Guide · Agent skill
How to use the Competition Kerberos Delegation agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
Competition Kerberos Delegation is a specialist agent skill for analysing Kerberos delegation in a Windows-style capture-the-flag (CTF) sandbox. It is written for competitors and security students who already work in an authorised sandbox and want an agent to map which delegation path exists, which ticket is requested, and which service actually accepts it. After this guide you will know what the skill does, how to install it, how to trigger it, and what it needs before it will run.
Competition Kerberos Delegationzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Install the parent skill. Make sure ctf-sandbox-orchestrator is installed and active, since this skill only runs after that parent has routed to it.
- 2Download and unzip this skill. Download the ZIP from our page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 3Or upload the ZIP in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Set up your sandbox. Prepare a Kerberos/Active Directory sandbox environment that you are authorised to test.
- 5Establish sandbox assumptions. Let the parent skill set the sandbox rules, node ownership and evidence priorities before delegation work begins.
- 6Ask a natural request. Describe the delegation setting or ticket question in plain language, such as constrained delegation or RBCD.
- 7Verify the chain. Check that each privilege claim is tied to an accepted ticket or service-side evidence.
What the skill makes the agent do
The skill focuses on one question: how a Kerberos trust edge turns into effective privilege under sandbox assumptions. It covers constrained delegation, unconstrained delegation, resource-based constrained delegation (RBCD), S4U steps, SPNs and service-ticket acceptance.
The agent is told to write a replayable chain of steps: principal, delegation edge, ticket type, target SPN, accepting service and resulting privilege. It also has to keep ticket possession separate from proven privilege, so a ticket that was minted is not treated as proof that a service accepted it.
- Identify which delegation edge is in play (constrained, unconstrained, RBCD, protocol transition or another trust edge).
- Record ticket details such as TGT or TGS type, delegation flags, PAC or group data, encryption type, cache location and target SPN.
- Confirm which service accepts the ticket and what capability appears afterwards.
- Compress the findings into one replayable path instead of a vague "domain compromise" statement.
What you need before you start
This skill is a downstream component. It is meant to run only after the parent skill ctf-sandbox-orchestrator is installed, active and has established the sandbox assumptions and routed the task here. If the parent has not done that, the skill tells the agent to return to the parent first.
You also need your own Kerberos/Active Directory sandbox environment. The skill does not supply one.
Install the skill from the download page
Download the ZIP for this skill from our page and unzip it. The package contains agents/openai.yaml, references/kerberos-delegation.md and SKILL.md.
For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.
In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
Trigger the skill with natural requests
You do not need a special command. Ask in plain language about the topics the skill covers. The description lists triggers such as constrained delegation, unconstrained delegation, RBCD, S4U, SPNs, ticket acceptance, and how a Kerberos trust edge becomes effective privilege.
Remember that the skill is written to reply in Simplified Chinese unless you explicitly ask for English.
- Ask about constrained delegation in your sandbox and which service accepts the resulting ticket.
- Ask how an RBCD configuration could let a service account obtain a service ticket.
- Ask the agent to write out the trust chain from your sandbox's SPNs and delegation settings.
- Ask whether a ticket you have minted is actually accepted by the target service.
Work through an example session
Start by stating your sandbox rules and the account and machine you control, so the parent skill can set the assumptions. Then describe the delegation setting you see. The skill guides the agent to name the edge, trace ticket minting and acceptance, and report the single edge that lands privilege.
Expect the output to separate candidate edges from the edge that actually works. Each privilege claim should point to a specific accepted ticket or a service-side effect such as a log event, logon session change or group change.
- Write the chain: principal, delegation edge, ticket type, target SPN, accepting service, resulting privilege.
- Keep SPNs, delegation mode, PAC/group data, encryption type and service acceptance in one evidence block.
- Reproduce one minimal chain before trying variants.
Safety notes: scripts and network
This skill does not run scripts and does not use the network by itself. Its guidance is text: a checklist and workflow for the agent to follow.
The skill assumes an authorised sandbox. It is not meant for real corporate or production networks, and it could be misused to attack systems without permission. Use it only in environments you are allowed to test.
- Use only in CTF or lab environments you are authorised to test.
- Do not point it at production or corporate Active Directory.
- Confirm the parent skill has set the sandbox rules before you start.
What people use it for
- Practising constrained delegation paths in a CTF Active Directory sandbox.
- Learning how RBCD lets a resource decide which accounts can delegate to it.
- Comparing constrained and unconstrained delegation settings in a lab.
- Checking whether a minted service ticket is actually accepted by the target service.
- Writing a clean, replayable attack-path write-up for a training exercise.
Frequently asked questions
How do I install the competition-kerberos-delegation skill?
Download the ZIP from our page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps you can also upload the ZIP under Settings → Capabilities → Skills.
Does this skill require anything else to be installed?
Yes. The parent skill ctf-sandbox-orchestrator must be installed and active, and you need your own Kerberos/Active Directory sandbox environment. The skill does not provide the sandbox.
Is the competition-kerberos-delegation skill free?
The source describes the skill as MIT licensed. It does not state any pricing, so check the licence and the download page for terms.
Does this skill run scripts or use the network?
According to the source, it runs no scripts and uses no network. It provides text guidance for the agent to follow.
Can I use it on a real corporate network?
No. The skill assumes an authorised CTF sandbox and is not meant for real corporate or production networks, where it could be misused to attack systems without permission.
What language does the skill reply in?
It replies in Simplified Chinese by default. Ask explicitly for English if you want English replies.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits competitors and security students practising Active Directory and Kerberos attack paths in authorised CTF sandboxes, provided the parent ctf-sandbox-orchestrator skill is already set up. It is a poor fit for production networks, for anyone who has not set up the parent skill, or for users who need a general Kerberos tutorial rather than a sandbox-focused workflow.
Download the skill