active-directory-attacks

This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", "Silver Ticket", "AS-REP roasting", "NTLM relay", or needs guidance on Windows domain penetration testing.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/active-directory-attacks/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-organized catalog of AD attack commands that assumes competence and splits advanced topics into a real reference file. Its main weakness is workflow clarity: destructive and batch operations mostly lack inline validation checkpoints and error-recovery feedback loops.

Suggestions

Embed explicit validation checkpoints in destructive workflows, e.g. after ZeroLogon/DCSync/Golden Ticket add 'Verify result (e.g., psexec with forged ticket) before proceeding' and a 'if it fails: re-check rights/hash and retry' feedback loop.

De-duplicate the Quick Reference table and Examples against the attack sections, or explicitly note they are condensed end-to-end runbooks to justify the repetition.

Consider moving the Critical CVEs and AD CS sections into the advanced reference to shorten the main SKILL.md and improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is dense with executable commands and assumes Claude's competence with no concept over-explanation, but the Quick Reference table and Examples section re-show commands already present in the attack sections, adding minor duplication that could be trimmed.	4 / 5
Actionability	It provides copy-paste-ready, executable commands across bash and PowerShell with real tool invocations (GetUserSPNs.py, secretsdump.py, certipy, mimikatz) covering the common AD attack cases thoroughly; placeholders are clearly marked parameter values.	5 / 5
Workflow Clarity	A Core Workflow with numbered steps and numbered Examples gives a clear sequence, and a few checkpoints exist (check vuln before CVE exploit, check SMB signing before relay, restore password after ZeroLogon), but most destructive/batch attack workflows lack embedded validate-before-proceed feedback loops, capping this at 3 per the destructive-operations guidance.	3 / 5
Progressive Disclosure	Structure is clean with sectioned headers and a single, well-signaled, one-level-deep reference (references/advanced-attacks.md, verified present and well-organized) that holds genuinely advanced topics; minor gap is that the main file is long and sections like AD CS / Critical CVEs could arguably also live in the reference.	4 / 5
	Total	16 / 20 Passed

Description

81%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A trigger-rich, highly distinctive description that excels at 'when to use it' but is weaker on explicitly stating 'what it does' in concrete action terms. Tightening the 'what' clause with explicit action verbs would lift completeness and specificity.

Suggestions

Lead with a concrete action clause before the trigger list, e.g. 'Enumerates Active Directory, harvests credentials, forges Kerberos tickets, and performs lateral movement' to make the 'what' explicit.

Frame the technique names as capabilities the skill performs rather than only phrases the user might say, to improve specificity scoring.

Dimension	Reasoning	Score
Specificity	The description names the domain ('Windows domain penetration testing', 'Active Directory') and lists concrete technique names (Kerberoasting, DCSync, Golden Ticket), but frames them as user-asked keywords rather than stating the skill's own actions, so the 'what it does' remains thin.	3 / 5
Completeness	The 'when' is explicit and concrete ('This skill should be used when the user asks to...'), but the 'what' is only weakly stated as 'guidance on Windows domain penetration testing' without concrete action verbs, so it stops short of a fully explicit what+what.	4 / 5
Trigger Term Quality	It comprehensively lists the exact natural phrases a red-teamer or pentester would say ('attack Active Directory', 'exploit AD', 'Kerberoasting', 'DCSync', 'pass-the-hash', 'NTLM relay'), including the AD/Active Directory synonym pair.	5 / 5
Distinctiveness Conflict Risk	The named AD-specific techniques (Kerberoasting, DCSync, Golden Ticket, BloodHound, NTLM relay) carve a clear niche with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/active-directory-attacks/SKILL.md
Commit: 3b43482

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.