القائمة
Use when starting, planning, or running a multi-phase pentest or red-team engagement — to sequence the Cyber Kill Chain phases with quality gates instead of jumping straight to exploitation
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing
Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation
Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response
Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
Use when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon, exploitation, or reporting)
| name | engagement-flow |
| description | Use when starting, planning, or running a multi-phase pentest or red-team engagement — to sequence the Cyber Kill Chain phases with quality gates instead of jumping straight to exploitation |
A pentest/red-team engagement is a phased pipeline with gates, not a pile of techniques run ad hoc. This skill sequences the 9-phase Lockheed Martin Cyber Kill Chain and routes each phase to its commands, domain skills, and discipline checks. It is the offensive analog of brainstorming → writing-plans → executing-plans: scope the work, plan it, then execute phase by phase.
Don't jump to exploitation. Earlier phases earn the access that later phases need, and each gate keeps quality high before you advance.
digraph killchain {
rankdir=LR;
scope -> recon -> weaponize -> deliver -> exploit -> install -> c2 -> actions -> report;
scope [label="0 SCOPE"]; recon [label="1 RECON"]; weaponize [label="2 WEAPONIZE"];
deliver [label="3 DELIVER"]; exploit [label="4 EXPLOIT"]; install [label="5 INSTALL"];
c2 [label="6 C2"]; actions [label="7 ACTIONS"]; report [label="8 REPORT"];
}
Each transition requires a gate (/engage.gate): required artifacts present, findings carry
CWE+CVSS+ATT&CK+evidence, and the automated checks pass. Gate FAIL → fix the gap before advancing.
/engage.* commands..engage/scope/scope.json. REQUIRED: scope-discipline./engage.memory recall to start from what worked.[CONFIRMED] without proof.engine/engine.py runs the phases under a budget/loop/trace with --resume
(/engage.pickup); offensive actions stay operator-gated./engage.memory recall)| Phase | Command | Discipline / tooling |
|---|---|---|
| Scope | /engage.scope | scope-discipline → scope.json |
| Recon | /engage.recon | scope-discipline; /engage.memory recall |
| Exploit | /engage.exploit | opsec-discipline; finding-discipline |
| Actions | /engage.actions | action_guard gate; opsec-discipline |
| Report | /engage.report | finding-discipline; record to memory |
| Gate / resume | /engage.gate, /engage.pickup | automated checks; engine trace |