CtrlK
BlogDocsLog inGet started
Tessl Logo

kerberoasting

Request Kerberos TGS tickets for SPN-bound service accounts and crack offline with hashcat — classic AD priv-esc primitive.

61

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/ad/kerberoasting/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The playbook is highly actionable with executable commands and tight, operational prose, but its batch-oriented workflow lacks explicit validation checkpoints, capping workflow clarity. Structure is good and self-contained though slightly above the simple-skill line.

Suggestions

Add explicit verification checkpoints to the workflow (e.g., after step 2 confirm /tmp/kerb.hashes is non-empty, after step 3 confirm at least one hash cracked before promoting the credential) to lift workflow clarity above the batch-operation cap.

Consider splitting the 'Common services found' table and service-account heuristics into a reference file to keep SKILL.md as a lean overview, which would also bring progressive disclosure to a 5.

DimensionReasoningScore

Conciseness

The body is lean and assumes Claude's knowledge of AD/Kerberos, with operational rather than padding prose; a few minor chatty bits ("yes, really", "Whatever the service account can reach is now yours") could be trimmed, keeping it just below a 5.

4 / 5

Actionability

Provides fully executable, copy-paste-ready commands across tools (ldapsearch, GetUserSPNs.py, Rubeus, hashcat with modes 13100/19700, kg_add_node) covering the common RC4 and AES cases with clearly marked placeholders.

5 / 5

Workflow Clarity

The five numbered steps form a clear sequence, but Kerberoasting is a batch-able operation (OPSEC notes warn against requesting all SPNs at once) and there are no explicit validation/verification checkpoints (e.g., confirm hashes were captured, confirm crack success), so the batch-operation cap of 3 applies.

3 / 5

Progressive Disclosure

No bundle files exist and the skill is self-contained with clear section headers and logical organization; at ~80 lines it is slightly over the under-50-lines simple threshold, and content like the services table and heuristics could arguably be split out, so it sits at 4 rather than 5.

4 / 5

Total

16

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly niche-distinct, but it lacks an explicit "Use when..." trigger clause, which caps completeness. Trigger-term coverage is good though missing the colloquial "kerberoasting" verb in the description text itself.

Suggestions

Add an explicit 'Use when...' clause stating when to invoke this skill (e.g., 'Use when performing AD privilege escalation, Kerberoasting, or when the user mentions TGS/SPN tickets or hashcat mode 13100/19700').

Include the colloquial term 'kerberoasting' directly in the description field so the natural trigger word users say is present alongside the technical phrasing.

DimensionReasoningScore

Specificity

Names the domain and two concrete, tool-specific actions ("Request Kerberos TGS tickets", "crack offline with hashcat") with precise artifacts (SPN-bound service accounts), but coverage is not comprehensive — identification and credential promotion steps are absent.

4 / 5

Completeness

The "what" is clear (request TGS tickets, crack with hashcat) but there is no "Use when..." clause or explicit trigger guidance, so completeness is capped at 3 per the judging guidelines.

3 / 5

Trigger Term Quality

Includes strong natural terms a practitioner would say ("Kerberos TGS tickets", "SPN", "hashcat", "AD priv-esc"), but the colloquial verb "kerberoast/kerberoasting" itself is not in the description field and a few synonyms are missing.

4 / 5

Distinctiveness Conflict Risk

Kerberoasting is a narrow, well-defined AD technique with distinct triggers (TGS/SPN/hashcat), so it is clearly distinguishable from other skills with minimal conflict risk.

5 / 5

Total

16

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.