How do I install the Bloodhound Query skill?

Run npx skillmds@latest add specterops/bloodhound-query in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Bloodhound Query safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Bloodhound Query?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Bloodhound Query free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Bloodhound Query?

specterops (@specterops) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Bloodhound Query by specterops — Agent Skill

Name: Bloodhound Query
Author: specterops

Bloodhound Query

Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested.

specterops Updated Sep 21, 2026

File contents

BloodHound Query Workflow

Use this as the shared query authoring/review workflow across BloodHound, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, and custom OpenGraph graphs.

Direct triggers

Use this skill when the task mentions any of the following:

write a BloodHound query
write Cypher
explain this Cypher
review this query
optimize this BloodHound query
adapt this saved query
turn this path question into Cypher
validate this BloodHound query

Route to instead

Use $bloodhound-analysis for generic BloodHound asks or initial graph triage.
Use the domain skill when the path question is clear and the user is asking for findings rather than query authoring: $bloodhound-ad-analysis, $azurehound-analysis, $openhound-github, $openhound-jamf, or $openhound-okta.

Required context

Confirm the assessment/lab is authorized and in scope.
Identify the graph domain and available collectors/extensions.
If live BloodHound MCP access is unavailable, produce a query/workflow plan and clearly avoid claiming observed graph facts.

Workflow

Read ../../references/docs/bloodhound-query-methodology.md.
Choose the domain skill when the graph is known: $bloodhound-ad-analysis, $azurehound-analysis, $openhound-github, $openhound-jamf, or $openhound-okta.
Use ../../references/docs/source-index.md to locate the matching query index and snapshots.
Adapt a saved-query pattern first; only invent a new query when no pattern fits.
For OpenGraph work, inspect ../../references/examples/example-cypher.md and ../../references/examples/node-edge-reference.md before inventing labels or edge kinds.
For SCIM/hybrid identity work, read ../../references/docs/scim-methodology.md and document each bridge edge explicitly.
Keep the query read-only, bounded, label-specific, and explicit about relationship direction.
Return the query with parameters, expected result shape, analysis guidance, caveats, and next queries.

Output contract

Query
Parameters to replace
Purpose
Expected result shape
Analysis guidance
Caveats / data-quality assumptions
Next queries

---name: bloodhound-querydescription: Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested.license: MIT---# BloodHound Query WorkflowUse this as the shared query authoring/review workflow across BloodHound, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, and custom OpenGraph graphs.## Direct triggersUse this skill when the task mentions any of the following:- write a BloodHound query- write Cypher- explain this Cypher- review this query- optimize this BloodHound query- adapt this saved query- turn this path question into Cypher- validate this BloodHound query## Route to instead- Use `$bloodhound-analysis` for generic BloodHound asks or initial graph triage.- Use the domain skill when the path question is clear and the user is asking for findings rather than query authoring: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`.## Required context- Confirm the assessment/lab is authorized and in scope.- Identify the graph domain and available collectors/extensions.- If live BloodHound MCP access is unavailable, produce a query/workflow plan and clearly avoid claiming observed graph facts.## Workflow1. Read `../../references/docs/bloodhound-query-methodology.md`.2. Choose the domain skill when the graph is known: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`.3. Use `../../references/docs/source-index.md` to locate the matching query index and snapshots.4. Adapt a saved-query pattern first; only invent a new query when no pattern fits.5. For OpenGraph work, inspect `../../references/examples/example-cypher.md` and `../../references/examples/node-edge-reference.md` before inventing labels or edge kinds.6. For SCIM/hybrid identity work, read `../../references/docs/scim-methodology.md` and document each bridge edge explicitly.7. Keep the query read-only, bounded, label-specific, and explicit about relationship direction.8. Return the query with parameters, expected result shape, analysis guidance, caveats, and next queries.## Output contract- Query- Parameters to replace- Purpose- Expected result shape- Analysis guidance- Caveats / data-quality assumptions- Next queries

Frequently asked questions