菜单
Coordinating multiple specialized agents to conduct complex penetration testing engagements through task decomposition, parallel execution, result aggregation, and conflict resolution.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/brucesongs/kali-claw --skill multi-agent-collaboration命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Semantic-layer attack testing against AI systems and LLM-integrated applications.
Cloud security covers security assessment for major cloud platforms including AWS, Azure, and GCP, with core focus on IAM misconfiguration detection, storage bucket exposure scanning, metadata service attacks, container escape, and Kubernetes RBAC auditing.
Defensive deception and honeypot deployment covering SSH/Telnet (Cowrie), web (OpenCanary), enterprise (HFish), ICS/SCADA (Conpot), all-in-one (T-Pot), AI-driven deception (Beelzebub), Thinkst Canarytokens (DNS, HTTP, file, AWS API key, SQL), Dionaea multi-protocol honeypot, notification pipelines (Slack/Teams webhooks), false positive tuning, and attacker engagement — including lure design, deployment OPSEC, IOC extraction, and attacker attribution.
基于 SOC 职业分类
正在显示 SKILL.md
| name | multi-agent-collaboration |
| description | Coordinating multiple specialized agents to conduct complex penetration testing engagements through task decomposition, parallel execution, result aggregation, and conflict resolution. |
| origin | openclaw |
| version | 0.2.0.2 |
| compatibility | ["openclaw","claude-code","cursor","windsurf"] |
| allowed-tools | ["Bash","Read","Write","Edit","WebSearch","WebFetch","Agent"] |
| defense_triple_required | false |
| metadata | {"domain":"infrastructure","tool_count":0,"guide_count":5,"last_reviewed":"2026-07-26"} |
Supplementary Files:
payloads.md— Task decomposition templates, agent role definition prompts, coordinator dispatch templates, result aggregation JSON schema, deduplication checklist, conflict resolution decision tree, and coverage verification matrixtest-cases.md— Structured test cases for parallel recon, multi-target aggregation, deduplication conflicts, coverage auditing, and full coordinator-worker engagementsguides/coordinated-pentest-playbook.md— Deep-dive guide on agent role design, task decomposition methodology, communication protocol, result integration, quality gates, and common failure modes
Multi Agent Collaboration skill domain covering infrastructure operations.
Domain: infrastructure
| Attribute | Value |
|---|---|
| Domain | Multi-Agent Collaboration — Coordinated Penetration Testing |
| Skill ID | multi-agent-collaboration |
| Version | 1.0.0 |
| Hacker Laws | Law 4 (Parallel Attack Surface), Law 7 (Minimal Footprint), Law 8 (Trust but Verify), Law 10 (Orchestration over Isolation) |
| Related Skills | council, autonomous-loops, verification-loop, chronicle, article-writing, safety-guard |
Coordinating multiple specialized agents to conduct complex penetration testing engagements through task decomposition, parallel execution, result aggregation, and conflict resolution. Where a single agent works iteratively, multi-agent collaboration fans out work across specialized instances and fans the results back in — achieving coverage at a speed and depth that no single agent can match.
Critical distinctions from related skills:
| Skill | Core Mechanic | Input/Output Relationship |
|---|---|---|
council | Debate — same question, multiple analytical lenses | Same input → multiple perspectives → synthesized judgment |
autonomous-loops | Iteration — single agent, repeating patterns | One agent → loop construct → sequential or batched results |
multi-agent-collaboration| Decomposition — different tasks to different agents |
| Scope → decomposed tasks → parallel execution → aggregated findings |
Multi-agent collaboration is about who does what, not about how one agent thinks or iterates.
Divide the engagement into phases and assign each phase to a specialized agent. Some phases can run in parallel (recon and initial web discovery); others are sequentially dependent (exploitation requires scan results).
Phase Assignment:
[Recon Agent] ← runs first or in parallel with Web Discovery
[Scan Agent] ← depends on Recon results
[Web Discovery Agent]← can run in parallel with Recon
[Exploit Agent] ← depends on Scan + Web Discovery results
[Post-Exploit Agent] ← depends on successful Exploit results
[Report Agent] ← depends on all prior results
Best for: Single complex target where deep sequential attack chains are needed but individual phases can be parallelized internally.
Trigger conditions: Single target, depth over breadth, phased penetration methodology required.
Assign each distinct target (host, application, subnet) to an independent agent instance. Each agent runs a complete assessment on its target, then results are aggregated.
Target Distribution:
[Agent-T1] → 192.168.1.10
[Agent-T2] → 192.168.1.11
[Agent-T3] → app.example.com
[Agent-T4] → api.example.com
[Agent-T5] → staging.example.com
↓ (all parallel)
[Coordinator] → aggregate + deduplicate → unified findings
Best for: Multiple independent targets with similar assessment scope (e.g., all web applications, all Linux hosts in a subnet).
Trigger conditions: N targets where N >= 3, targets are independently assessable, uniform assessment methodology.
Agents are defined by the tool family they master rather than by target or phase. Each specialist covers their domain across the entire scope.
Specialist Assignment (same scope, different tool families):
[Network Scanner Agent] → nmap, masscan, netdiscover
[Web Tester Agent] → ffuf, nikto, sqlmap, burp
[OSINT Agent] → theHarvester, recon-ng, shodan
[Binary Analyst Agent] → ghidra, binwalk, strings, gdb
[Credential Agent] → hydra, hashcat, kerbrute
Best for: Comprehensive coverage where each domain requires deep expertise and the attack surface spans multiple tool families.
Trigger conditions: Broad scope, specialist depth required, tool domains are clearly separable.
One orchestrator agent holds the master scope, decomposes tasks, dispatches to N worker agents, monitors progress, handles failures, and aggregates results. Workers report back in structured format; coordinator maintains the master finding list.
[Coordinator Agent]
├── dispatches Task-A → [Worker-1]
├── dispatches Task-B → [Worker-2]
├── dispatches Task-C → [Worker-3]
├── monitors status + handles failures
└── aggregates results → master finding list
Best for: Complex engagements where task dependencies shift dynamically, worker failures need rerouting, and a single authority must maintain engagement state.
Trigger conditions: High task complexity, dynamic dependencies, need for centralized state management.
Apply multi-agent collaboration when two or more of the following are true:
| Condition | Threshold |
|---|---|
| Independent attack surfaces | 3 or more clearly separable |
| Target count | 3 or more independent targets |
| Time constraint | Wall-clock budget < single-agent throughput |
| Specialist depth required | 2+ tool families need expert-level coverage |
| Verification burden | Critical findings require independent confirmation |
Do not use multi-agent collaboration for:
autonomous-loops Sequential Pipeline instead)council instead)autonomous-loops Batch Processing instead)Before assigning tasks to parallel agents, verify independence:
Tasks that pass all four checks are safe for true parallelization.
| Granularity | Problem | Signal |
|---|---|---|
| Too coarse | Agents block each other waiting for shared resources | Agent idle time > 30% |
| Correct | Agents run independently, minimal coordination overhead | Steady progress, results accumulating |
| Too fine | Coordination overhead (dispatch, format, aggregate) exceeds task execution time | Tasks complete in <2 minutes |
Practical rule: Tasks smaller than 10 minutes of work are typically too fine-grained for separate agents — batch them together or use a loop pattern instead.
When multiple agents report findings on the same target:
When agents disagree on vulnerability status (one says vulnerable, one says not):
After all agents return results, audit for gaps using the Coverage Matrix (see payloads.md):
index=agent coordination.council=* | stats dc(agent_id) as workers by session | where workers > 5ECC Loop Pattern: Batch Processing
Rationale: Multi-agent collaboration is inherently a batch distribution problem — the coordinator fans out tasks to specialized workers, monitors parallel execution, and fans in results for aggregation. The Batch Processing pattern from autonomous-loops provides exactly this dispatch/aggregate structure. The coordinator itself runs a Batch Processing loop; each worker may run any loop pattern appropriate to its assigned task.
Integration:
chronicle (consolidated findings log), article-writing (final report aggregation), verification-loop (post-aggregation confirmation of critical findings)council (strategic model selection — which collaboration model fits this engagement), autonomous-loops (each worker agent runs its own appropriate loop pattern), safety-guard (scope enforcement applied independently to every agent)Cross-Skill Pipeline:
council
→ [strategic decision: which collaboration model to use, scope risk assessment]
↓
multi-agent-collaboration
→ [decompose scope into parallel tasks, assign agents by model]
↓
[Worker A: network-pentest] [Worker B: web-*] [Worker C: osint]
(each runs autonomous-loops pattern internally)
↓ (parallel execution, results returned to coordinator)
multi-agent-collaboration
→ [aggregate findings, run deduplication, resolve conflicts]
↓
verification-loop
→ [independent confirmation of all Critical/High findings]
↓
chronicle + article-writing
→ [consolidated engagement report]
Quality Gate: Before declaring a multi-agent engagement complete, verify all of the following: