Skip to content
Agentmart
Submit a tool

azurehound-analysis

Use for AzureHound and BloodHound Azure or Entra ID attack-path work when the user clearly means Azure semantics such as Global Administrator, privileged…

Skill by GhostWorks

IndexedAGPL-3.0
Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/ijlalhaider313-azurehound-analysis

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Use for AzureHound and BloodHound Azure or Entra ID attack-path work when the user clearly means Azure semantics such as Global Administrator, privileged Entra roles, service principals, applications, app roles, managed identities, subscriptions, resource groups, VMs, Key Vaults, or hybrid AD/Azure paths. Do not use for generic BloodHound connection checks, unclear graph-domain triage, explicit Cypher authoring/review, or OpenGraph schema-extension work.

Use cases: cloud, marketing

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools
No tools found
Secrets
None asked for
Install scripts
None found

Network hosts it talks to 1

  • codeload.github.com · found in install command

Files it touches

  • ~/.claude/skills/azurehound-analysis

What's inside

Skill name
azurehound-analysis
Description
Use for AzureHound and BloodHound Azure or Entra ID attack-path work when the user clearly means Azure semantics such as Global Administrator, privileged Entra roles, service principals, applications, app roles, managed identities, subscriptions, resource groups, VMs, Key Vaults, or hybrid AD/Azure paths. Do not use for generic BloodHound connection checks, unclear graph-domain triage, explicit Cypher authoring/review, or OpenGraph schema-extension work.
License
AGPL-3.0
Metadata
author: GhostWorks
Instructions
32 lines in SKILL.md · view on GitHub

Files (3)

  • SKILL.md
  • icon.png · assets/
  • icon.svg · assets/

SKILL.md (first lines)

# AzureHound

Use this skill for AzureHound / Entra ID BloodHound query design and attack-path triage.

## Required context

- Authorized Azure tenants/subscriptions and whether AzureHound/Entra collection is present.
- Known object IDs, tenant names, privileged roles, subscriptions, or resource scopes.
- Hybrid collection availability when paths cross AD, GitHub, Okta, or SCIM.

## Workflow

1. Read `../../references/docs/bloodhound-query-methodology.md` and `../../references/docs/azurehound-methodology.md`.
2. Search `../../references/query-indexes/azurehound.md` for a matching Query Library pattern.
3. Inspect the snapshot and confirm `AZ*` labels/edges before adapting.
4. Use exact `objectid` filters when possible and bound broad tenant paths.
5. Explain each path segment by platform and collector source.

## Common pivots

- Users/groups/service principals to privileged Entra roles.
- App owners, app role assignments, credentials, and Graph API permission edges.
- Managed identities to Azure resources.
- Subscription/resource group/VM/Key Vault control paths.
- AAD/Entra Connect and synced identity bridges.
- GitHub/OIDC or Okta/SCIM hybrid paths when data is present.

## Output

Use the shared output contract from `$bloodhound-query` and include Azure-specific caveats such as display-name ambiguity, tenant-scale query cost, non-traversable Graph API edges, and collector freshness.

From ijlalhaider313/ARTEX, AGPL-3.0.

More from ijlalhaider313/ARTEX

Signals

Stars
0
Forks
0
Open issues
0
Last commit (this folder)
Oct 11, 2026 (19 days ago)

From GitHub (fetched Oct 24, 2026).

Details

License
AGPL-3.0
Repository
github.com/ijlalhaider313/ARTEX
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

More from GhostWorks

Cite this page

azurehound-analysis skill. Agent Mart. https://agentmart.dev/skills/ijlalhaider313-azurehound-analysis (last updated 2026-10-24)