菜单
Generates the MITRE ATT&CK technique embedding cache (technique_embeddings.json). Required after updating enterprise-attack.json or if the cache is missing or corrupt. Takes ~3 minutes and makes ~274 API calls to OpenRouter. Run after /update-data completes a MITRE refresh.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Audit and selectively re-run the deterministic analysis engine across all 26 corpus architectures. Default (no args) shows a staleness check — which reports are missing metadata, which arch types need engine fixes re-applied, and the current corpus score table. Pass --ai-only to re-run only AI/agentic architectures, --all to re-run everything, or a single arch name to re-run one. Use after engine changes (self_validation.py, ground_truth_generator.py, rapids_driven_controls.py) to confirm scores are consistent and no regressions landed.
Run TATB (TA Test Benchmark) on a single architecture and print the four-rubric scorecard — Threat-Relevant, TTP-Accurate, Risk-Defensible, Plan-Actionable. Uses the same scoring logic as the dashboard TATB tab. Pass an architecture name as argument, or omit for the most recent report. Read-only. ~3 seconds (includes MITRE API fetch).
Score all architectures in /report/ across the four TATB rubrics and print a visual corpus map — bar table, heatmap, and pipeline stage attribution. Shows which architectures are Excellent/Solid/Weak/Draft on each dimension and identifies which pipeline stages to fix for the largest corpus-wide gain. No UI needed. ~10-15 seconds (MITRE fetch batched once).
Run Expert Review (MoE critics + ScrumMaster) on any architecture that has an existing analysis. Three modes — sequential (3 core critics), full_moe (5 critics + SM, generates Plan-Actionable data), or single-critic (re-run one critic by name). Streams live critic results with scores, gaps, and final confidence. ~60–120s for full_moe, ~30–60s for sequential.
TATB feedback loop — observe corpus or single-arch TATB scores, diagnose weak signals, propose targeted pipeline stage fixes, gate on human approval, apply changes, re-run TATB to verify improvement, and log the before/after delta to docs/DECISIONS.md. The agent does NOT autonomously commit code; every code change requires explicit human approval.
Runs a fast ~15 second integration sanity check — verifies dependencies, rate limiter, MITRE data load (≥835 techniques), OpenRouter API key, API connection, and one real embedding call. Use at session start or after installing dependencies to confirm everything is working before coding.
| name | build-embeddings-cache |
| description | Generates the MITRE ATT&CK technique embedding cache (technique_embeddings.json). Required after updating enterprise-attack.json or if the cache is missing or corrupt. Takes ~3 minutes and makes ~274 API calls to OpenRouter. Run after /update-data completes a MITRE refresh. |
| allowed-tools | Bash(python3:*) Bash(ls:*) Read |
| compatibility | Requires OPENROUTER_API_KEY in .env and internet access. Verify the embedding model name is still a valid free-tier model on openrouter.ai before running. |
Generates chatbot/data/technique_embeddings.json (~45 MB) from chatbot/data/enterprise-attack.json.
# Confirm MITRE data exists
ls -lh "$(git rev-parse --show-toplevel)/chatbot/data/enterprise-attack.json
# Check current embedding model is still available on OpenRouter
# Visit https://openrouter.ai/models and search for the model name below
# Free-tier models rotate — verify before running if it has been >30 days
grep -r "embed" "$(git rev-parse --show-toplevel)/chatbot/modules/mitre_embeddings.py | grep "model"
cd "$(git rev-parse --show-toplevel)"
python3 -c "
from chatbot.modules.mitre_embeddings import build_technique_embeddings, save_embeddings_json
from chatbot.modules.mitre import MitreHelper
from chatbot.modules import embeddings
mitre = MitreHelper(use_local=True)
cache = build_technique_embeddings(mitre, embeddings)
save_embeddings_json(cache, 'chatbot/data/technique_embeddings.json')
"
chatbot/data/technique_embeddings.json — should be ≥40 MB| Symptom | Fix |
|---|---|
OPENROUTER_API_KEY missing | Add to .env |
| Model 404 / not found | Update model name in chatbot/modules/mitre_embeddings.py |
| Rate limit errors | Wait and re-run — the script resumes from where it left off |
| Output file <10 MB | JSON truncated; delete and re-run |