MCP App StoreMCP App StoreThis skill transforms an agent into an expert Active Directory security assessor. It provides a structured methodology for auditing AD environments to find misconfigurations, dangerous permissions, and privilege escalation paths.
Use this skill when performing internal network penetration tests or security audits of Windows domain environments, specifically when you have initial credentials and need to map the domain or escalate privileges.
enum4linux-ng, netexec, impacket, certipy-ad, and bloodhound-python.Designed for agents with access to a Kali Linux environment or similar pentesting toolset (e.g., Claude Code, opencode).
This skill has not been reviewed by our automated audit pipeline yet.
Kerberoasting Active Directory
Execute Kerberoasting attacks to extract and crack SPN ticket hashes for privilege escalation in Active Directory.
BOLA & IDOR Hunting
Advanced methodology for detecting Broken Object Level Authorization and Insecure Direct Object References in APIs.
Active Directory Kerberos Attack Playbook
Expert-level guide for executing Kerberos-based attacks in AD environments, including roasting, ticket forging, and delegation abuse.
Analyzing Ransomware Leak Site Intelligence
Collect and analyze ransomware data-leak site (DLS) postings to extract victim, group, sector, and timeline intelligence for threat hunting and risk assessment.
Evaluating Threat Intelligence Platforms
Guides procurement, evaluation, and proof-of-concept testing for Threat Intelligence Platforms (MISP, OpenCTI, ThreatConnect, Anomali, EclecticIQ) based on inte
Performing Threat Modeling with OWASP Threat Dragon
Use OWASP Threat Dragon to create data-flow diagrams, apply STRIDE/LINDDUN threat classifications, and generate threat-model reports to guide secure design revi
Tabletop Exercise Designer
Design and generate CISA-aligned cybersecurity tabletop exercises, facilitator guides, participant materials, technical atomics, and SOP gap analyses for incide
Kali Docker Pentesting
Provides a Kali Linux Docker container with 200+ penetration-testing tools and guidance for running scans, exploitation, and forensics via direct docker exec co
Scanner Skill — Decepticon
High-volume codebase scanner that shards work, ranks suspicious locations, and promotes a concise set of candidates for deeper analysis.
AD Overview (Decepticon)
Playbook and workflows for Active Directory offensive operations: BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync and LAPS extraction.
MITRE ATT&CK T1098 — Account Manipulation
Defensive analysis and guidance for MITRE ATT&CK technique T1098 (Account Manipulation): detection, triage, hunting, and mitigation planning for enterprise envi