bloodhound-query
Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested.
Source facts
- Repository
- SpecterOps/skills
- Last source activity
- August 14, 2026 at 01:16
- Detected SKILL.md language
- English
- Stars
- 657
- Forks
- 72
Install options
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Review the source files
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
File Explorer
4 filesShowing SKILL.md
SKILL.md
Source instructions · Read-only preview- name
- bloodhound-query
- description
- Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested.
- license
- MIT
- metadata
- {"author":"turbo","version":"0.1.0","category":"security"}
# BloodHound Query Workflow
Use this as the shared query authoring/review workflow across BloodHound, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, and custom OpenGraph graphs.
## Direct triggers
Use this skill when the task mentions any of the following:
- write a BloodHound query
- write Cypher
- explain this Cypher
- review this query
- optimize this BloodHound query
- adapt this saved query
- turn this path question into Cypher
- validate this BloodHound query
## Route to instead
- Use `$bloodhound-analysis` for generic BloodHound asks or initial graph triage.
- Use the domain skill when the path question is clear and the user is asking for findings rather than query authoring: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`.
## Required context
- Confirm the assessment/lab is authorized and in scope.
- Identify the graph domain and available collectors/extensions.
- If live BloodHound MCP access is unavailable, produce a query/workflow plan and clearly avoid claiming observed graph facts.
## Workflow
1. Read `../../references/docs/bloodhound-query-methodology.md`.
2. Choose the domain skill when the graph is known: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`.
3. Use `../../references/docs/source-index.md` to locate the matching query index and snapshots.
4. Adapt a saved-query pattern first; only invent a new query when no pattern fits.
5. For OpenGraph work, inspect `../../references/examples/example-cypher.md` and `../../references/examples/node-edge-reference.md` before inventing labels or edge kinds.
6. For SCIM/hybrid identity work, read `../../references/docs/scim-methodology.md` and document each bridge edge explicitly.
7. Keep the query read-only, bounded, label-specific, and explicit about relationship direction.
8. Return the query with parameters, expected result shape, analysis guidance, caveats, and next queries.
## Output contract
- Query
- Parameters to replace
- Purpose
- Expected result shape
- Analysis guidance
- Caveats / data-quality assumptions
- Next queries
View on GitHub