botron

Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.

Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.

Final engagement report generation — executive summary, technical report, findings aggregation, attack path narrative, detection gap matrix, remediation roadmap.

Decepticon orchestrator patterns — delegation, state management, adaptive re-planning, context handoff protocols.

Use when setting up, running, or managing the Botron autonomous red team agent — Docker-based multi-provider LLM pentesting framework. Covers install, demo, service management, testing, and provider configuration.

Sliver C2 framework operations — server connection, listener setup, implant generation, BOF/Armory extensions, post-implant operations, HTTP C2 profiles.

Stage 1 broad-spectrum scanner playbook. Sharded sweep over very large codebases producing CANDIDATE nodes for the Detector to reason about. Load at scanner-agent startup.

Top-level orchestration skill — execution order and dependencies across all Decepticon skills.

Rules of Engagement document creation — scope definition, prohibited/permitted actions, testing windows, escalation contacts, incident procedures.

Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.

Exploitation finding documentation — initial access reports, exploit chain documentation, CVSS v4.0 scoring, shell/credential inventory, detection gap analysis.

Recon output formatting — report structure, CVSS v4.0 scoring (primary), MITRE ATT&CK mapping, finding prioritization, Markdown output, detection gap tracking, handoff checklists.

CTF benchmark reference — vulnerability tag mapping, exploitation techniques, and flag capture patterns for automated benchmark challenges.

Web application exploitation — the primary category skill for all web-based attacks. This is a routing skill: read this first to identify the attack type, then load the appropriate specialized sub-skill for detailed procedures. Covers 11 technique areas across injection, file access, authentication, and API exploitation.

Web application enumeration — directory/file fuzzing, virtual host discovery, API endpoint enumeration, CMS scanning, WAF detection, JavaScript analysis.