abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/abusing-dpapi-for-credential-access/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a clean sequence, but it over-explains known concepts, lacks in-workflow validation checkpoints for destructive operations, and fails to wire its existing bundle files into the main document.

Suggestions

Replace the concept-heavy Overview paragraph with a brief pointer and move detailed DPAPI/master-key background into a reference file, keeping only the decryption-path summary Claude cannot infer.

Add explicit validation checkpoints inside the workflow (e.g., confirm master-key GUID:SHA1 output parsed before running credentials/vaults; verify backupkey .pvk file exists before /pvk: use) with a fix-and-retry loop.

Link the existing bundle files from the body — reference references/api-reference.md for the full command/flag table, references/standards.md for MITRE/NIST mappings instead of inlining them, and scripts/agent.py for automated triage.

Dimension	Reasoning	Score
Conciseness	Mostly efficient command-focused content, but the Overview explains DPAPI/master-key concepts Claude already knows and the inline Tools/Resources table duplicates URLs already shown, so it could be tightened.	3 / 5
Actionability	Fully executable, copy-paste-ready SharpDPAPI/SharpChrome/Impacket commands cover the common cases, and a bundled triage helper script is provided.	5 / 5
Workflow Clarity	Seven clearly sequenced steps are present, but destructive/batch credential operations lack in-flow validate->fix->retry checkpoints, capping this dimension at 3 per the rubric despite a final checklist.	3 / 5
Progressive Disclosure	Bundle files (references/api-reference.md, references/standards.md, scripts/agent.py) exist but are never linked or signaled from the body, and the MITRE table is inlined duplicating standards.md.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific, and complete description that names concrete actions, tools, and explicit trigger conditions for an authorized red-team context. Minor keyword synonym coverage gaps keep trigger_term_quality just below the top anchor.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (extract/decrypt Credential Manager, browser logins/cookies, Wi-Fi, KeePass, domain-wide backup-key decryption) across named tools, giving comprehensive coverage.	5 / 5
Completeness	Explicitly states both what it does (extract/decrypt DPAPI-protected secrets via named tools and paths) and when to use it ('Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs').	5 / 5
Trigger Term Quality	Strong natural terms (DPAPI, Credential Manager, browser logins/cookies, red-team credential-access, SharpDPAPI) but misses some synonyms and file extensions like .pvk, master keys, and Vault.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear Windows-DPAPI niche with distinct tool and trigger terms (SharpDPAPI, backup key, DPAPI blobs), making conflict with other skills minimal.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/abusing-dpapi-for-credential-access/SKILL.md
Commit: 54a7988

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.