bloodhound-query

BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/ad/bloodhound-query/SKILL.md

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, highly actionable playbook with executable commands and a strong query table, weakened only by the absence of explicit validation checkpoints around ingest and the promote/batch step, and by being a single monolithic file rather than a tiered reference structure.

Suggestions

Add explicit validation checkpoints: after ingest, verify node/edge counts before querying (e.g., 'Run kg_query(kind="count") and confirm User/Computer nodes exist before running attack-path queries'), and after promoting a path, confirm the attack_path node was added.

Consider splitting the canonical Cypher query table and the CVSS/impact table into a one-level-deep reference file (e.g., CYPHER_QUERIES.md) so SKILL.md stays a lean overview pointing to detail.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence — it never explains what BloodHound, Active Directory, or Cypher are, and every table and command earns its place, matching the 'lean and efficient; every token earns its place' anchor.	3 / 3
Actionability	It provides copy-paste-ready commands (bloodhound-python invocation, bh_ingest_zip, bh_cypher) and a full table of executable Cypher queries; placeholders like USER/PASS and <owned-user> are appropriately parameterized rather than vague pseudocode, matching the 'fully executable; copy-paste ready' anchor.	3 / 3
Workflow Clarity	The Collect → Ingest → Query → Prioritize → Promote sequence is clear and section 6 provides failure fixes, but there is no explicit validation checkpoint after ingest or before/after the batch 'promote findings' step, so per the feedback-loops scoring note workflow clarity is capped at 2.	2 / 3
Progressive Disclosure	The content is well-organized into clearly headed sections with tables and no nested references, but it is a monolithic single-file body (~75 lines) rather than an overview pointing to one-level-deep detail files, so it lands at 'some structure but content that should be separate is inline'.	2 / 3
	Total	10 / 12 Passed

Description

67%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-niched description that clearly states what the skill does, but it lacks an explicit 'Use when...' trigger clause, leaving the 'when to use' guidance only implied and capping completeness.

Suggestions

Add an explicit 'Use when ...' clause naming natural user triggers (e.g., 'Use when enumerating AD attack paths after a BloodHound/SharpHound collector dump, or when the user mentions BloodHound, Cypher, kerberoasting, or domain dominance paths').

Broaden trigger-term coverage with common phrasings a user might say, such as 'shortest path to Domain Admin', 'kerberoastable users', or 'unconstrained delegation'.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions — 'BloodHound ingestion', 'canonical Cypher queries', 'AD attack-path enumeration', and 'promotes findings into the knowledge graph' — matching the anchor for several specific concrete actions rather than the level-2 'some actions' anchor.	3 / 3
Completeness	The 'what' is strong (ingestion, queries, promotion), but the 'when' is only implied via 'Run after collector dumps zip' with no explicit 'Use when...' trigger clause, which per the judging guidelines caps completeness at 2 rather than 3.	2 / 3
Trigger Term Quality	Terms like 'BloodHound', 'Cypher queries', and 'AD attack-path' are natural for this niche, but coverage of common variations is limited (no 'Use when...' keyword list in the description) so it sits at 'some relevant keywords but missing common variations' rather than full coverage.	2 / 3
Distinctiveness Conflict Risk	The BloodHound/Active-Directory/Cypher niche is sharply defined and unlikely to trigger for unrelated skills, matching the 'clear niche with distinct triggers' anchor.	3 / 3
	Total	10 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ad/bloodhound-query/SKILL.md
Commit: e34afba

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.