菜单
Phase 2 — Skill Selection. Map recon findings to specific exploit skills from the 764-skill catalog. Triggered by arsenal-phase-recon when RECON_COMPLETE is found.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Arsenal offensive security agent — 5-phase attack workflow. When a user asks to attack, hack, pentest, or assess a target, follow this skill. 764 cybersecurity skills, 22 lab targets, real recon tools (nmap, dig, curl, openssl).
Phase 3 — Execution. Run matched exploit playbooks against lab targets. Triggered by arsenal-phase-skill-match when SKILLS_MATCHED is found.
Phase 5 — Notification. Deliver pipeline results via Telegram message. Terminal link for any phase — starter failure, recon no-targets, execution critical findings, or final report.
Phase 1 — Reconnaissance. Run nmap, dig, curl, openssl against lab targets. Triggered by arsenal-pipeline-starter when TARGETS_READY is found.
Phase 4 — Report. Compile execution findings into a structured markdown report. Triggered by arsenal-phase-execute when EXECUTION_COMPLETE is found.
Entry point for the Arsenal automated attack pipeline. Cron-triggered daily scan of lab targets. Chains through recon → skill-match → execute → report → notify.
| name | arsenal-phase-skill-match |
| description | Phase 2 — Skill Selection. Map recon findings to specific exploit skills from the 764-skill catalog. Triggered by arsenal-phase-recon when RECON_COMPLETE is found. |
Take recon output and map every finding to specific exploit skills from the 764-skill catalog. Use the Arsenal skill search and the skill-matcher engine to find the best matches.
Parse incoming RECON_COMPLETE blocks — each target's ports, services, web tech
For each finding, query matching skills:
arsenal_skill_list(group="web"), then drill to arsenal_skill_list(search="<tech>")arsenal_skill_list(search="sqli") or arsenal_skill_list(search="sql injection")arsenal_skill_list(search="ssh"), arsenal_skill_list(search="brute force")arsenal_skill_list(search="authentication"), arsenal_skill_list(search="credential")arsenal_skill_list(search="<server>") for version-specific CVEsarsenal_skill_list(search="wordpress"), arsenal_skill_list(search="cms")arsenal_skill_list(search="api"), arsenal_skill_list(search="injection")For each matched skill, read the playbook:
arsenal_skill_show(skill_id="<id>") to get the exact attack procedureAlso run terminal-based skill matching for broader coverage:
node dist/index.js skill list --search "<keyword>" from the arsenal-cli directoryBuild a prioritized execution plan:
Output the match plan:
SKILLS_MATCHED: <target_name>
- exploiting-sql-injection-vulnerabilities (score: 85, group: web)
→ Matches: MySQL/8.0 on port 3306
→ Tools: sqlmap, curl, burp
→ Prerequisites met: YES (database accessible)
- testing-for-xss-vulnerabilities (score: 72, group: web)
→ Matches: Apache/PHP web app
→ Tools: burp, curl, browser
→ Prerequisites met: YES (web forms found)
- implementing-ssh-hardening-assessment (score: 45, group: network)
→ Matches: SSH on port 22
→ Tools: hydra, nmap, ssh-audit
→ Prerequisites met: PARTIAL (need cred list)
on_complete: