bloodhound-query

BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

83%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exceptionally actionable and token-efficient playbook with a clear step sequence; the main gap is the absence of explicit validation/verification checkpoints between the batch write operations (ingest, promote), which caps workflow clarity.

Suggestions

Add a validation checkpoint after ingest (e.g., verify expected node counts with a quick Cypher count query) before running enumeration queries.

Add a verification step after plan_attack_chains / kg_add_node promotion (e.g., confirm the attack_path node exists and is linked to the crown-jewel target) so the batch write can be confirmed before reporting.

Consider moving the 12-row canonical-query table into a references/ file (e.g., QUERIES.md) to keep SKILL.md as a leaner overview, which would also let progressive disclosure reach 5.

Dimension	Reasoning	Score
Conciseness	Lean and efficient throughout — code blocks and tables only, no padding explaining what BloodHound/AD/Cypher are; assumes Claude's competence and every line earns its place, matching the 5 anchor.	5 / 5
Actionability	Fully executable, copy-paste-ready guidance: the bloodhound-python collector command, bh_ingest_zip, a 12-row table of canonical Cypher queries, plan_attack_chains, and kg_add_node/edge calls cover the common cases concretely.	5 / 5
Workflow Clarity	Steps are clearly sequenced (Collect → Ingest → Query → Auto-prioritize → Promote → Troubleshoot) and the collector-failure table is a feedback loop, but the workflow involves batch/database-style writes (ingest, kg_add_node/edge) with no validation checkpoint verifying ingest succeeded or findings were promoted correctly; per the rubric cap, missing validation in batch/database operations caps this at 3.	3 / 5
Progressive Disclosure	A single self-contained file with well-organized numbered sections and tables, no nested or buried references and no external files needed; not a 5 because the large canonical-query table is somewhat over 50 lines and could plausibly be split into a reference file, leaving minor organization room.	4 / 5
	Total	17 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, domain-specific description that states concrete capabilities and an explicit run-condition; its main weakness is that the 'when' guidance is a workflow precondition rather than natural user-intent trigger phrases.

Suggestions

Add a 'Use when ...' clause with natural user trigger phrases (e.g., 'Use when enumerating AD attack paths, finding shortest paths to Domain Admin, or hunting kerberoastable/delegation targets after a BloodHound collector run').

Surface a few more natural synonyms users might say (e.g., 'attack paths', 'shortest path to DA', 'kerberoasting') so the trigger terms match varied phrasings.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions — 'BloodHound ingestion', 'canonical Cypher queries', 'AD attack-path enumeration', 'promotes findings into the knowledge graph' — but stops short of an exhaustive action list, fitting the 'several specific actions; minor gaps' anchor rather than the comprehensive 5.	4 / 5
Completeness	Clear 'what' (ingestion + Cypher queries + promotion into KG) and an explicit 'when' clause ('Run after collector dumps zip'), but the 'when' is a procedural precondition rather than user-intent trigger phrases, matching the 4 anchor where 'when' could be more explicit.	4 / 5
Trigger Term Quality	Strong domain keywords a practitioner would naturally say (BloodHound, Cypher queries, AD attack-path, collector dumps zip, knowledge graph); not a 5 because it lacks synonyms/file-extension-style variations and relies on a single phrasing per concept.	4 / 5
Distinctiveness Conflict Risk	A clear niche — BloodHound + canonical Cypher for AD attack-path enumeration — with distinct triggers and minimal realistic overlap with other skills, matching the 5 anchor.	5 / 5
	Total	17 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/ad/bloodhound-query/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.