Security Audit
Active Directory Attacks
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
Active Directory Attacks received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Skill contains numerous commands for Active Directory exploitation.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit 9f5351e8). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Skill contains numerous commands for Active Directory exploitation The skill 'Active Directory Attacks' provides a comprehensive guide to offensive security techniques against Microsoft Active Directory. It includes numerous `bash` and `powershell` commands for tools like Impacket, Mimikatz, Rubeus, CrackMapExec, and various CVE exploits (ZeroLogon, PrintNightmare, samAccountName Spoofing). These commands are designed to perform reconnaissance, credential harvesting, privilege escalation, lateral movement, and domain dominance. Given the 'claude_code' ecosystem, if the LLM is configured to execute code from skills, or if a user is prompted to execute these commands without proper sandboxing, it poses a critical command injection risk, potentially leading to the compromise of the host system or connected networks. The skill should explicitly state that these commands are for educational/simulated environments only and should never be executed on production systems or by the LLM without strict sandboxing. For an LLM execution environment, these commands should be blocked, require explicit user confirmation, and be executed within a highly isolated and ephemeral sandbox. | LLM | SKILL.md:137 |
Scan History
Embed Code
[](https://skillshield.io/report/d41416bf09eed50e)
Powered by SkillShield