# bloodhound-query

Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested.

- **Kind:** skill
- **Source:** https://github.com/SpecterOps/skills
- **Page:** https://forefy.com/skills/f039aa4d-48a7-472d-a5ab-82ebdba521d2
- **API (JSON + files):** https://forefy.com/api/asr/f039aa4d-48a7-472d-a5ab-82ebdba521d2

---

## SKILL.md

---
name: bloodhound-query
description: "Use when the user explicitly wants BloodHound Cypher or query work: write a BloodHound query, review or explain Cypher, optimize a query, adapt a saved query, validate query safety or performance, convert a graph question into query syntax, or design follow-up graph questions across BloodHound CE/BHE, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, or other OpenGraph data. Do not use as the default entry skill for generic path triage, connection checks, or AD/Azure/OpenHound exposure analysis when no explicit query-authoring task is requested."
license: MIT
metadata:
  author: turbo
  version: "0.1.0"
  category: security
---

# BloodHound Query Workflow

Use this as the shared query authoring/review workflow across BloodHound, AzureHound, OpenHound GitHub, OpenHound Jamf, OpenHound Okta, and custom OpenGraph graphs.

## Direct triggers

Use this skill when the task mentions any of the following:

- write a BloodHound query
- write Cypher
- explain this Cypher
- review this query
- optimize this BloodHound query
- adapt this saved query
- turn this path question into Cypher
- validate this BloodHound query

## Route to instead

- Use `$bloodhound-analysis` for generic BloodHound asks or initial graph triage.
- Use the domain skill when the path question is clear and the user is asking for findings rather than query authoring: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`.

## Required context

- Confirm the assessment/lab is authorized and in scope.
- Identify the graph domain and available collectors/extensions.
- If live BloodHound MCP access is unavailable, produce a query/workflow plan and clearly avoid claiming observed graph facts.

## Workflow

1. Read `../../references/docs/bloodhound-query-methodology.md`.
2. Choose the domain skill when the graph is known: `$bloodhound-ad-analysis`, `$azurehound-analysis`, `$openhound-github`, `$openhound-jamf`, or `$openhound-okta`.
3. Use `../../references/docs/source-index.md` to locate the matching query index and snapshots.
4. Adapt a saved-query pattern first; only invent a new query when no pattern fits.
5. For OpenGraph work, inspect `../../references/examples/example-cypher.md` and `../../references/examples/node-edge-reference.md` before inventing labels or edge kinds.
6. For SCIM/hybrid identity work, read `../../references/docs/scim-methodology.md` and document each bridge edge explicitly.
7. Keep the query read-only, bounded, label-specific, and explicit about relationship direction.
8. Return the query with parameters, expected result shape, analysis guidance, caveats, and next queries.

## Output contract

- Query
- Parameters to replace
- Purpose
- Expected result shape
- Analysis guidance
- Caveats / data-quality assumptions
- Next queries

## agents

```

```

## agents/openai.yaml

```yaml
interface:
  display_name: "BloodHound Query Workflow"
  short_description: "Write and review BloodHound Cypher queries."
  icon_small: ./assets/icon.svg
  icon_large: ./assets/icon.png
  default_prompt: "Use $bloodhound-query to write, review, optimize, or explain a BloodHound Cypher query for this graph question."
  brand_color: "#991B1B"

policy:
  allow_implicit_invocation: true
```

## assets

```

```

## assets/icon.png

```

```

## assets/icon.svg

```

```