# bloodhound-opengraph

Use when creating or changing BloodHound OpenGraph extensions, custom node schemas, custom ingestors, edge models, or Cypher patterns that connect non-AD assets to BloodHound CE graph analysis. Use for graph-model design questions such as new node kinds, new relationship kinds, extension schema changes, or custom ingestor behavior. Do not use for routine BloodHound path triage, connection checks, or known OpenHound query adaptation; use $bloodhound-analysis, $bloodhound-query, $openhound-github, $openhound-jamf, or $openhound-okta instead.

- **Kind:** skill
- **Source:** https://github.com/SpecterOps/skills
- **Page:** https://forefy.com/skills/1a331afb-b3e6-4cd2-8cd0-aa43be4cedc5
- **API (JSON + files):** https://forefy.com/api/asr/1a331afb-b3e6-4cd2-8cd0-aa43be4cedc5

---

## SKILL.md

---
name: bloodhound-opengraph
description: "Use when creating or changing BloodHound OpenGraph extensions, custom node schemas, custom ingestors, edge models, or Cypher patterns that connect non-AD assets to BloodHound CE graph analysis. Use for graph-model design questions such as new node kinds, new relationship kinds, extension schema changes, or custom ingestor behavior. Do not use for routine BloodHound path triage, connection checks, or known OpenHound query adaptation; use $bloodhound-analysis, $bloodhound-query, $openhound-github, $openhound-jamf, or $openhound-okta instead."
license: MIT
metadata:
  author: turbo
  version: "0.1.0"
  category: security
---

# BloodHound OpenGraph Skill

Use this skill when creating custom BloodHound schema/extensions, ingestors, or attack-path queries that require graph-model customization. For standard OpenHound GitHub/Jamf/Okta analysis, use the matching OpenHound domain skill instead.

## Input Contract
- Context describing the required extension (new node/edge types, ingestor data source, Cypher query need).

## Workflow
1. Read `../../references/docs/opengraph-extension-management.md` before making schema/install/upload recommendations.
2. Read `../../references/docs/collector-source-index.md` for GitHound, JamfHound, OktaHound, and SCIM source context.
3. Inspect `../../references/examples/node-edge-reference.md` and `../../references/examples/example-cypher.md` before proposing custom labels, edges, or queries.
4. For SCIM bridge modeling, read `../../references/docs/scim-methodology.md` and preserve `SCIM_*` labels/edges.
5. Separate extension schema design from collector implementation, saved queries, privilege-zone rules, and data payload upload steps.

## Output
- Documentation or code for custom node/edge definitions, ingestors, or Cypher queries aligned with BloodHound CE or OpenGraph extensions.
- Notes about performance, compatibility, and MITRE technique relevance.

## Notes
- This capability is flagged as in-development and may require extra data/model tuning later.
- Share the TODO tag `bloodhound-opengraph:in-progress` when passing the idea to other agents.

## agents

```

```

## agents/openai.yaml

```yaml
interface:
  display_name: "BloodHound OpenGraph"
  short_description: "Design BloodHound OpenGraph schemas and ingestors."
  icon_small: ./assets/icon.svg
  icon_large: ./assets/icon.png
  brand_color: "#7F1D1D"
  default_prompt: "Use $bloodhound-opengraph to design or review BloodHound OpenGraph nodes, relationships, schemas, ingestors, extension management, SCIM bridges, or custom collector behavior."

dependencies:
  tools:
    - type: "mcp"
      value: "bloodhound_mcp"
      description: "BloodHound CE MCP server with custom_nodes and Cypher support"
      transport: "stdio"

policy:
  allow_implicit_invocation: true
```

## assets

```

```

## assets/icon.png

```

```

## assets/icon.svg

```

```