How do I install the Ad Overview skill?

Run npx skillmds@latest add purpleailab/ad-overview in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Ad Overview skill do?

Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction. It is listed under Coding & Dev Tools on SkillMD.

Is Ad Overview safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ad Overview?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ad Overview free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ad Overview?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ad Overview by purpleailab — Agent Skill

Name: Ad Overview
Author: purpleailab

File contents

AD Operator Skill Catalog

Playbooks

Skill	Use for
`/skills/standard/ad/bloodhound-query/SKILL.md`	Ingest + common Cypher queries
`/skills/standard/ad/kerberoasting/SKILL.md`	Roast SPN users, crack with hashcat
`/skills/standard/ad/asrep-roasting/SKILL.md`	dontreqpreauth users
`/skills/standard/ad/adcs-esc1/SKILL.md`	ESC1 template abuse → domain admin
`/skills/standard/ad/dcsync/SKILL.md`	Replication rights → krbtgt dump
`/skills/standard/ad/laps/SKILL.md`	LAPS local admin password extraction
`/skills/standard/ad/netexec/SKILL.md`	NetExec (formerly CrackMapExec) cheatsheet — SMB/WinRM/LDAP/MSSQL modules

Workflow

Collect: bash("bloodhound-python -u user -p pass -d DOMAIN -c all --zip")
bh_ingest_zip("/workspace/bh.zip")
dcsync_check — if any principal, that's instant domain compromise
kg_query(kind="user") and filter for hasspn=true → Kerberoast queue
kg_query(kind="user") and filter for dontreqpreauth=true → AS-REP roast
ADCS: bash("certipy find -u user -p pass -dc-ip X -json") then adcs_audit
plan_attack_chains to see graph-computed domain compromise paths

Crown jewels to add

kg_add_node(kind="crown_jewel", label="Domain Admins group")
kg_add_node(kind="crown_jewel", label="krbtgt account")
kg_add_node(kind="crown_jewel", label="DC: DC01.corp.local")

Frequently asked questions

Ad Overview