القائمة
Use when a SCOPE top-level agent starts a run and needs bounded environment knowledge, durable observations, reasoning notes, coverage gaps, and Splunk patterns before planning.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when constructing SCOPE attack candidate chains from audit artifacts and rejecting facts that do not form attacker progressions.
Use when formatting SCOPE controls detection candidates into detections.md, detections.json, dashboard-readable SPL sections, or controls-schema detection records.
Use when attaching schema-valid SCOPE evidence handles to attack candidates, hops, observations, assumptions, and caveats.
Use when scope-exploit has operator-approved attack paths and needs to generate the narrative red team playbook, execution steps, persistence, post-exploitation, and IAM policy JSON without detection or SOC guidance.
Use when scope-investigate completes an investigation and needs a facts-only analyst summary, evidence timeline, query appendix, investigation gaps, and optional saved investigation artifact.
Use after SCOPE evidence review, final disposition, or operator-approved save to update durable environment knowledge, observations, coverage gaps, or proposed reasoning-note improvements.
| name | scope-knowledge-load |
| description | Use when a SCOPE top-level agent starts a run and needs bounded environment knowledge, durable observations, reasoning notes, coverage gaps, and Splunk patterns before planning. |
Use this skill at the start of top-level agents before planning, dispatching subagents, writing detections, building controls, or forming investigation hypotheses.
The caller provides any known selectors:
ACCOUNT_IDAGENT: scope-audit, scope-controls, scope-exploit, or scope-investigateENTITY: role, user, IP, bucket, key, account, repo, domain, or alert identifier when knownTOPIC: service, TTP, threat actor, alert type, AWS action, or investigation theme when knownTIMEFRAME: the investigation or run window when knownRead these files when present. Missing files are normal on first use.
knowledge/environment.mdknowledge/observations.mdknowledge/coverage-gaps.mdknowledge/exploit-reasoning-notes.mdknowledge/hunt-reasoning-notes.mdconfig/splunk-patterns.mdReturn a bounded KNOWLEDGE_CONTEXT instead of dumping full files.
Prioritize entries that match:
If more than 10 entries match, return the 10 most relevant. Prefer recent, evidence-backed, confirmed entries over stale or needs-review entries.
Return this structure to the calling agent:
KNOWLEDGE_CONTEXT
files_read:
- path
relevant_observations:
- id_or_source: ...
status: confirmed|likely_normal|suspicious|false_positive|coverage_gap|needs_review
summary: ...
evidence: ...
coverage_gaps:
- gap: ...
affected_sources: ...
implication: ...
constraints:
- ...
stale_or_conflicting_knowledge:
- ...
If no useful knowledge exists, return:
KNOWLEDGE_CONTEXT
files_read: []
relevant_observations: []
coverage_gaps: []
constraints: []
stale_or_conflicting_knowledge: []