القائمة
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | engagement-startup |
| description | Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization. |
| allowed-tools | Bash Read |
| metadata | {"subdomain":"orchestration","when_to_use":"agent startup, first message, session start","tags":"startup, engagement-selection, workspace-init, resume","upstream_ref":"Decepticon orchestrator first-turn bootstrap — workspace + engagement selection, no direct attack technique"} |
Execute this procedure on every session start, before any other action.
bash(command="ls -1 /workspace/ 2>/dev/null || echo '[empty]'", description="List existing engagement workspaces")
Present a numbered list and ask:
Existing engagements found:
1. acme-external-2026
2. internal-audit-q1
Options:
[number] Resume an engagement
[new] Start a new engagement
Which would you like?
No existing engagements found. Let's set up a new one.
What is the target or scope for this engagement?
read_file("<engagement>/plan/roe.json")
read_file("<engagement>/plan/conops.json")
read_file("<engagement>/plan/deconfliction.json")
read_file("<engagement>/plan/opplan.json")
read relevant files under "<engagement>/findings/"
Soundwave has already interviewed the operator and created the engagement documents (RoE, CONOPS, Deconfliction Plan) before the orchestrator was activated. The workspace and planning documents already exist.
bash(command="ls plan/roe.json plan/conops.json plan/deconfliction.json", description="Verify the planning documents exist")
soundwave to regenerate:
task("soundwave", "Engagement workspace: /workspace/. Regenerate missing planning documents.")
bash(command="nc -z c2-sliver 31337 2>/dev/null && echo 'C2_REACHABLE' || echo 'C2_UNREACHABLE'", description="Check whether the C2 server is reachable")
C2_REACHABLE → C2 framework is Sliver (server: c2-sliver, gRPC port 31337). Include this in ALL sub-agent delegations.C2_UNREACHABLE → C2 server is not available, skip C2-dependent objectivesRoot pointer for the binary reversing lane. Covers triage, Radare2 fallback, string extraction, packer unpacking, virtualized protectors, symbol risk, ROP, Ghidra deep analysis, and firmware extraction.
VMProtect, VMP2, Themida, and CodeVirtualizer reversing workflow using Radare2/Ghidra facts and Back Engineering Labs research guidance.
Use to close the Offensive Vaccine loop on the defender side. The Detector agent produces Sigma / YARA rules from offensive operations; this catalog validates those rules against real memory dumps, event logs, and forensic artifacts using Volatility 3, plaso, and sigma-cli. Without this catalog, detection rules are theoretical.
Use when the target is an industrial control system or operational technology network running Modbus, BACnet, S7Comm/S7Comm Plus, DNP3, OPC-UA, or any PLC/HMI/SCADA stack. Engagements MUST set RoE flag industrial_safety_critical=true; this catalog gates every write-scope operation behind explicit operator confirmation regardless of HITL middleware.
Use when the engagement target is an Android (APK / AAB) or iOS (IPA) application. Covers static analysis (jadx, apktool, class-dump), dynamic instrumentation via Frida and Objection, SSL-pinning bypass, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported-component attacks, IPC redirection, WebView vulnerabilities, and biometric / Face ID / Touch ID bypass.
Use when the engagement requires passive reconnaissance only — no packets to the target's authoritative infrastructure. Splits off from the Recon agent so bug-bounty and pre-engagement work can run with outbound-only network policy. Maltego, Shodan, Censys, Hunter.io, breach-data lookups, GitHub code search, Wayback Machine archives, certificate transparency, BGP/ASN mapping.