privilege-escalation-methods

This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable command catalog but is a monolithic ~330-line reference with no progressive disclosure to bundle files and no validation feedback loops in its destructive workflows. It also repeats material (Examples re-shows the sudo technique).

Suggestions

Move the per-technique command catalogs into reference files under references/ and keep SKILL.md as a concise overview with one-level-deep links, so progressive disclosure reaches level 3.

Add explicit validation/verification checkpoints (e.g. confirm uid=0 after escalation, verify ticket with klist before use) to the destructive and persistence workflows to lift workflow clarity above 2.

Trim the duplicate Examples section that re-demonstrates `sudo -l` / `sudo vim` already covered in Core Techniques, and condense the Purpose/Inputs/Outputs prose, to improve conciseness.

Dimension	Reasoning	Score
Conciseness	Mostly direct command catalogs without explaining concepts Claude already knows, but at ~330 lines it is padded — the Examples section repeats the sudo -l technique already shown in Core Techniques, and the prose Purpose/Inputs/Outputs sections could be tightened. Not level 3 because not every token earns its place.	2 / 3
Actionability	Provides fully executable, copy-paste-ready commands throughout (e.g. `sudo -l`, `sudo vim -c ':!/bin/bash'`, `GetUserSPNs.py domain.local/user:password -dc-ip ... -request`), matching the 'fully executable code/commands' anchor.	3 / 3
Workflow Clarity	Techniques are cataloged rather than sequenced into a workflow; the one numbered example (Golden Ticket with Scheduled Tasks) lacks validation checkpoints, and destructive/persistence operations have no verify-then-proceed feedback loop, so per the guidelines workflow clarity is capped at 2.	2 / 3
Progressive Disclosure	Content is well-organized into headed sections plus a quick-reference table, but it is monolithic — all ~330 lines live inline in SKILL.md with no bundle files (references/scripts/assets absent) and no one-level-deep references, so content that should be split into separate files is inline. Not level 3 because the under-50-lines simple-skill exception does not apply.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states a clear niche, lists concrete techniques, and gives explicit trigger guidance in third-person voice. It cleanly answers both what the skill does and when to use it.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions/techniques — "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation" — matching the 'lists multiple specific concrete actions' anchor; voice is third-person ('This skill should be used'), so no voice penalty applies.	3 / 3
Completeness	Explicitly answers 'when' ("This skill should be used when the user asks to...") with concrete triggers and 'what' ("post-exploitation privilege escalation for Linux or Windows systems"), satisfying the 'clearly answers both what AND when' anchor.	3 / 3
Trigger Term Quality	Quotes many natural terms a pentester would actually say ("escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo"), giving good coverage rather than only jargon.	3 / 3
Distinctiveness Conflict Risk	The niche is distinct (privilege escalation / post-exploitation) with specialized triggers like Kerberoasting and pass-the-ticket that are unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/privilege-escalation-methods/SKILL.md
Commit: af7d491

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.