BloodHound Narrator

Turn BloodHound attack path exports into dual-layer security reports — CISO executive prose on top, technical remediation playbook below. Automates Active Di...

Security Scan

The skill's code, instructions, and requirements are internally consistent with its stated purpose of converting BloodHound JSON exports into local PowerShell-generated reports; no network calls or secret access are present.

Purpose & Capability

Name/description (convert BloodHound exports into dual-layer reports) match the included files and runtime behavior. The package contains PowerShell classifiers and narrative templates consistent with generating executive and technical Markdown reports from BloodHound JSON.

Instruction Scope

SKILL.md instructs purely local operations: read a JSON export, classify paths, and write a Markdown report. The included PowerShell code only reads local files, builds text output, and writes to disk; it does not make network calls or reference external endpoints or unrelated system credentials.

Install Mechanism

No install spec is provided (instruction-only with bundled scripts). The runtime wrapper copies local .txt PowerShell sources to a temp .ps1 and executes them with pwsh — a transparent, local execution pattern. No archives or remote downloads are used.

Credentials

The skill requires no secrets or config paths at runtime and does not access environment credentials. Minor metadata inconsistencies: SKILL.md declares 'bins: pwsh' and instructs installing PowerShell, but the registry 'Required binaries' field was empty; the registry version is 1.0.1 while SKILL.md header lists 1.0.0. These are bookkeeping issues, not functional red flags, but you should verify pwsh availability before running.

Persistence & Privilege

always:false and no persistent agent/system changes. The scripts create temporary files in /tmp and remove them; they do not modify other skills, system-wide agent settings, or store credentials.

Assessment

This skill appears to do what it says: it parses a BloodHound Cypher-export JSON locally and emits a Markdown report with executive prose and remediation steps. Before installing/running: (1) ensure PowerShell (pwsh) is installed and trusted on the host, (2) run the bundled tests in an isolated environment if you want to validate behavior (tests call pwsh/Pester), (3) review the included PowerShell templates yourself (they are human-readable) if you have policy concerns, and (4) note minor metadata mismatches (declared version in files vs registry and missing 'required binary' in registry) — these are administrative inconsistencies, not functional or exfiltration issues. If you plan to run this on sensitive hosts, run it on a jump-host or admin workstation rather than directly on domain controllers, and avoid feeding it exports that include credentials or other secrets you don't want written to disk.

Turn BloodHound attack paths into boardroom-ready security reports — entirely offline.

Built for pentesters, blue teams, and AD security consultants who need to translate BloodHound graph output into actionable deliverables without spending hours writing prose.

BloodHound Narrator ingests Cypher export JSON, scores each attack path on a weighted severity model, and produces a dual-layer Markdown report:

1. CISO / Executive Layer — severity summary table, per-path business risk narrative, impact statements written in non-technical language that management and board members can act on.
2. Technical Remediation Appendix — step-by-step hardening playbook with PowerShell commands, Event IDs to monitor, and remediation guidance per finding.

Detected attack patterns: DCSync, Kerberoasting, unconstrained delegation, GenericAll / WriteDacl / WriteOwner ACL abuse, GPO takeover, lateral movement chains (AdminTo + HasSession), Tier 0 boundary violations, stale service account passwords, and sensitive data exposure paths.

No API keys. No network calls. No data exfiltration risk. Air-gap compatible. Works in regulated, classified, and OT environments.

Setup

Install PowerShell (if not already present):

# macOS
brew install powershell/tap/powershell

# Linux (Ubuntu/Debian)
sudo apt-get install -y powershell

# Windows — already included

No environment variables or credentials required.

Usage

# Generate a full report (all severities)
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/bloodhound-export.json"

# Only include Critical and High findings
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/export.json" -MinSeverity High

# Specify output path
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/export.json" -OutputFile "report.md"

# Pipe classified objects for further processing
bash {baseDir}/scripts/bh-narrator.sh -InputFile "path/to/export.json" -PassThru

Run the test suite

bash {baseDir}/tests/run-tests.sh

A synthetic BloodHound export with 5 attack paths (3 Critical, 2 High) is included at {baseDir}/tests/synthetic-bloodhound.json for validation.

Severity Scoring Model

Factor	Points	Example
Tier 0 target (DA, EA, DC)	+40	Path ends at Domain Admins
DCSync edge	+30	Replication rights on DC
GenericAll/WriteDacl/Owns on Tier 0	+30	GenericAll on Domain Admins group
Unconstrained delegation in path	+20	TGT cached on delegation host
GenericAll/WriteDacl/Owns (non-Tier 0)	+15	WriteDacl on OU
Sensitive data keywords in path	+15	Target description contains "PII" or "financial"
Kerberoastable source	+10	Source account has SPN set
Short path (1-2 hops)	+10	Direct GenericAll to DA
Lateral movement chain	+10	AdminTo + HasSession combo
Medium path (3 hops)	+5	Three-hop escalation
Stale password (>365 days)	+5	Service account never rotated

Thresholds: Critical >= 50 | High >= 30 | Medium >= 15 | Low < 15

Report Output

The generated Markdown report includes:

• Header with domain name, collection date, BloodHound version
• Executive summary with severity distribution table
• Per-path findings with attack chain, business risk bullets, and impact statement
• Technical remediation appendix with numbered steps per finding (DCSync removal, gMSA migration, delegation hardening, tier isolation, GPO lockdown, etc.)

Who Is This For

• Pentesters delivering AD audit reports to clients — skip the manual write-up, generate the narrative from your BloodHound data
• Blue team / SOC analysts triaging BloodHound findings after a security assessment
• Security consultants who need client-ready deliverables fast
• CISOs and security managers who want attack path reports they can actually read without a graph database
• Purple teams documenting offensive findings for defensive remediation

Use Cases

• Post-pentest AD audit reporting
• Quarterly Active Directory security health checks
• Incident response — rapid attack path analysis after a compromise
• Compliance reporting (ISO 27001, NIS2, LPM, SOC2) requiring documented AD risk assessments
• Training and awareness — show management what "3 hops to Domain Admin" actually means