performing-active-directory-bloodhound-analysis

SUSPICIOUS/HIGH-RISK skill. The capabilities align with its stated purpose, but that purpose is an offensive AD enumeration and privilege-escalation workflow for an AI agent, including AMSI bypass and credentialed collection. The main install-trust issue is the outdated ghst.ly pipe-to-docker pattern; same-ecosystem provenance reduces malware confidence, but the overall skill still meaningfully increases security risk by enabling agent-driven recon and attack-path discovery.

This artifact is not executable code, but it is highly actionable offensive Active Directory exploitation and credential-theft guidance tightly coupled to BloodHound edge semantics. While the excerpt itself contains no direct network/process/credential-dumping implementation, embedding such tradecraft in a distributed dependency is a significant supply-chain red flag and suggests the surrounding package/repo may be intended for malicious use or contains additional malicious functionality not shown here.