메뉴
Use when starting, planning, or running a multi-phase pentest or red-team engagement — to sequence the Cyber Kill Chain phases with quality gates instead of jumping straight to exploitation
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
| name | engagement-flow |
| description | Use when starting, planning, or running a multi-phase pentest or red-team engagement — to sequence the Cyber Kill Chain phases with quality gates instead of jumping straight to exploitation |
A pentest/red-team engagement is a phased pipeline with gates, not a pile of techniques run ad hoc. This skill sequences the 9-phase Lockheed Martin Cyber Kill Chain and routes each phase to its commands, domain skills, and discipline checks. It is the offensive analog of brainstorming → writing-plans → executing-plans: scope the work, plan it, then execute phase by phase.
Don't jump to exploitation. Earlier phases earn the access that later phases need, and each gate keeps quality high before you advance.
digraph killchain {
rankdir=LR;
scope -> recon -> weaponize -> deliver -> exploit -> install -> c2 -> actions -> report;
scope [label="0 SCOPE"]; recon [label="1 RECON"]; weaponize [label="2 WEAPONIZE"];
deliver [label="3 DELIVER"]; exploit [label="4 EXPLOIT"]; install [label="5 INSTALL"];
c2 [label="6 C2"]; actions [label="7 ACTIONS"]; report [label="8 REPORT"];
}
Each transition requires a gate (/engage.gate): required artifacts present, findings carry
CWE+CVSS+ATT&CK+evidence, and the automated checks pass. Gate FAIL → fix the gap before advancing.
/engage.* commands..engage/scope/scope.json. REQUIRED: scope-discipline./engage.memory recall to start from what worked.[CONFIRMED] without proof.engine/engine.py runs the phases under a budget/loop/trace with --resume
(/engage.pickup); offensive actions stay operator-gated./engage.memory recall)| Phase | Command | Discipline / tooling |
|---|---|---|
| Scope | /engage.scope | scope-discipline → scope.json |
| Recon | /engage.recon | scope-discipline; /engage.memory recall |
| Exploit | /engage.exploit | opsec-discipline; finding-discipline |
| Actions | /engage.actions | action_guard gate; opsec-discipline |
| Report | /engage.report | finding-discipline; record to memory |
| Gate / resume | /engage.gate, /engage.pickup | automated checks; engine trace |
Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting
Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing
Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation
Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response
Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
Use when starting any offensive-security engagement or task — establishes how to find and invoke the right skill before any action (including clarifying questions, recon, exploitation, or reporting)