean, with only minor conciseness trim opportunities and no bundle-file references to organize.

Suggestions

Move the version (v9.2.2) and release date (2026-06-01) into a small 'Version / compatibility' note so time-sensitive details are isolated from the durable workflow guidance.

Consider extracting the Cypher starter-query library into a references/queries.md file referenced one level deep, keeping the SKILL.md body as a lean overview.

Tighten the 'Why we use BHCE rather than our own ingest' section to the minimum decision rationale needed by the agent.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and assumes Claude's competence (no basics about AD or BloodHound explained), but the 'Why we use BHCE' rationale and time-sensitive version/date info not placed in a deprecated section are minor trim opportunities.	4 / 5
Actionability	Fully executable guidance throughout — a tool table, copy-paste-ready Cypher queries, a parameterized bhce_ingest_zip call, expected result envelopes, and failure diagnostics pinned to file:line references like cmd/api/src/api/auth.go:276-296.	5 / 5
Workflow Clarity	A clear four-step loop (health check, ingest, walk the graph, cross-domain handoff) with explicit validation checkpoints (verify version/principal, check terminal_status, stop-and-report) and a failure-modes section providing error-recovery feedback loops for the batch ingest operation.	5 / 5
Progressive Disclosure	Well-organized into clear sections with no broken or nested references, and no bundle files exist to mis-signal; the inline Cypher query library is reasonably placed but is substantial enough that it could be split into a one-level-deep reference file.	4 / 5
	Total	18 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted description that names concrete actions and a distinct niche, with trigger terms supplied both in the prose and metadata.when_to_use. Its only gap is that the 'when to use' guidance lives in metadata rather than an integrated 'Use when...' clause in the description.

Suggestions

Add an explicit 'Use when ...' clause to the description prose (e.g., 'Use when doing Active Directory attack-path enumeration, ADCS/ESC analysis, or SharpHound ingest') so the trigger guidance is self-contained.

Fold a few high-value trigger terms currently only in metadata.when_to_use (attack path, dcsync, adcs, domain compromise) into the description sentence to improve natural-keyword coverage.

Dimension	Reasoning	Score
Specificity	Names the domain (BloodHound CE v9.2.2 via Decepticon's bhce_* tools) and three concrete actions — 'health check, Cypher passthrough, SharpHound ZIP ingest' — which is comprehensive coverage for this tool's scope.	5 / 5
Completeness	The 'what' is explicit and concrete; the 'when' is provided via equivalent explicit trigger guidance in metadata.when_to_use rather than an integrated 'Use when...' clause in the description itself, so it stops short of a 5.	4 / 5
Trigger Term Quality	Good keyword coverage in the description ('BloodHound', 'Cypher', 'SharpHound', 'ESC*', 'ingest') supplemented by metadata.when_to_use terms, though a few natural variations like 'attack path' and 'dcsync' live only in metadata rather than the description prose.	4 / 5
Distinctiveness Conflict Risk	A clear niche — 'BloodHound Community Edition v9.2.2 via Decepticon's bhce_* tools' — with a named tool family and version, making conflict with other skills minimal.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ad/bloodhound-bhce/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.