菜单
Framework for training cybersecurity agents without access to live environments. Uses CTF writeups and persona-driven LLM simulation to synthesize training trajectories, achieving performance matching proprietary systems like Claude-3.5-Sonnet.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/ADu2021/skillXiv --skill cyber-zero-runtime-free-agent-training命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Convert arXiv papers into ready-to-use agent skills using category-aware extraction. First classifies the paper into one or more of 11 research categories, then applies a specialized extraction pipeline for each category — because different types of papers produce different types of usable knowledge. A single paper can yield multiple skills if it spans categories. Use this skill whenever the user wants to turn a paper into a skill, extract practical techniques from research, build a skill library from papers, convert arXiv papers into reusable agent instructions, or batch-process multiple papers into skills. Also trigger when someone asks about extracting actionable knowledge from papers, making research practical for LLM agents, or systematically converting academic contributions into structured agent capabilities.
Establish regret bounds for behavior cloning with discretized actions combining statistical error and quantization error terms. Prove smoothness requirements for safe quantizer design, show that learning-based quantizers fail these requirements, and propose model-based augmentation to reduce error dependence from H² to H.
Dynamically allocate LoRA ranks per-layer during fine-tuning instead of using fixed uniform ranks. Learn optimal rank for each layer and subject via variational framework with discretized exponential distribution, reducing memory footprint while maintaining fidelity and text-alignment.
基于 SOC 职业分类
正在显示 SKILL.md
| name | cyber-zero-runtime-free-agent-training |
| title | Cyber-Zero Training Cybersecurity Agents Without Runtime |
| version | 0.0.2 |
| engine | skillxiv-v0.0.2-claude-opus-4.6 |
| license | MIT |
| url | https://arxiv.org/abs/2508.00910 |
| keywords | ["cybersecurity","agent-training","synthetic-data","persona-simulation","runtime-free"] |
| description | Framework for training cybersecurity agents without access to live environments. Uses CTF writeups and persona-driven LLM simulation to synthesize training trajectories, achieving performance matching proprietary systems like Claude-3.5-Sonnet. |
Cyber-Zero addresses a critical challenge in cybersecurity agent development: the lack of accessible runtime environments for training. Rather than requiring live CTF platforms or complex setups, the system leverages public documentation and persona-driven simulation to create high-quality synthetic training data, enabling agents to match proprietary system performance.
The fundamental insight is that cybersecurity knowledge is extensively documented in CTF (Capture-The-Flag) writeups and solutions. Cyber-Zero:
The framework consists of:
Step 1: Extract knowledge from CTF writeups
Parse CTF solutions to identify problem types and solution patterns:
import re
import json
from typing import Dict, List, Tuple, Optional
from dataclasses import dataclass
@dataclass
class CTFProblem:
"""Represents a CTF challenge and its solution"""
name: str
category: str
description:
solution_steps: []
tools_used: []
vulnerability_type:
difficulty:
:
():
.problems: [CTFProblem] = []
.vulnerability_index: [, [CTFProblem]] = {}
() -> [CTFProblem]:
title_match = re.search(, writeup_text, re.MULTILINE)
title = title_match.group() title_match
category = ._detect_category(writeup_text)
description = ._extract_description(writeup_text)
solution_steps = ._extract_solution_steps(writeup_text)
tools = ._identify_tools(writeup_text, solution_steps)
vulnerability = ._extract_vulnerability(writeup_text)
difficulty = ._assess_difficulty(solution_steps)
problem = CTFProblem(
name=title,
category=category,
description=description,
solution_steps=solution_steps,
tools_used=tools,
vulnerability_type=vulnerability,
difficulty=difficulty
)
.problems.append(problem)
vulnerability .vulnerability_index:
.vulnerability_index[vulnerability] = []
.vulnerability_index[vulnerability].append(problem)
problem
() -> :
categories = {
: [, , , , ],
: [, , , , ],
: [, , , ],
: [, , , , ],
: [, , , ]
}
text_lower = text.lower()
category, keywords categories.items():
(kw text_lower kw keywords):
category
() -> :
lines = text.split()
description_lines = []
in_description =
line lines:
line.lower() line.lower():
in_description =
in_description line.strip() line.startswith():
description_lines.append(line)
in_description line.strip().startswith():
.join(description_lines[:])
() -> []:
steps = []
step_matches = re.findall(
,
text,
re.DOTALL
)
num, step_text step_matches:
step = step_text.strip()[:]
step:
steps.append(step)
steps:
code_blocks = re.findall(, text, re.DOTALL)
steps = [b[:] b code_blocks[:]]
steps
() -> []:
tools = ()
tool_patterns = {
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
:
}
full_text = text + + .join(steps)
tool, pattern tool_patterns.items():
re.search(pattern, full_text, re.IGNORECASE):
tools.add(tool)
(tools)
() -> :
vulnerabilities = [
, , , ,
, ,
]
text_lower = text.lower()
vuln vulnerabilities:
vuln.replace(, ) text_lower vuln text_lower:
vuln
() -> :
(steps) <= :
(steps) <= :
:
() -> [CTFProblem]:
[p p .problems p.category == category]
() -> [CTFProblem]:
.vulnerability_index.get(vuln_type, [])
Step 2: Implement persona-driven LLM simulator
Create LLM-based agent simulation with different personas:
from enum import Enum
class AgentPersona(Enum):
"""Different agent personas for simulation"""
CAUTIOUS = "thorough, methodical, checks assumptions"
AGGRESSIVE = "tries shortcuts, tests hypotheses quickly"
EXPERT = "applies known patterns, recognizes problem types"
class PersonaDrivenSimulator:
"""Simulates agent interaction using LLM with personas"""
def __init__(self, llm):
self.llm = llm
def simulate_agent_step(self, problem: CTFProblem,
current_state: Dict,
persona: AgentPersona = AgentPersona.EXPERT) -> Tuple[str, Dict]:
"""
Simulate single agent action step.
Args:
problem: CTF problem to solve
current_state: Current progress/findings
persona: Agent personality style
Returns:
(action, updated_state)
"""
# Build context
context = self._build_context(problem, current_state, persona)
# Generate action
prompt = f"""{context}
Based on the current situation, what is your next action? Be specific and actionable.
Action:"""
action = self.llm.generate(prompt, max_tokens=200).strip()
# Simulate effect of action
new_state = self._simulate_action_effect(action, current_state, problem)
return action, new_state
def _build_context(self, problem: CTFProblem,
current_state: Dict,
persona: AgentPersona) -> str:
"""Build simulation context for LLM"""
persona_desc = {
AgentPersona.CAUTIOUS: "You are a cautious, methodical analyst",
AgentPersona.AGGRESSIVE: "You are an aggressive problem solver",
AgentPersona.EXPERT: "You are an expert in cybersecurity"
}[persona]
context = f"""{persona_desc}.
Challenge: {problem.name}
Category: {problem.category}
Description: {problem.description}
Vulnerability Type: {problem.vulnerability_type}
Tools Available: {', '.join(problem.tools_used)}
Current Progress:
{json.dumps(current_state, indent=2)}
Solution Steps (for guidance):
{chr(10).join(f'- {s}' for s in problem.solution_steps[:3])}"""
return context
def _simulate_action_effect(self, action: str,
current_state: Dict,
problem: CTFProblem) -> Dict:
"""Simulate the effect of an action"""
new_state = current_state.copy()
# Simple heuristics for effect simulation
action_lower = action.lower()
if 'scan' in action_lower or 'nmap' in action_lower:
new_state['scanned'] = True
new_state['ports_discovered'] = [22, 80, 443]
elif 'connect' in action_lower or 'telnet' in action_lower:
new_state['connected'] = True
elif 'find' in action_lower or 'grep' in action_lower:
new_state['findings'] = (new_state.get('findings', 0) + 1)
elif 'exploit' in action_lower:
new_state['exploit_attempted'] = True
new_state['success'] = True # Simplified
return new_state
Step 3: Generate synthetic trajectories
Create realistic multi-step problem-solving sequences:
@dataclass
class Trajectory:
"""Multi-step solution trajectory"""
problem: CTFProblem
steps: List[Tuple[str, Dict]] # (action, resulting_state)
success: bool
num_steps: int
class TrajectoryGenerator:
"""Generates synthetic problem-solving trajectories"""
def __init__(self, extractor: CTFKnowledgeExtractor,
simulator: PersonaDrivenSimulator):
self.extractor = extractor
self.simulator = simulator
def generate_trajectory(self, problem: CTFProblem,
persona: AgentPersona = AgentPersona.EXPERT,
max_steps: int = 20) -> Trajectory:
"""
Generate complete trajectory for solving a problem.
Args:
problem: CTF problem to solve
persona: Agent persona to use
max_steps: Maximum trajectory length
Returns:
Complete trajectory from start to goal
"""
steps = []
current_state = {
'started': True,
'found_flags': [],
'tools_used': []
}
success = False
for step_num in range(max_steps):
# Simulate next step
action, new_state = self.simulator.simulate_agent_step(
problem,
current_state,
persona
)
steps.append((action, new_state))
current_state = new_state
# Check if goal reached (simplified)
if 'flag' in action.lower() or new_state.get('success'):
success = True
break
# Bail if stalled
if step_num > 10 and not new_state.get('progress', False):
break
return Trajectory(
problem=problem,
steps=steps,
success=success,
num_steps=len(steps)
)
def generate_batch_trajectories(self, problems: List[CTFProblem],
batch_size: int = 10) -> List[Trajectory]:
"""Generate trajectories for multiple problems"""
trajectories = []
for problem in problems[:batch_size]:
# Generate with each persona
for persona in AgentPersona:
traj = self.generate_trajectory(problem, persona=persona)
trajectories.append(traj)
return trajectories
Step 4: Validate trajectory quality
Ensure synthetic data is realistic and useful:
class TrajectoryValidator:
"""Validates quality of synthetic trajectories"""
def __init__(self):
self.realistic_patterns = self._load_patterns()
def validate_trajectory(self, trajectory: Trajectory) -> Dict:
"""
Validate trajectory for realism and utility.
Returns validation score and issues.
"""
issues = []
scores = {
'realism': 0.0,
'diversity': 0.0,
'utility': 0.0,
'overall': 0.0
}
# Check realism
realism_score = self._check_realism(trajectory)
if realism_score < 0.5:
issues.append("Low action realism")
scores['realism'] = realism_score
# Check diversity
actions = [step[0] for step in trajectory.steps]
diversity = len(set(actions)) / len(actions) if actions else 0
if diversity < 0.3:
issues.append("Low action diversity")
scores['diversity'] = diversity
# Check utility
if trajectory.success:
utility = 0.9
else:
utility = 0.3
scores['utility'] = utility
# Overall
scores['overall'] = (
0.4 * realism_score + 0.3 * diversity + 0.3 * utility
)
return {
'valid': scores['overall'] > 0.5,
'scores': scores,
'issues': issues
}
def _check_realism(self, trajectory: Trajectory) -> float:
"""Check if actions follow realistic patterns"""
realism_score = 0.0
valid_actions = 0
for action, _ in trajectory.steps:
if self._is_realistic_action(action):
valid_actions += 1
realism_score = valid_actions / len(trajectory.steps) if trajectory.steps else 0
return realism_score
def _is_realistic_action(self, action: str) -> bool:
"""Check if action is realistically described"""
realistic_patterns = [
r'(scan|nmap)',
r'(analyze|examine)',
r'(connect|telnet)',
r'(crack|bruteforce)',
r'(exploit|execute)',
r'(find|search)',
r'(decrypt|decode)'
]
action_lower = action.lower()
for pattern in realistic_patterns:
if re.search(pattern, action_lower):
return True
return False
def _load_patterns(self) -> List[str]:
"""Load realistic action patterns"""
return []
def filter_valid_trajectories(self,
trajectories: List[Trajectory],
min_score: float = 0.5) -> List[Trajectory]:
"""Filter trajectories by quality"""
valid = []
for trajectory in trajectories:
validation = self.validate_trajectory(trajectory)
if validation['scores']['overall'] > min_score:
valid.append(trajectory)
return valid
Step 5: Integrate agent training
Train agents on synthetic trajectories:
class CyberZeroTrainer:
"""Trains cybersecurity agents on synthetic trajectories"""
def __init__(self, agent_model, trajectory_dataset: List[Trajectory]):
self.agent = agent_model
self.trajectories = trajectory_dataset
def prepare_training_data(self) -> Tuple[List, List]:
"""
Convert trajectories to training data.
Returns (problem_contexts, action_sequences)
"""
contexts = []
sequences = []
for trajectory in self.trajectories:
problem = trajectory.problem
actions = [step[0] for step in trajectory.steps]
# Context: problem description and category
context = f"{problem.category}: {problem.description}"
contexts.append(context)
# Action sequence
sequences.append(actions)
return contexts, sequences
def train(self, learning_rate: float = 1e-5, num_epochs: int = 3):
"""Train agent on trajectories"""
contexts, action_sequences = self.prepare_training_data()
optimizer = torch.optim.AdamW(
self.agent.parameters(),
lr=learning_rate
)
for epoch in range(num_epochs):
total_loss = 0.0
for context, actions in zip(contexts, action_sequences):
# Encode problem
problem_encoding = self.agent.encode_problem(context)
# Predict next action at each step
for step_idx, target_action in enumerate(actions):
# Get prediction
pred_action = self.agent.predict_next_action(
problem_encoding,
actions[:step_idx]
)
# Compute loss
loss = self._compute_loss(pred_action, target_action)
optimizer.zero_grad()
loss.backward()
optimizer.step()
total_loss += loss.item()
avg_loss = total_loss / len(contexts)
print(f"Epoch {epoch}: Loss = {avg_loss:.4f}")
def _compute_loss(self, prediction, target) -> torch.Tensor:
"""Compute training loss"""
# Simplified: real version would use cross-entropy
return torch.tensor(0.0)
When to use Cyber-Zero:
When NOT to use Cyber-Zero:
Key hyperparameters:
max_trajectory_steps: 15-25 typical for realistic solutionsnum_personas: 3 provides good diversityvalidation_min_score: 0.5-0.6 typical thresholdtraining_epochs: 2-5 typical for convergenceExpected performance:
Dataset characteristics:
Cyber-Zero: Training Cybersecurity Agents without Runtime. arXiv:2508.00910