analyzing-active-directory-acl-abuse

Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths

Quality

54%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-active-directory-acl-abuse/SKILL.md

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized with a clear eight-step process and concrete output schema, but it explains concepts Claude already knows and never links the accompanying reference/script bundle, leaving it descriptive rather than executable in-place. Batch-scan validation checkpoints are also absent.

Suggestions

Trim the Overview's definitions of ACL/DACL/ACE — Claude already knows these — and lead with the actionable procedure.

Add explicit links/signals to the bundle, e.g. '## API reference — see references/api-reference.md' and '## Runner script — python scripts/agent.py', so the executable code is discoverable.

Insert validation checkpoints into the workflow (e.g. verify the LDAP bind succeeded, confirm objects_scanned > 0 before reporting, re-query a flagged ACE to confirm before escalating), to satisfy the batch-operation feedback-loop expectation.

Dimension	Reasoning	Score
Conciseness	The Overview explains concepts Claude already knows ('Access Control Lists (ACLs) define permissions...', 'Discretionary Access Control Lists (DACLs) containing Access Control Entries (ACEs)'), matching the 'mostly efficient but includes some unnecessary explanation' anchor; not a 2 because the rest is reasonably tight.	3 / 5
Actionability	Steps cite concrete specifics (attributes, bitmasks like GenericAll 0x10000000) but the body contains no executable code — the runnable script lives in scripts/agent.py which the body never invokes; fits 'some concrete guidance but incomplete' rather than 4 because guidance is descriptive rather than copy-paste ready.	3 / 5
Workflow Clarity	Eight steps are clearly sequenced, but this is a batch scan over many AD objects with no validation/verification or error-recovery checkpoints, which caps workflow_clarity at 3 per the batch-operations guideline; not a 2 because the sequence itself is coherent.	3 / 5
Progressive Disclosure	Section structure is reasonable (Overview, When to Use, Prerequisites, Steps, Expected Output) and bundle files exist (references/api-reference.md, scripts/agent.py), but the body never signals or links them, so references are 'present but not clearly signaled'; not a 4 because navigation to the bundle is missing.	3 / 5
	Total	12 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-targeted to a clear security niche, but omits any explicit trigger/'Use when' guidance, which caps its completeness. Keyword coverage is solid but technical rather than user-natural.

Suggestions

Add an explicit 'Use when...' clause naming natural user triggers, e.g. 'Use when auditing Active Directory permissions, hunting ACL-based privilege escalation, or investigating BloodHound attack paths.'

Broaden trigger terms with natural synonyms users actually say (e.g. 'DACL', 'permissions', 'BloodHound', 'privilege escalation') rather than only technical bitmask names.

Optionally mention the output artifact (e.g. 'and outputs a JSON remediation report') to round out the 'what'.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions ('Detect dangerous ACL misconfigurations', 'identify GenericAll, WriteDACL, and WriteOwner abuse paths'), comparable to the 'lists several specific actions; minor gaps' anchor; not a 5 because parsing, SID resolution, and remediation are absent.	4 / 5
Completeness	Has a clear 'what' (detect ACL misconfigurations, identify abuse paths) but no 'when'/Use-when clause, which caps completeness at 3 per the judging guidelines; not a 2 because the 'what' is concrete rather than vague.	3 / 5
Trigger Term Quality	Includes relevant technical keywords ('Active Directory', 'ACL', 'ldap3', 'GenericAll', 'WriteDACL', 'WriteOwner') but lacks common natural synonyms a user might say ('BloodHound', 'permissions', 'DACL'); fits the 'some relevant keywords but missing variations' anchor.	3 / 5
Distinctiveness Conflict Risk	A clear niche (AD ACL abuse via ldap3 with named abuse paths) with minimal overlap risk; not a 5 because the trigger phrasing is less explicit than the anchor's 'Use when...' formulation.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-active-directory-acl-abuse/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.