How to use the Windows Pivot Specialist agent skill

What is an agent skill, and what does this one do?

An agent skill is a folder of instructions (a SKILL.md file plus optional reference files) that an AI agent loads when a request matches the skill's description. This skill does not run tools or scripts on its own. It changes how the agent organizes its work.

Once active, the agent builds a pivot chain: the source host, the recovered artifact, the replay protocol or service, the destination host, and the resulting capability. It keeps host evidence, ticket evidence, and privilege effects on one timeline, and records the exact accepting service or host for each replayed artifact. The skill covers Kerberos, WinRM, SMB, RDP, and related Windows credential material.

• Separates stored credential material from usable privilege
• Records Kerberos fields such as SPN, delegation mode, PAC or group data, encryption type, cache location, and accepting service
• Keeps raw host artifacts and the derived timeline separate
• Points to more specialised skills for DPAPI, LSASS, Kerberos delegation, and relay/coercion questions

Install the skill from our page

Download the ZIP for competition-windows-pivot from this page. Then install it using one of the two methods below. The skill folder must keep its files together: SKILL.md, references/windows-pivot.md, and agents/openai.yaml.

Option A is a personal install for your user account. Unzip the download into ~/.claude/skills/. Option B is a project install: unzip it into the .claude/skills/ folder of the project you are working in. Option C is for the Claude apps: upload the skill under Settings → Capabilities → Skills.

• Option A: unzip into ~/.claude/skills/
• Option B: unzip into .claude/skills/ inside your project
• Option C: upload in the Claude apps under Settings → Capabilities → Skills
• Confirm the agent you use supports SKILL.md skills before you start

Install the parent skill first

This skill is a downstream specialisation. It is meant to activate only after the parent skill ctf-sandbox-orchestrator is installed and active, and after that parent has set sandbox assumptions, node ownership, and evidence priorities. If the parent has not run, the skill tells the agent to return to ctf-sandbox-orchestrator first.

The source does not name a download location or setup steps for the parent skill, so check its own documentation for those.

How to trigger the skill with natural requests

The skill's description lists the kinds of requests it matches. You do not need special syntax. Ask in plain language, and make sure the sandbox context has already been set up by the parent skill in the same session.

Requests that match the description include asking to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, explain host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. The skill's own text also mentions the $ctf-sandbox-orchestrator and $competition-... names, which you can use to point the agent to a specific skill.

• "Trace the WinRM pivot from the foothold host to the file server and tell me what privilege appeared there."
• "Replay this Kerberos ticket and show which SMB service accepted it."
• "Build a pivot timeline for this sandbox challenge: artifact, protocol, accepting host, resulting group change."

Examples of a good pivot timeline

A useful result is a short, replayable chain with evidence attached to each hop. Each hop should name the artifact, the protocol, the destination, and the observed effect. The reference file lists the fields to keep, such as event IDs, logon IDs, and group or token changes on the destination host.

The reference also lists common mistakes to avoid: treating possession of a ticket as proof of accepted privilege, claiming a pivot worked without a destination-side effect, and merging several hops into one vague statement.

• Source host → recovered artifact → replay over WinRM → destination host → new local group membership seen in event logs
• Keep logon IDs, SIDs, SPNs, and service names exactly as recorded
• Reproduce only the smallest pivot that still proves the privilege edge

What the skill needs and safety notes

The skill needs a parent skill (ctf-sandbox-orchestrator) that is already active, and an agent that supports SKILL.md skills. The source names no API keys or accounts. The skill does not run scripts and does not use the network, according to the files provided.

The skill describes credential recovery and replay. Use it only against systems you own or have written authorisation to test, inside a sandbox or competition environment. The skill is not written for safe handling of live data, so it is not suited to production incident response on real networks. It is also not a general Windows administration aid.

• Requires ctf-sandbox-orchestrator installed and active first
• Runs scripts: no. Uses network: no.
• Use only on systems you own or have written permission to test
• Not for production incident response or general Windows administration

Tips for better results

Give the agent the sandbox scope and node ownership up front, because the skill assumes the parent has already set them. Name the protocol you think was used (WinRM, SMB, RDP, WMI, or another listed option) so the agent does not have to guess.

Ask for the evidence block as well as the conclusion. The skill is designed to keep raw artifacts and the derived timeline apart, so ask for both.

• State the sandbox assumptions before asking for a pivot
• Name the protocol and destination host when you know them
• Ask for raw evidence and the derived timeline as separate outputs
• Expect replies in Simplified Chinese unless you request English