Guide · Agent skill
How to use the AD ACL Abuse Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the analyzing-active-directory-acl-abuse agent skill, which lets an AI agent review the permissions on objects in an Active Directory domain. It is written for security engineers, SOC analysts and students who may not have used agent skills before. By the end you will know what the skill does, how to install it, how to ask for an audit in plain language, and what it needs to run safely.
AD ACL Abuse Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Install ldap3. Make sure Python 3.9 or later is available, then run pip install ldap3.
- 3Confirm authorisation. Check that you have written permission to audit the target domain before starting.
- 4Ask in plain language. Describe the domain, scope and risks you want checked, such as GenericAll or WriteDACL on Domain Admins.
- 5Review the JSON report. Read each finding's trustee, permission, attack path and recommended remediation.
- 6Remediate and re-run. Apply the recommended fixes under change control, then run the audit again to confirm the findings are gone.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md instruction file and optional scripts and reference files. When installed, an agent can load these instructions and follow them for a matching task. This skill covers ACL abuse analysis in Active Directory.
When installed, the agent can connect to a Windows Active Directory domain controller over LDAP, read the permission lists (ACLs) attached to users, groups, computers and OUs, and flag non-admin accounts holding dangerous rights such as GenericAll, WriteDACL or WriteOwner. It explains the likely attack path for each finding and produces a JSON report with remediation steps.
The skill is intended for defensive review of an environment you are authorised to audit.
- Connects to a domain controller using the ldap3 Python library
- Parses nTSecurityDescriptor values into SDDL and reads each ACE
- Checks access masks against GenericAll, WriteDACL, WriteOwner and GenericWrite
- Excludes expected admin trustees such as Domain Admins, Enterprise Admins, SYSTEM and Administrators
- Outputs a JSON report with severity, attack path and remediation for each finding
Install the skill from the ZIP
Download the ZIP for this skill from this page and unzip it. The skill folder must contain SKILL.md, scripts/agent.py and references/api-reference.md.
For a personal install, unzip it into ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills, then upload
Install the Python requirements
The skill needs Python 3.9 or later and the ldap3 library. Install ldap3 with pip before running any audit.
- Python 3.9 or later
- ldap3 Python library
pip install ldap3How do you trigger the skill with a natural request?
You do not need to name the skill. Describe the task in plain language that mentions Active Directory and permissions, and the agent should match the skill from its description. Be specific about the domain and scope, and confirm you are authorised to audit it.
Good requests name the domain, the scope (whole domain or one OU) and the risk you care about. Vague requests may not trigger the skill.
- "Audit ACLs in corp.example.com for GenericAll and WriteDACL abuse paths on Domain Admins."
- "Check whether helpdesk accounts have dangerous rights over users in the Staff OU, and give me a JSON report."
- "Explain the attack path behind any WriteOwner rights you find on domain controllers."
What do you need before running an audit?
You need domain user credentials with read access to AD objects, and network access to a domain controller on port 389 (LDAP) or 636 (LDAPS). The skill's steps recommend LDAPS on port 636 for encrypted connections in production.
Use credentials that are sensitive and handle them accordingly. The skill runs scripts and uses the network, so review scripts/agent.py before running it.
- Domain user credentials with read access to AD objects
- Network access to a domain controller on port 389 or 636
- Understanding of the AD security model and SDDL format helps when reading results
What does the JSON report look like?
The report lists the domain, the number of objects scanned, the number of dangerous ACEs found, and a findings array. Each finding includes severity, target object, target type, trustee, permission, access mask, ACE type, attack path and remediation.
{
"domain": "corp.example.com",
"objects_scanned": 1247,
"dangerous_aces_found": 8,
"findings": [
{
"severity": "critical",
"target_object": "CN=Domain Admins,CN=Users,DC=corp,DC=example,DC=com",
"target_type": "group",
"trustee": "CORP\\helpdesk-team",
"permission": "GenericAll",
"access_mask": "0x10000000",
"ace_type": "ACCESS_ALLOWED",
"attack_path": "GenericAll on Domain Admins group allows adding arbitrary members",
"remediation": "Remove GenericAll ACE for helpdesk-team on Domain Admins"
}
]
}What safety points should you know?
The skill reads sensitive directory data using domain credentials and queries many objects, so treat it as a sensitive operation. Do not run it against domains you do not own or have written authorisation to test. In production, use change control.
Because the skill runs scripts and uses the network, read scripts/agent.py before you let an agent execute it.
- Only audit domains you own or are authorised to test in writing
- Use LDAPS (port 636) where possible
- Run under change control in production environments
- Review the scripts before running them
What people use it for
- Security engineers auditing an Active Directory domain for privilege escalation paths
- SOC analysts or students learning how BloodHound-style ACL attack paths are found
- Blue teams checking whether helpdesk or service accounts have excessive permissions
Frequently asked questions
How do I install the analyzing-active-directory-acl-abuse skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings, then Capabilities, then Skills.
What do I need to run it?
You need Python 3.9 or later, the ldap3 library installed with pip install ldap3, domain user credentials with read access to AD objects, and network access to a domain controller on port 389 or 636.
Is this skill free to use?
The skill is listed under the Apache-2.0 licence. Check the licence file included with the source for the terms that apply to your use.
Does it change anything in Active Directory?
The skill is described as a defensive review tool that reads permission lists and reports findings with remediation steps. It does not describe making changes to your directory; remediation is listed as recommendations for you to apply.
Which permissions does it flag?
It checks for GenericAll, WriteDACL, WriteOwner and GenericWrite, and mentions WriteProperty for specific extended rights. It excludes expected admin trustees such as Domain Admins, Enterprise Admins, SYSTEM and Administrators.
How does it compare to BloodHound?
The skill's source says the misconfigurations it finds are the basis for ACL-based attack paths discovered by tools like BloodHound. This skill focuses on parsing ACLs and producing a JSON report, rather than the graph view BloodHound provides.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose this skill if you are a security engineer, SOC analyst or student who needs a structured, scripted review of ACL misconfigurations in an Active Directory domain you are authorised to audit. Pick a different approach if you need a graphical attack-path explorer, or if you cannot use domain credentials and network access against the directory under your organisation's rules.
Download the skill