Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hypnguyen1209/offensive-claude --skill active-directory-attackgit clone --depth 1 https://github.com/hypnguyen1209/offensive-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hypnguyen1209/offensive-claude/active-directory-attack)<a href="https://agentmods.dev/skills/hypnguyen1209/offensive-claude/active-directory-attack"><img src="https://agentmods.dev/badge/skills/hypnguyen1209/offensive-claude/active-directory-attack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hypnguyen1209/offensive-claude/active-directory-attack"><img src="https://agentmods.dev/badge/skills/hypnguyen1209/offensive-claude/active-directory-attack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 3 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high YARA Match · line 7 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- medium Privilege Escalation · line 71 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.02784 |
| Opus 5 | $0.00042 | $0.01392 |
| Sonnet 5 | $0.00017 | $0.00557 |
| Haiku 4.5 | $0.00008 | $0.00278 |
Grade B, and why
active-directory-attack scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo ntpdate <DC_IP> # or: faketime "$(net time -S <DC>)" <cmd> How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Active Directory Attacks
When to Activate
- Attacking Windows domain environments after gaining any domain foothold (creds, hash, or unauth network position)
- Kerberos exploitation: Kerberoasting, AS-REP roasting, delegation (RBCD/constrained/unconstrained), ticket forgery
- Coercion + NTLM/Kerberos relay chains (PetitPotam/DFSCoerce → LDAP/ADCS, NTLM reflection CVE-2025-33073)
- ADCS certificate-template abuse (ESC1-ESC16) and certificate-based domain takeover
- dMSA / BadSuccessor privilege escalation on Windows Server 2025 domains
- BloodHound CE attack-path discovery, lateral movement, DCSync, and domain-dominance persistence
Technique Map
| Technique | ATT&CK | CWE | Reference | Script |
|---|---|---|---|---|
| BloodHound CE / SharpHound enumeration | T1482 | CWE-732 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
| Password spray / PtH / PtT lateral movement | T1550.002, T1550.003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
| LAPS / gMSA password read | T1003 | CWE-522 | references/bloodhound-enum-lateral.md | scripts/ad_recon.py |
| Kerberoasting | T1558.003 | CWE-261 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |
| AS-REP roasting | T1558.004 | CWE-308 | references/kerberos-roasting-delegation.md | scripts/kerberoast_audit.py |
| Resource-Based Constrained Delegation (RBCD) | T1558, T1098 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |
| Constrained/Unconstrained delegation (S4U) | T1558 | CWE-269 | references/kerberos-roasting-delegation.md | scripts/rbcd_takeover.py |
| Coercion (PetitPotam/DFSCoerce/PrinterBug/WebDAV) | T1187 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| NTLM relay (SMB/LDAP/ADCS) | T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| NTLM reflection (CVE-2025-33073) | T1187, T1557.001 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| Kerberos relay / DNS CNAME (CVE-2026-20929) | T1557 | CWE-294 | references/coercion-relay.md | scripts/coerce_relay_chain.sh |
| ADCS ESC1 (SAN) / ESC15 EKUwu (CVE-2024-49019) | T1649 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |
| ADCS ESC8 relay / ESC16 CA-wide override | T1649, T1557.001 | CWE-295 | references/adcs-abuse.md | scripts/adcs_esc_finder.py |
| Golden / Silver / Diamond / Sapphire ticket | T1558.001, T1558.002 | CWE-345 | references/ticket-forgery-dcsync.md | - |
| DCSync (DRSUAPI replication) | T1003.006 | CWE-269 | references/ticket-forgery-dcsync.md | - |
| noPac / sAMAccountName spoofing (CVE-2021-42278/87) | T1558 | CWE-287 | references/ticket-forgery-dcsync.md | - |
| dMSA BadSuccessor (CVE-2025-53779) | T1098, T1558 | CWE-269 | references/dmsa-badsuccessor.md | scripts/Get-BadSuccessorOUPermissions.ps1 |
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/adcs-abuse.md 7.0 KB
- references/bloodhound-enum-lateral.md 7.7 KB
- references/coercion-relay.md 7.2 KB
- references/dmsa-badsuccessor.md 6.5 KB
- references/kerberos-roasting-delegation.md 6.6 KB
- references/ticket-forgery-dcsync.md 6.5 KB
- scripts/ad_recon.py 7.3 KB runs code
- scripts/adcs_esc_finder.py 7.0 KB runs code
- scripts/coerce_relay_chain.sh 3.2 KB runs code
- scripts/Get-BadSuccessorOUPermissions.ps1 5.3 KB runs code
- scripts/kerberoast_audit.py 4.7 KB runs code
- scripts/rbcd_takeover.py 4.4 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 118 lines · 84 tokens per session scan B 4e50cc891aa9
active-directory-attack is a skill published in the GitHub repository hypnguyen1209/offensive-claude (357 stars, last pushed 22d ago), licensed MIT. It adds 84 tokens to every session and 2,784 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bt6-queue-audit
Audit the full pull-request and issue queue of a BT6 research or support repository, classifying readiness, evidence risk, and next action without mutating tracker state.
bt6-issue-steward
Triage and steward issues in BT6 research and support repositories, deciding whether to answer, reproduce, correct evidence, link work, design a feature, route security, implement, or close.
bt6-merge-train
Run an explicitly authorized, conservative BT6 merge train that processes validated pull requests one at a time and reconciles repository, CI, evidence, and issue state after each merge.
bt6-pr-audit
Audit one pull request in a BT6 research or support repository at an exact head SHA, covering correctness, research integrity, security, tests, contracts, and merge readiness.
bt6-provider-review
Audit an external AI/API provider and its integration into a BT6 repository for service reality, independent verification, trust boundaries, secret handling, API/model correctness, completeness, claim traceability, and merge readiness.
xiaohongshu-search-full
Search Xiaohongshu (XHS / RedNote) notes by keyword with full field extraction including body text, topics/tags, image list URLs, video stream URL, publish timestamp, and all engagement stats (likes, collects, comments, shares). Supports all page filter options: sort order (general, latest, most liked, most commented…