Skip to content
Get packs

Active Directory Attack-Path Assessment

Assess Active Directory attack paths from supplied evidence, with gated, read-only-by-default validation

Source Download skill
Repository
sickn33/agentic-awesome-skills
Stars
49,023
Licence
MIT
Files
2 files

What it does

Once installed, the agent reviews Active Directory configurations (the Windows directory that manages users, groups and permissions) to identify possible routes an attacker could take to gain more access. It starts from evidence you supply, maps who can reach what, lists the preconditions each technique would need, and writes a report with mitigations. It is designed to stay read-only and give defensive guidance unless you explicitly confirm scope and authorization before any probing or testing.

Great for

  • Security engineers performing an authorized Active Directory review with written owner permission
  • Blue teams wanting to understand and fix attack paths in their own domain
  • Instructors building isolated, synthetic Active Directory training labs

Skip it if

  • Testing any domain, host or account you do not own or lack written permission to assess; the skill itself says this is illegal and prohibited
  • Beginners looking for a ready-made attack toolkit: the document provides no tools, credentials or verified exploit chains, and its own guidance says older tool names may be outdated
  • Production environments where live credential or directory queries could cause lockouts, outages or monitoring alerts without careful planning

Try asking

  • “Review this exported BloodHound-style group and ACL summary from our test domain and list the possible attack paths and their prerequisites”
  • “Which AD CS certificate template settings should we check for impersonation risk, and what mitigations apply?”
  • “Draft a report for our authorized assessment of service account exposure, using the scoped reporting template”
  • “Explain what preconditions must hold for a Kerberos ticket attack to be realistic in our environment”
Step-by-step guide: how to use Active Directory Attack-Path AssessmentInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    active-directory-attacks.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip active-directory-attacks.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip active-directory-attacks.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Give the agent exported configuration evidence first and keep it in read-only analysis mode; only confirm active validation once scope, target and authorization are stated explicitly
  • Use the reporting template so each finding separates observed evidence from hypothetical impact
  • Run any proposed validation yourself in a disposable lab after reviewing the exact command, since the skill does not execute tooling on its own

What's inside

  • references/advanced-attacks.md
  • SKILL.md

Redistributed unmodified from sickn33/agentic-awesome-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.