Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/oyi77/1ai-skillsnpx agentmods add skills/oyi77/1ai-skills/ad-killerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/oyi77/1ai-skills/ad-killer)<a href="https://agentmods.dev/skills/oyi77/1ai-skills/ad-killer"><img src="https://agentmods.dev/badge/skills/oyi77/1ai-skills/ad-killer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/oyi77/1ai-skills/ad-killer"><img src="https://agentmods.dev/badge/skills/oyi77/1ai-skills/ad-killer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 33 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high YARA Match · line 269 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.07073 |
| Opus 5 | $0.00018 | $0.03537 |
| Sonnet 5 | $0.00007 | $0.01415 |
| Haiku 4.5 | $0.00004 | $0.00707 |
Grade A, and why
ad-killer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 501 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ad Killer
Overview
Compromise Windows Active Directory domains from low-privileged domain user to Domain Admin. Covers the full AD exploitation kill chain: reconnaissance with BloodHound, credential harvesting via Kerberoasting and DCSync, ACL abuse path climbing, ADCS certificate escalation (ESC1-ESC8), and post-exploitation lateral movement across the domain. Every technique maps to MITRE ATT&CK tactics (TA0006 Credential Access, TA0008 Lateral Movement, TA0004 Privilege Escalation).
This skill turns a foothold on one workstation into complete domain compromise, then translates that capability into paid AD penetration testing services for enterprise clients.
When to Use
Trigger phrases:
- "Active Directory penetration test" / "AD security assessment"
- "Domain privilege escalation" / "BloodHound attack path analysis"
- "Kerberoasting / DCSync / ADCS exploitation"
- "Lateral movement in Windows domains"
Scenarios:
- Authorized internal pentest against a Windows domain
- Post-exploitation after gaining initial access to a domain-joined workstation
- AD security audit for compliance (PCI DSS 4.0, SOC 2, ISO 27001)
- Purple team exercise validating AD detection controls
- Ransomware simulation — test if AD misconfigurations accelerate lateral spread
When NOT to Use
- Without signed authorization (ROE document) from the domain owner
- On production domain controllers without prior change management approval
- When the test scope explicitly excludes AD infrastructure
- When you are inside a law enforcement or military AD environment without special written approval
- When the goal is long-term persistence or data theft rather than demonstrating compromise paths
Money-Making Overview
Buyer persona: CISOs and IT directors at mid-market enterprises (200-5,000 employees) who know Active Directory is the backbone of their security but have never had it professionally attacked. These organizations run on AD but have unpatched domain controllers, legacy trusts, weak service account passwords, and misconfigured ACLs. They need to see how a real attacker would move from a workstation to Domain Admin before a ransomware group shows them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 501 lines · 37 tokens per session scan A 63af88c88155
ad-killer is a skill published in the GitHub repository oyi77/1ai-skills (12 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 7,073 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
owasp-top-10-testing
Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design…
abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team…
abusing-shadow-credentials-for-privesc
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows…
application-security-testing
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the…
analyzing-active-directory-acl-abuse
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths.
performing-soap-web-service-security-testing
Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.