How do I install the Azurehound Analysis skill?

Run npx skillmds@latest add specterops/azurehound-analysis in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Azurehound Analysis safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Azurehound Analysis?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Azurehound Analysis free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Azurehound Analysis?

specterops (@specterops) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Azurehound Analysis by specterops — Agent Skill

Name: Azurehound Analysis
Author: specterops

Azurehound Analysis

Use for AzureHound and BloodHound Azure or Entra ID attack-path work when the user clearly means Azure semantics such as Global Administrator, privileged Entra roles, service principals, applications, app roles, managed identities, subscriptions, resource groups, VMs, Key Vaults, or hybrid AD/Azure paths. Do not use for generic BloodHound connection checks, unclear graph-domain triage, explicit Cypher authoring/review, or OpenGraph schema-extension work.

specterops Updated Sep 21, 2026

File contents

AzureHound

Use this skill for AzureHound / Entra ID BloodHound query design and attack-path triage.

Required context

Authorized Azure tenants/subscriptions and whether AzureHound/Entra collection is present.
Known object IDs, tenant names, privileged roles, subscriptions, or resource scopes.
Hybrid collection availability when paths cross AD, GitHub, Okta, or SCIM.

Workflow

Read ../../references/docs/bloodhound-query-methodology.md and ../../references/docs/azurehound-methodology.md.
Search ../../references/query-indexes/azurehound.md for a matching Query Library pattern.
Inspect the snapshot and confirm AZ* labels/edges before adapting.
Use exact objectid filters when possible and bound broad tenant paths.
Explain each path segment by platform and collector source.

Common pivots

Users/groups/service principals to privileged Entra roles.
App owners, app role assignments, credentials, and Graph API permission edges.
Managed identities to Azure resources.
Subscription/resource group/VM/Key Vault control paths.
AAD/Entra Connect and synced identity bridges.
GitHub/OIDC or Okta/SCIM hybrid paths when data is present.

Output

Use the shared output contract from $bloodhound-query and include Azure-specific caveats such as display-name ambiguity, tenant-scale query cost, non-traversable Graph API edges, and collector freshness.

Frequently asked questions