How do I install the Bloodhound skill?

Run npx skillmds@latest add timsonner/bloodhound in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Bloodhound safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Bloodhound?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Bloodhound free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Bloodhound?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Bloodhound by timsonner — Agent Skill

Name: Bloodhound
Author: timsonner

Bloodhound

Use for Active Directory relationship analysis during authorized internal assessments. Trigger on AD path mapping, privilege chain review, delegated access analysis, and understanding how directory relationships affect attacker movement.

timsonner a98199a 2.5 KB Updated Sep 17, 2026

File contents

BloodHound

Purpose

Use this skill to analyze Active Directory relationships and privilege paths after scope and collection boundaries are clearly defined.

Phase Fit

Primary: Threat Modeling and Test Planning, Vulnerability Analysis
Secondary: Retest and Closure

Use When

Need to understand privilege paths, delegation issues, or relationship-driven attack paths.
Need to prioritize AD findings by practical movement potential.
Need to retest whether a privilege path was removed.

Avoid When

Domain collection scope is not explicit.
Broad collection would exceed the approved impact level.

Inputs

Approved domain, collectors, and credential context
Narrow collection scope aligned to the current objective
Evidence handling rules for AD graph data

Procedure

Limit collection to the minimum scope needed for the question.
Review relationship paths that materially change privilege or data exposure.
Correlate graph findings with real hosts, groups, and business impact.
Avoid presenting theoretical paths as confirmed compromise.
Preserve the exact collection scope for retest.

Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

# Collect all data using bloodhound-python (agentless, remote)
bloodhound-python -u auditor -p '<password>' -d contoso.com -c All -ns 10.10.10.10 -o contoso-bh/

# DC-only collection (faster, less noisy)
bloodhound-python -u auditor -p '<password>' -d contoso.com -c DCOnly -ns 10.10.10.10

# Pass-the-Hash collection
bloodhound-python -u auditor --hashes :<NTLM_hash> -d contoso.com -c All -ns 10.10.10.10

# Target a specific domain controller
bloodhound-python -u auditor -p '<password>' -d contoso.com -c All --dc dc01.contoso.com

# Launch GUI for analysis
bloodhound

# SharpHound collection from Windows (run on target)
# SharpHound.exe -c All -d contoso.com --outputdirectory C:\temp\bh\

Evidence to Capture

Material privilege paths and delegated access issues
Nodes and relationships that create real risk
Exact collection scope and credential context

Safety Boundaries

Keep collection narrow and approved.
Treat graph relationships as analysis leads until validated against the environment.

---name: bloodhounddescription: Use for Active Directory relationship analysis during authorized internal assessments. Trigger on AD path mapping, privilege chain review, delegated access analysis, and understanding how directory relationships affect attacker movement.license: MIT---# BloodHound## PurposeUse this skill to analyze Active Directory relationships and privilege paths after scope and collection boundaries are clearly defined.## Phase Fit- Primary: Threat Modeling and Test Planning, Vulnerability Analysis- Secondary: Retest and Closure## Use When- Need to understand privilege paths, delegation issues, or relationship-driven attack paths.- Need to prioritize AD findings by practical movement potential.- Need to retest whether a privilege path was removed.## Avoid When- Domain collection scope is not explicit.- Broad collection would exceed the approved impact level.## Inputs- Approved domain, collectors, and credential context- Narrow collection scope aligned to the current objective- Evidence handling rules for AD graph data## Procedure1. Limit collection to the minimum scope needed for the question.2. Review relationship paths that materially change privilege or data exposure.3. Correlate graph findings with real hosts, groups, and business impact.4. Avoid presenting theoretical paths as confirmed compromise.5. Preserve the exact collection scope for retest.## Command SyntaxReplace sample targets with approved in-scope assets and authorized credentials.```bash# Collect all data using bloodhound-python (agentless, remote)bloodhound-python -u auditor -p '<password>' -d contoso.com -c All -ns 10.10.10.10 -o contoso-bh/# DC-only collection (faster, less noisy)bloodhound-python -u auditor -p '<password>' -d contoso.com -c DCOnly -ns 10.10.10.10# Pass-the-Hash collectionbloodhound-python -u auditor --hashes :<NTLM_hash> -d contoso.com -c All -ns 10.10.10.10# Target a specific domain controllerbloodhound-python -u auditor -p '<password>' -d contoso.com -c All --dc dc01.contoso.com# Launch GUI for analysisbloodhound# SharpHound collection from Windows (run on target)# SharpHound.exe -c All -d contoso.com --outputdirectory C:\temp\bh\```## Evidence to Capture- Material privilege paths and delegated access issues- Nodes and relationships that create real risk- Exact collection scope and credential context## Safety Boundaries- Keep collection narrow and approved.- Treat graph relationships as analysis leads until validated against the environment.

Frequently asked questions