Guide · Agent skill
How to use the Active Directory Attack agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The active-directory-attack skill is a file of instructions that gives an AI agent a condensed playbook of techniques used against Windows Active Directory domains and internal networks. It is written for people who already work in penetration testing or red teaming and need a quick reminder of attack paths and tool names. After this guide you will know how to install the skill, how to phrase requests so the agent uses it, and what limits to respect.
Active Directory AttackAIPentest/CyberStrikeAI · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the active-directory-attack skill ZIP from this page.
- 2Unzip into the skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload it in the Claude apps. Alternatively, go to Settings → Capabilities → Skills in the Claude apps and upload the skill.
- 4Install the required tools. Install BloodHound, Certipy, Impacket, Responder, mitm6, hashcat and any coercion tools you need, since the skill does not install them.
- 5Ask a specific question. Describe your authorized assessment and name the topic, such as ADCS, NTLM relay or DCSync, so the agent uses the skill.
- 6Verify before running. Check each suggested command and flag against the tool's own documentation before you run it.
What the skill makes the agent do
Once the skill is loaded, the agent can recall and suggest specific attack techniques and tools when you ask about attacking Active Directory, ADCS, NTLM relay, or an internal domain. The source file covers topics such as BloodHound-based attack path discovery, Kerberoasting and AS-REP roasting, ADCS ESC1 and ESC8, NTLM relay, forced authentication coercion, DACL abuse, DCSync, several known domain vulnerabilities, IPv6 spoofing with mitm6, LLMNR and NBT-NS poisoning, and some Linux internal network issues.
The skill is written in Chinese, with tool names and commands in English. The file contains only instructions. It does not contain executable code.
- Recon: BloodHound, with SharpHound for collection
- Kerberos: GetNPUsers (AS-REP) and GetUserSPNs (Kerberoast)
- ADCS: Certipy, including certipy find -vulnerable
- NTLM relay: ntlmrelayx
- Name poisoning: Responder, with hashcat for cracking captured hashes
- IPv6: mitm6
Install the active-directory-attack skill
Download the skill ZIP from this page. Unzip it into one of two locations. For a personal install, use ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.
In the Claude apps you can instead upload the skill under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the skill
Trigger the skill with natural requests
You do not need a special command. The skill's description tells the agent to use it when you ask about attacking Active Directory, ADCS, NTLM relay, or an internal domain. Name the topic directly so the agent matches the skill to your request.
Include the context the agent needs, such as that the assessment is authorized and what you are trying to achieve. The source itself gives no workflow, so treat the agent's suggestions as starting points to verify with the tools' own documentation.
- Ask which Active Directory attack paths to check after collecting data with BloodHound
- Ask how ADCS ESC1 or ESC8 applies to a certificate authority you are testing
- Ask which tool syntax to use for NTLM relay against LDAP or ADCS
- Ask what to try against an internal network that uses IPv6 by default
Example commands the skill references
The skill lists the following commands as shorthand. They are copied from the source file. Check the flags against each tool's documentation before running anything, because the source is terse and in places contains typos.
- certipy find -vulnerable: looks for vulnerable ADCS templates
- ntlmrelayx -t ldap --escalate-user: relays to LDAP for privilege escalation
- certipy shadow: shadow credentials, which the source notes need only GenericWrite and do not change a password
- secretsdump -just-dc: DCSync-style credential dump
- GetNPUsers and GetUserSPNs: Kerberos roasting helpers
certipy find -vulnerableWhat you need before using it
The skill does not install any tools. It names offensive security tools such as BloodHound, SharpHound, Certipy, Impacket (ntlmrelayx, secretsdump, GetNPUsers, GetUserSPNs), Responder, mitm6, hashcat, and coercion tools. You must install and run these yourself.
The techniques only apply when you have access to a target internal network. The skill itself does not connect to any network.
- Offensive security tools listed above, installed separately
- Access to a target internal network that you are authorized to test
- Written permission for the engagement
Safety notes on scripts and network use
According to the listing, the skill runs no scripts and uses no network. It is a text file of instructions. The risk comes from the techniques themselves. These attacks can cause illegal intrusion and real damage if used against networks or domains you do not own or lack written permission to test.
The skill also gives no remediation or detection guidance. If you are defending a network, use it only to understand attacker methods.
- Use only on domains you own or have written permission to test
- The skill contains attack techniques, not hardening steps
- Check every command and flag against the official tool documentation before running it
What people use it for
- A penetration tester preparing an authorized Active Directory assessment asks which ADCS misconfigurations to check with Certipy.
- A red team operator wants a quick reminder of NTLM relay syntax for ntlmrelayx against LDAP or ADCS.
- A security student studies how DCSync and Kerberoasting work so they can later explain the risk to a defender.
- An operator reviews common AD attack paths after collecting data with BloodHound during an approved engagement.
Frequently asked questions
Is the active-directory-attack skill free?
The listing states the skill is licensed under Apache-2.0. The source file does not mention pricing. Check the repository licence file for the full terms.
How do I install the active-directory-attack skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps you can also upload it under Settings → Capabilities → Skills.
Does the skill run scripts or use the network?
No. The listing says it runs no scripts and uses no network. The file contains only instructions, not executable code.
What tools do I need to install separately?
The skill names BloodHound, SharpHound, Certipy, Impacket, Responder, mitm6, hashcat and coercion tools, but does not install them. You must install and run these yourself.
Is this skill for beginners?
Not really. The content is terse command shorthand written for people who already have penetration testing expertise. It is not a step-by-step tutorial.
How does this compare with a full pentest guide?
This skill is a condensed reminder of attack paths and tool names for an AI agent to recall. It gives no hardening or detection guidance, so pick a full methodology guide if you need the complete process or defensive advice.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a professional penetration tester or red team operator on an authorized Active Directory assessment, or a security student who wants a quick map of domain attack techniques. Pick something else if you are a defender looking for remediation steps, or a beginner who needs a full walkthrough, since the file gives attacks only and assumes existing expertise.
Download the skill