The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous commands for Active Directory exploitation, including modifying permissions, resetting passwords, and manipulating Group Policy Objects using tools like SharpHound.exe, Whisker.exe, and Impacket scripts. These are standard offensive security procedures for the intended red-teaming use case.
[PRIVILEGE_ESCALATION]: The skill details methods to escalate privileges within an Active Directory environment, such as exploiting GenericAll or WriteDACL permissions to gain DCSync rights or Domain Admin membership.
[PERSISTENCE]: The skill includes methods for achieving persistence using Group Policy Objects (GPO), specifically through scheduled tasks and startup scripts configured via SharpGPOAbuse.exe or pygpoabuse.py.
[INDIRECT_PROMPT_INJECTION]: The skill instructions involve processing and acting upon data retrieved from Active Directory objects (e.g., computer and user descriptions). Malicious content placed in these fields by an attacker could potentially influence the behavior of an agent executing these playbooks.
Ingestion points: Active Directory object attributes such as descriptions (e.g., in BLOODHOUND_PATHS.md Cypher queries searching for passwords in descriptions).
Boundary markers: Absent.
Capability inventory: Subprocess execution for tools like SharpHound.exe, secretsdump.py, and SharpGPOAbuse.exe across both SKILL.md and BLOODHOUND_PATHS.md.
Sanitization: Absent.

active-directory-acl-abuse