# openhound-jamf

Use for OpenHound Jamf/JamfHound OpenGraph BloodHound work when the user clearly means Jamf semantics such as Jamf tenant, site, account, group, computer, API-client exposure, Tier 1 to Tier 0 paths, policy/script/profile management privileges, traversable Jamf edges, Jamf SSO links, Okta/Jamf hybrid links, or Jamf device-management attack-path analysis. Do not use for generic BloodHound path triage, connection checks, explicit Cypher authoring/review, or non-Jamf OpenGraph domains.

- **Kind:** skill
- **Source:** https://github.com/SpecterOps/skills
- **Page:** https://forefy.com/skills/44e15884-2b00-4e1b-8aff-f03b77071c5c
- **API (JSON + files):** https://forefy.com/api/asr/44e15884-2b00-4e1b-8aff-f03b77071c5c

---

## SKILL.md

---
name: openhound-jamf
description: "Use for OpenHound Jamf/JamfHound OpenGraph BloodHound work when the user clearly means Jamf semantics such as Jamf tenant, site, account, group, computer, API-client exposure, Tier 1 to Tier 0 paths, policy/script/profile management privileges, traversable Jamf edges, Jamf SSO links, Okta/Jamf hybrid links, or Jamf device-management attack-path analysis. Do not use for generic BloodHound path triage, connection checks, explicit Cypher authoring/review, or non-Jamf OpenGraph domains."
license: MIT
metadata:
  author: turbo
  version: "0.1.0"
  category: security
---

# OpenHound Jamf / JamfHound

Use this skill for OpenHound Jamf OpenGraph query design and attack-path triage with JamfHound/OpenHound Jamf data.

## Required context

- Authorized Jamf tenants/sites and managed device scope.
- Whether JamfHound/OpenHound Jamf extension/schema/data is loaded.
- Collector account type/permissions, Jamf Cloud vs on-prem context, and site scoping.
- Target accounts, groups, API clients, sites, computers, tenant objects, policies, scripts, or profiles.

## Workflow

1. Read `../../references/docs/bloodhound-query-methodology.md`, `../../references/docs/openhound-jamf-methodology.md`, and `../../references/docs/collector-source-index.md`.
2. Inspect JamfHound schema/object examples under `../../references/examples/jamfhound/` when node/property shape matters.
3. Search `../../references/query-indexes/openhound-jamf.md` and `../../references/examples/example-cypher.md` for a saved-search starting point.
4. Inspect the referenced JSON snapshot before adapting.
5. Preserve `jamf_` labels/edges and `r.traversable = True` filters where the source query uses them.
6. Distinguish tenant-wide paths from site-scoped permissions and identify hybrid identity/device bridge assumptions.

## Common pivots

- Accounts/groups/API clients to tenant administration.
- Site-scoped admin paths to managed computers.
- Policy/script/profile creation or modification control.
- Disabled principal hygiene and stale access.
- Jamf paths linked to SSO/identity providers when hybrid data exists.
- Okta/Jamf hybrid device-management paths when OktaHound or another collector produced bridge data.

## Output

Use the shared output contract from `$bloodhound-query` and include Jamf-specific caveats such as site scoping, collector account privilege, disabled-account interpretation, extension/schema availability, hybrid bridge availability, and managed-device collection completeness.

## agents

```

```

## agents/openai.yaml

```yaml
interface:
  display_name: "JamfHound / OpenHound Jamf"
  short_description: "Analyze Jamf device, account, and hybrid paths."
  icon_small: ./assets/icon.svg
  icon_large: ./assets/icon.png
  default_prompt: "Use $openhound-jamf to analyze JamfHound/OpenHound Jamf tenant, site, account, group, API-client, policy, script, profile, computer, and hybrid identity/device attack paths."
  brand_color: "#991B1B"

policy:
  allow_implicit_invocation: true
```

## assets

```

```

## assets/icon.png

```

```

## assets/icon.svg

```

```