Use when starting any pentesting engagement, receiving a target domain or IP, saying "new engagement", "start a pentest", "plan this target", or beginning any offensive security assessment. Invoke this FIRST before any other skill. Also triggers on "bug bounty on X", "test X for me", "attack X", "scope is X".
Internal utility library - not an invokable skill. Contains phase0.sh (session state, intel relay, memory read) and signals.sh (append-only signal emission). Sourced by all other skills via `source ~/.claude/skills/_shared/phase0.sh`.
Use when encountering HTTP 403 Forbidden responses during pentests or bug bounty hunting, testing access control bypasses, trying to reach restricted endpoints, admin panels, or protected API routes. Also trigger when the user says "403 bypass", "bypass forbidden", "access denied bypass", "forbidden page bypass", or "trying to access restricted endpoint". Use this whenever a 403 needs to be tested - not just blindly accepted.
Use when attacking Active Directory environments, hunting Kerberoastable accounts, AS-REP roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, BloodHound path analysis, LDAP enumeration, GPO abuse, ACL abuse, or full AD domain compromise chains. Also use when the user says "attack AD", "domain compromise", "Kerberoast", "DCSync", "BloodHound", or "lateral movement".
Use when auditing cloud infrastructure for misconfigurations, testing AWS IAM privilege escalation, enumerating exposed S3 buckets, attacking GCP service accounts, testing Azure RBAC misconfigs, hunting for exposed Kubernetes API servers, or finding cloud credential leaks in metadata services. Also use when the user says "cloud audit", "AWS pentest", "GCP attack", "K8s attack", "S3 exposed", "metadata service", or "cloud misconfiguration".
Use when context is running long during a pentest engagement, at phase boundaries after completing a full phase, or when the user says "compact", "compress context", "trim context", or "save tokens". Compresses completed phase outputs while keeping session.json as the authoritative source of truth.
Use when running exploitation phase of a pentest, testing for SQL injection, XSS, SSRF, JWT confusion, deserialization, prototype pollution, HTTP smuggling, cache poisoning, SSTI, XXE, GraphQL, SAML, LFI, file upload bypass, CORS, WebSocket hijacking, IDOR, mass assignment, account takeover chains, 2FA bypass, or any class of web/API vulnerability. Also use when the user says "run exploit", "phase 3", "start exploitation", "test for XSS/SQLi/SSRF", or names any specific vuln class.
Use when attacking OAuth 2.0 or OIDC implementations, testing for authorization code interception, PKCE bypass, open redirect chains, token leakage via referer, state parameter CSRF, token substitution, JWT confusion, implicit flow token theft, or OAuth misconfiguration in bug bounty targets. Also use when the user says "attack OAuth", "OAuth bug", "PKCE bypass", "redirect_uri bypass", "token leakage", or "SSO attack".