adcs-access-and-relay
Warn
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing complex and intrusive security tools used for exploiting Active Directory, such as Certipy, Certify.exe, and Rubeus. These tools are used to modify certificate templates and request unauthorized certificates.
- [COMMAND_EXECUTION]: Includes a 'Handoff protocol' for privileged operations involving
sudo(e.g., ntlmrelayx.py, mitm6). The agent is instructed to present these commands to the user for manual execution rather than attempting to execute them directly. - [DATA_EXFILTRATION]: Instructs the agent to systematically save sensitive findings, including dumped credentials, session tokens, and target configurations, to a local
evidence/directory for later retrieval. - [REMOTE_CODE_EXECUTION]: The skill relies on several external, standalone Python scripts (e.g., modifyCertTemplate.py, PetitPotam.py, dementor.py, dfscoerce.py) to perform NTLM relay and coercion attacks. Execution of these third-party scripts is central to the skill's functionality.
Audit Metadata