メニュー
Cleanup & restoration plan generator — artifact inventory, persistence removal commands, pre-engagement baseline, post-engagement verification.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill cleanup-templateコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | cleanup-template |
| description | Cleanup & restoration plan generator — artifact inventory, persistence removal commands, pre-engagement baseline, post-engagement verification. |
| allowed-tools | Read Write Edit |
| metadata | {"subdomain":"planning","when_to_use":"create cleanup plan, artifact inventory, persistence removal, post-engagement teardown, restoration plan","tags":"cleanup, restoration, persistence, post-engagement, hygiene","upstream_ref":"Soundwave cleanup template — artifact inventory, persistence removal, restoration plan"} |
The cleanup plan is the anti-foothold roster — every artifact the kill chain will create must have a concrete removal command and a verifier, or dummy accounts / scheduled tasks / beacons routinely outlive the engagement.
For every phase in CONOPS.kill_chain, infer which CleanupArtifact.artifact_type entries will be produced:
| Kill Chain Phase | Likely artifact_types |
|---|---|
| recon | tool (installed scanners), (firewall whitelist) |
network-rule| initial-access | account (test users), file (uploaded payloads), tool (web shells) |
| post-exploit | persistence-mechanism (scheduled-task / service / registry-run), account (created backdoor users), file (dropped binaries) |
| c2 | beacon (C2 implants), network-rule (egress allow), tool (sliver / cobalt-strike payloads) |
| exfiltration | file (staged exfil archives), network-rule (DNS tunneling) |
For each expected artifact, set:
artifact_type — category abovehost — placeholder (e.g. "<initial-access target>") — operations agents replace at run timepath — likely filesystem / registry / account-name locationpersistence_mech — concrete mechanism if applicableremoval_command — idempotent shell or API call to removeverifier_command — zero-exit on successcreated_by_objective — left blank; operations agents fill on creationremoved=False, removed_at=""Set pre_engagement_baseline to whatever snapshot reference the operator gives during the interview (volume ID, AWS AMI, hypervisor snapshot, manual filesystem hash list). If no baseline is available, record that explicitly — it's a critical risk signal for the engagement owner.
Default schema text covers most engagements. Override only when the engagement specifies different completion semantics (e.g. "leave honeyfile FILE_X in place for blue team training" — note as a cancellation_reason on that artifact later).
Before writing plan/cleanup.json:
removal_commandpath references an out-of-scope hostpre_engagement_baseline is either set or explicitly marked "no baseline available"removal_command empty — operations agents will skip the artifact entirely/workspace/<eng> inside the sandbox; cleanup runs on TARGETS not the workspace)Write to plan/cleanup.json validating against decepticon.core.schemas.CleanupPlan.