How do I install the Sharphound skill?

Run npx skillmds@latest add timsonner/sharphound in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sharphound safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sharphound?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sharphound free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Sharphound?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sharphound by timsonner — Agent Skill

Name: Sharphound
Author: timsonner

Sharphound

Use for Active Directory graph collection during authorized pentests. Trigger on approved AD relationship mapping, privilege-path review, local admin exposure review, and generating focused data for BloodHound analysis.

timsonner f162e60 2.3 KB Updated Sep 17, 2026

File contents

SharpHound

Purpose

Use this skill when the methodology needs focused AD graph collection for later path analysis, and the domain collection scope is explicitly approved.

Phase Fit

Primary: Threat Modeling and Test Planning, Vulnerability Analysis
Secondary: Retest and Closure

Use When

Need to map privilege relationships, session exposure, or local admin paths.
Need to generate input for bloodhound analysis.
Need a repeatable retest after AD path remediation.

Avoid When

Broad collection scope is not explicitly approved.
The environment cannot tolerate the chosen collection mode.

Inputs

Approved domain and collection scope
Authorized credential context if needed
Output handling rules for collected graph data

Procedure

Limit collection to the minimum methods needed for the question.
Record exact collection scope, host, and account context.
Analyze only the relationships that materially affect privilege or exposure.
Avoid presenting unvalidated graph theory as confirmed compromise.
Preserve the exact collection profile for retest.

Command Syntax

Replace sample collection sets with the minimum approved scope.

:: Collect all data methods
SharpHound.exe -c All

:: Session and local admin collection only
SharpHound.exe -c Session,LocalAdmin

:: Collect against a specific domain
SharpHound.exe -c All -d contoso.com

:: DC-only collection (faster, less noisy)
SharpHound.exe -c DCOnly --ldapusername auditor --ldappassword '<password>'

:: Output to a specific directory with custom zip name
SharpHound.exe -c All --outputdirectory C:\temp\bh\ --zipfilename contoso-bh.zip

:: Stealth collection (computer-targeted only)
SharpHound.exe -c ComputerOnly --stealth

Evidence to Capture

Material AD relationships and paths uncovered by the approved collection
Exact collection scope and credential context used
Output files needed for later analysis or retest

Safety Boundaries

Keep collection narrowly scoped and approved.
Protect graph data as sensitive evidence.

---name: sharphounddescription: Use for Active Directory graph collection during authorized pentests. Trigger on approved AD relationship mapping, privilege-path review, local admin exposure review, and generating focused data for BloodHound analysis.license: MIT---# SharpHound## PurposeUse this skill when the methodology needs focused AD graph collection for later path analysis, and the domain collection scope is explicitly approved.## Phase Fit- Primary: Threat Modeling and Test Planning, Vulnerability Analysis- Secondary: Retest and Closure## Use When- Need to map privilege relationships, session exposure, or local admin paths.- Need to generate input for `bloodhound` analysis.- Need a repeatable retest after AD path remediation.## Avoid When- Broad collection scope is not explicitly approved.- The environment cannot tolerate the chosen collection mode.## Inputs- Approved domain and collection scope- Authorized credential context if needed- Output handling rules for collected graph data## Procedure1. Limit collection to the minimum methods needed for the question.2. Record exact collection scope, host, and account context.3. Analyze only the relationships that materially affect privilege or exposure.4. Avoid presenting unvalidated graph theory as confirmed compromise.5. Preserve the exact collection profile for retest.## Command SyntaxReplace sample collection sets with the minimum approved scope.```cmd:: Collect all data methodsSharpHound.exe -c All:: Session and local admin collection onlySharpHound.exe -c Session,LocalAdmin:: Collect against a specific domainSharpHound.exe -c All -d contoso.com:: DC-only collection (faster, less noisy)SharpHound.exe -c DCOnly --ldapusername auditor --ldappassword '<password>':: Output to a specific directory with custom zip nameSharpHound.exe -c All --outputdirectory C:\temp\bh\ --zipfilename contoso-bh.zip:: Stealth collection (computer-targeted only)SharpHound.exe -c ComputerOnly --stealth```## Evidence to Capture- Material AD relationships and paths uncovered by the approved collection- Exact collection scope and credential context used- Output files needed for later analysis or retest## Safety Boundaries- Keep collection narrowly scoped and approved.- Protect graph data as sensitive evidence.

Frequently asked questions