Skip to main content
skillsmp

Menu

bloodhound-opengraph

Use when creating or changing BloodHound OpenGraph extensions, custom node schemas, custom ingestors, edge models, or Cypher patterns that connect non-AD assets to BloodHound CE graph analysis. Use for graph-model design questions such as new node kinds, new relationship kinds, extension schema changes, or custom ingestor behavior. Do not use for routine BloodHound path triage, connection checks, or known OpenHound query adaptation; use $bloodhound-analysis, $bloodhound-query, $openhound-github, $openhound-jamf, or $openhound-okta instead.

Jump to installReview files

Source facts

Repository
SpecterOps/skills
Last source activity
August 14, 2026 at 01:16
Detected SKILL.md language
English
Stars
689
Forks
77

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer
4 files

Showing SKILL.md

SKILL.md
Source instructions · Read-only preview
name
bloodhound-opengraph
description
Use when creating or changing BloodHound OpenGraph extensions, custom node schemas, custom ingestors, edge models, or Cypher patterns that connect non-AD assets to BloodHound CE graph analysis. Use for graph-model design questions such as new node kinds, new relationship kinds, extension schema changes, or custom ingestor behavior. Do not use for routine BloodHound path triage, connection checks, or known OpenHound query adaptation; use $bloodhound-analysis, $bloodhound-query, $openhound-github, $openhound-jamf, or $openhound-okta instead.
license
MIT
metadata
{"author":"turbo","version":"0.1.0","category":"security"}
# BloodHound OpenGraph Skill Use this skill when creating custom BloodHound schema/extensions, ingestors, or attack-path queries that require graph-model customization. For standard OpenHound GitHub/Jamf/Okta analysis, use the matching OpenHound domain skill instead. ## Input Contract - Context describing the required extension (new node/edge types, ingestor data source, Cypher query need). ## Workflow 1. Read `../../references/docs/opengraph-extension-management.md` before making schema/install/upload recommendations. 2. Read `../../references/docs/collector-source-index.md` for GitHound, JamfHound, OktaHound, and SCIM source context. 3. Inspect `../../references/examples/node-edge-reference.md` and `../../references/examples/example-cypher.md` before proposing custom labels, edges, or queries. 4. For SCIM bridge modeling, read `../../references/docs/scim-methodology.md` and preserve `SCIM_*` labels/edges. 5. Separate extension schema design from collector implementation, saved queries, privilege-zone rules, and data payload upload steps. ## Output - Documentation or code for custom node/edge definitions, ingestors, or Cypher queries aligned with BloodHound CE or OpenGraph extensions. - Notes about performance, compatibility, and MITRE technique relevance. ## Notes - This capability is flagged as in-development and may require extra data/model tuning later. - Share the TODO tag `bloodhound-opengraph:in-progress` when passing the idea to other agents.
View on GitHub
Back to searchBack to installation