Skip to main content
skillsmp

Menú

bloodhound-query

Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested.

Ir a la instalación

Datos de origen

Repositorio
SpecterOps/skills
Última actividad en el origen
14 de agosto de 2026 a las 01:16
Idioma detectado de SKILL.md
inglés
Estrellas
657
Forks
72

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos
4 archivos

Mostrando SKILL.md

SKILL.md
Instrucciones de origen · Vista previa de solo lectura
name
bloodhound-query
description
Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested.
license
MIT
metadata
{"author":"turbo","version":"0.1.0","category":"security"}
# BloodHound Query Workflow Use this as the shared query authoring/review workflow across BloodHound, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, and custom OpenGraph graphs. ## Direct triggers Use this skill when the task mentions any of the following: - write a BloodHound query - write Cypher - explain this Cypher - review this query - optimize this BloodHound query - adapt this saved query - turn this path question into Cypher - validate this BloodHound query ## Route to instead - Use `$bloodhound-analysis` for generic BloodHound asks or initial graph triage. - Use the domain skill when the path question is clear and the user is asking for findings rather than query authoring: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`. ## Required context - Confirm the assessment/lab is authorized and in scope. - Identify the graph domain and available collectors/extensions. - If live BloodHound MCP access is unavailable, produce a query/workflow plan and clearly avoid claiming observed graph facts. ## Workflow 1. Read `../../references/docs/bloodhound-query-methodology.md`. 2. Choose the domain skill when the graph is known: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`. 3. Use `../../references/docs/source-index.md` to locate the matching query index and snapshots. 4. Adapt a saved-query pattern first; only invent a new query when no pattern fits. 5. For OpenGraph work, inspect `../../references/examples/example-cypher.md` and `../../references/examples/node-edge-reference.md` before inventing labels or edge kinds. 6. For SCIM/hybrid identity work, read `../../references/docs/scim-methodology.md` and document each bridge edge explicitly. 7. Keep the query read-only, bounded, label-specific, and explicit about relationship direction. 8. Return the query with parameters, expected result shape, analysis guidance, caveats, and next queries. ## Output contract - Query - Parameters to replace - Purpose - Expected result shape - Analysis guidance - Caveats / data-quality assumptions - Next queries
Ver en GitHub
Volver a la búsquedaVolver a la instalación