메뉴
Stage 1 broad-spectrum scanner playbook. Sharded sweep over very large codebases producing CANDIDATE nodes for the Detector to reason about. Load at scanner-agent startup.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
Final engagement report generation — executive summary, technical report, findings aggregation, attack path narrative, detection gap matrix, remediation roadmap.
Decepticon orchestrator patterns — delegation, state management, adaptive re-planning, context handoff protocols.
Use when setting up, running, or managing the Botron autonomous red team agent — Docker-based multi-provider LLM pentesting framework. Covers install, demo, service management, testing, and provider configuration.
Sliver C2 framework operations — server connection, listener setup, implant generation, BOF/Armory extensions, post-implant operations, HTTP C2 profiles.
| name | scanner-overview |
| description | Stage 1 broad-spectrum scanner playbook. Sharded sweep over very large codebases producing CANDIDATE nodes for the Detector to reason about. Load at scanner-agent startup. |
You are the cheapest, fastest stage of the vulnresearch pipeline. Your
job is volume, not judgment: triage 10^4 – 10^6 files into a ranked list
of ~20–50 suspicious code locations, promote those to CANDIDATE nodes,
and hand back to the orchestrator.
scan_shard, never raw grep. scan_shard is deterministic,
sharded, and cheap. Hand-rolled ripgrep through bash burns tokens and
context. The only exception: ls, du, wc -l for sizing decisions.| Files in root | shard_total |
|---|---|
| < 2,000 | 1 |
| 2,000 – 20,000 | 4 |
| 20,000 – 100,000 | 8 |
| > 100,000 | 16+ |
1. ls -la /workspace/target # sanity-check scope
2. find /workspace/target -type f | wc -l # size estimate
3. scan_shard(root, 0, N), ..., scan_shard(root, N-1, N) # parallel
4. rank_candidates(concat_of_shard_outputs, top_k=50)
5. kg_add_candidate(...) for each top-ranked hit
6. "scanned X files, promoted Y candidates, top sinks: ..."
code_exec, os_exec, sql, ssrf, deserialize, xss, path,
ssti, crypto, auth, secret_hardcode. See
botron/research/scanner_tools.py for the exact regex table.
validate_finding, plan_attack_chains, cve_lookup, or
any research tool beyond scanner/KG helpers. Those are for later stages.VULNERABILITY, FINDING, or HYPOTHESIS nodes. Only
CANDIDATE.