메뉴
Internal utility library - not an invokable skill. Contains phase0.sh (session state, intel relay, memory read) and signals.sh (append-only signal emission). Sourced by all other skills via `source ~/.claude/skills/_shared/phase0.sh`.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | _shared |
| description | Internal utility library - not an invokable skill. Contains phase0.sh (session state, intel relay, memory read) and signals.sh (append-only signal emission). Sourced by all other skills via `source ~/.claude/skills/_shared/phase0.sh`. |
This directory contains bash libraries sourced by all Akira skills. It is not an invokable skill.
phase0.sh - canonical Phase 0 functions: p0_init_vars, p0_state_gate, p0_read_relay, p0_read_memory, p0_read_hypotheses, p0_manifest_write, p0_relay_write, p0_completion_gatesignals.sh - atomic append-only signal emission: emit_signal TYPE VALUE SOURCE CONFIDENCEsource ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh
Use when starting any pentesting engagement, receiving a target domain or IP, saying "new engagement", "start a pentest", "plan this target", or beginning any offensive security assessment. Invoke this FIRST before any other skill. Also triggers on "bug bounty on X", "test X for me", "attack X", "scope is X".
Use when encountering HTTP 403 Forbidden responses during pentests or bug bounty hunting, testing access control bypasses, trying to reach restricted endpoints, admin panels, or protected API routes. Also trigger when the user says "403 bypass", "bypass forbidden", "access denied bypass", "forbidden page bypass", or "trying to access restricted endpoint". Use this whenever a 403 needs to be tested - not just blindly accepted.
Use when attacking Active Directory environments, hunting Kerberoastable accounts, AS-REP roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, BloodHound path analysis, LDAP enumeration, GPO abuse, ACL abuse, or full AD domain compromise chains. Also use when the user says "attack AD", "domain compromise", "Kerberoast", "DCSync", "BloodHound", or "lateral movement".
Use when auditing cloud infrastructure for misconfigurations, testing AWS IAM privilege escalation, enumerating exposed S3 buckets, attacking GCP service accounts, testing Azure RBAC misconfigs, hunting for exposed Kubernetes API servers, or finding cloud credential leaks in metadata services. Also use when the user says "cloud audit", "AWS pentest", "GCP attack", "K8s attack", "S3 exposed", "metadata service", or "cloud misconfiguration".
Use when context is running long during a pentest engagement, at phase boundaries after completing a full phase, or when the user says "compact", "compress context", "trim context", or "save tokens". Compresses completed phase outputs while keeping session.json as the authoritative source of truth.
Use when running exploitation phase of a pentest, testing for SQL injection, XSS, SSRF, JWT confusion, deserialization, prototype pollution, HTTP smuggling, cache poisoning, SSTI, XXE, GraphQL, SAML, LFI, file upload bypass, CORS, WebSocket hijacking, IDOR, mass assignment, account takeover chains, 2FA bypass, or any class of web/API vulnerability. Also use when the user says "run exploit", "phase 3", "start exploitation", "test for XSS/SQLi/SSRF", or names any specific vuln class.