Guide · Agent skill
How to use the LDAP Security Hardening Audit agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the configuring-ldap-security-hardening skill does, how to install it for an AI agent, and how to ask for an LDAP or Active Directory hardening review in plain language. It is aimed at IT and security staff who manage a directory service they are authorised to audit. After reading it you will know how to install the skill, which requirements to meet, and how to check the output before relying on it.
LDAP Security Hardening Auditmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Confirm requirements. Check that you have Python 3.8 or newer, network access to the server on ports 389 and 636, and written authorisation for the audit.
- 2Install ldap3. Run pip install ldap3 in the Python environment you will use.
- 3Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 4Ask for the audit. Describe the environment, scope and the controls to check, such as LDAPS, channel binding and LDAP signing, and ask for findings with fixes.
- 5Review the script output. If you run scripts/agent.py, read its result as a lead and confirm the signing and LDAPS settings on the server.
- 6Write up findings. Record the findings, the recommended fixes and the verification steps so they can serve as compliance evidence.
What is an agent skill and what does this one do?
An agent skill is a folder containing instructions (a SKILL.md file), and sometimes supporting files and scripts, that an AI agent can load when a task matches the skill's description. This skill covers hardening LDAP directory services, which store usernames and passwords for many systems, against credential harvesting, LDAP injection, anonymous binding and channel binding bypass.
When the skill is active, the agent is guided to check that encrypted connections (LDAPS), channel binding and LDAP signing are enforced, to look for anonymous access and risky access control settings, and to write up findings with recommended fixes. The reference material lists the Windows registry settings for LDAP signing and channel binding, with recommended values.
- Checks LDAPS, channel binding and LDAP signing enforcement
- Looks for anonymous access and risky access control settings
- Produces written findings with recommended fixes
- Includes a small Python script that connects to a server address and reports whether plain LDAP signing appears enforced and whether LDAPS responds
How do you install the LDAP hardening skill?
Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder instead.
In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
The only package the skill asks you to install is the ldap3 Python library, which you can install with pip.
- Personal use: ~/.claude/skills/
- Single project: .claude/skills/ inside the project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
pip install ldap3What do you need before you run an audit?
Check these requirements before you start. The script opens real connections to the server and attempts binds, so the network and authorisation points matter as much as the software.
The skill's own prerequisites also suggest working in a test or lab environment where possible, and confirming written authorisation for any testing.
- Python 3.8 or newer
- The ldap3 Python library installed
- Network access to the target LDAP or AD server on ports 389 and 636
- Authorisation to audit the target environment
How do you trigger the skill with a natural request?
You do not need a special command. Describe the task in plain language and mention LDAP, Active Directory, or the controls you care about. The skill is written to load when you ask to secure or audit a directory service for these attack classes.
Be specific about scope. Name the environment you own, say whether you want a configuration review or a quick connectivity check, and ask for findings with fixes so the output is useful for a hardening checklist.
- 'Review our Active Directory domain controllers for LDAPS, channel binding and LDAP signing enforcement, and list fixes.'
- 'Check whether our lab LDAP server allows anonymous binds and which access control settings look risky.'
- 'Write a hardening checklist for our AD environment covering LDAP signing and channel binding, with registry values to verify.'
- 'Run the LDAP audit script against our test directory server and summarise whether LDAPS responds.'
What does the bundled script check, and what does it not?
The bundled script (scripts/agent.py) is a small Python tool. It connects to a server address and reports whether plain LDAP signing appears enforced and whether LDAPS responds. Its signing check only tests whether an anonymous connection succeeds. That does not confirm the signing policy, so treat the result as a lead to verify, not as proof of configuration.
Verify the actual settings on the server. The reference file lists the registry values for LDAP signing (LDAPServerIntegrity) and channel binding (LdapEnforceChannelBinding) with the recommended values, which you can check directly.
- Script result is a starting point, not a final configuration report
- Confirm LDAP signing and channel binding on the server itself
- Review access control settings manually
What safety points should you know?
The skill runs scripts and uses the network. Both the script and the agent's requests can open real connections to the directory server and attempt binds. Only point them at systems you own or have written permission to assess.
Do not treat the output as an audit result on its own. Keep records of what you tested and when, and check results against your own configuration review before reporting them.
- Only target servers you own or are authorised to assess
- Run first against a test or lab directory where possible
- Review the script before running it in your environment
What people use it for
- Preparing a hardening checklist for an Active Directory environment you manage
- Gathering evidence for an access control review that asks about LDAP signing and LDAPS
- Checking a lab directory for anonymous binding and risky access control settings
- Learning how password spraying and LDAP relay are mitigated through configuration
Frequently asked questions
How do I install the LDAP security hardening agent skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder for one project. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills. Then install the ldap3 library with pip install ldap3.
What do I need to run this skill?
You need Python 3.8 or newer, the ldap3 Python library, network access to the target LDAP or AD server on ports 389 and 636, and authorisation to audit that environment. The skill runs scripts and uses the network.
Is this skill free to use?
The skill is published under the Apache-2.0 licence. The source does not mention pricing, so check the licence and your own terms before using it in a commercial setting.
Does the script prove my LDAP signing is enforced?
No. The script's signing check only tests whether an anonymous connection succeeds, which does not confirm the signing policy. Verify LDAP signing and channel binding directly on the server, for example against the registry values listed in the reference file.
Can I use this skill on servers I don't own?
No. The script opens real connections and attempts binds, so use it only on systems you own or have written permission to assess. Test in a lab environment first where you can.
How is this different from other LDAP security tools?
This skill is an instruction set for an AI agent plus one small connectivity script. It does not claim to be a full scanner, and the source does not compare it with other tools, so use it as a guided review aid alongside your own checks.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits IT and security staff who manage an Active Directory or LDAP environment and want guided help checking LDAPS, channel binding, LDAP signing and access control settings. It is not a substitute for a full scanner or for checking the live server configuration yourself, and it should not be pointed at systems you are not authorised to test.
Download the skill