菜单
Run a red team offensive security assessment on the app: reconnaissance, code analysis, exploit development, and remediation recommendations.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run a blue team defensive security assessment on the app: OWASP ASVS Level 2, CAS compliance, threat modeling, kill chains, deterministic scanning, and HTML report generation.
Scaffold and build an app from the harness's template. Copies template/public into ./app/, optionally strips unused code, and follows the build guides. Sole sanctioned scaffold path — never build by hand.
Run a green team deterministic code review against a target codebase, multi-round static and dynamic analysis (Round 1: npm audit, secrets, dangerous patterns, dependencies, licences, circular imports, formatting, govulncheck, OpenAPI lint, gitignore, env defaults, migrations, compiled binaries, API baseURL audit, Go toolchain; Round 2: type checking, ESLint, vitest coverage, go test coverage, integration test enumeration, test-bypass audit, CI pipeline audit, console-log scan, refinement re-framing). Mirrors the blueteam / redteam pipeline shape. Modeled on real human-led code reviews. Usage: /greenteam [--target /path/to/repo] [--round 1|2|all]
Phase 1 of the build lifecycle. Read every input under ./phases/phase1-requirements/inputs/, classify and analyze each document, and produce a structured FR/NFR/module-decomposition deliverable at ./phases/phase1-requirements/output/requirements.md. Usage: /phase1-requirements [--module moduleName]
Phase 2 of the build lifecycle. Read the requirements deliverable from ./phases/phase1-requirements/output/requirements.md, then produce a highly structured plan: roadmap, task breakdown, dependency graph, estimates, critical path, resource plan, and risks. Hard-blocks if requirements.md is missing. Usage: /phase2-planning [--module moduleName]
Phase 3 of the build lifecycle. Read requirements.md and plan.md from prior phase outputs, then produce a structured architecture deliverable: system context, components, data model, API contract, auth flow, deployment topology, tech stack (aligned with template/), ADRs, NFR-to-component mapping, and a STRIDE-lite threat model. Hard-blocks if either prior artifact is missing. Usage: /phase3-architecture [--module moduleName]
| name | redteam |
| description | Run a red team offensive security assessment on the app: reconnaissance, code analysis, exploit development, and remediation recommendations. |
Run the full offensive security assessment pipeline against ./app/ or a target URL.
/redteam # Assess ./app/ code + local endpoints
/redteam --target https://example.com # Assess a live target
/redteam --phase 3 # Resume from Phase 3 (PoC execution)
cd .claude/security/redteam && npm install
# External recon binaries are OPTIONAL. Every tool has a Node-native fallback.
# On Linux/macOS:
bash scripts/install_recon_deps.sh
# On Windows:
pwsh scripts/install_recon_deps.ps1
For an authenticated run that drives all 4 agents in sequence via the Anthropic Agent SDK:
cd .claude/security/redteam
node pipeline/claude_sdk.js <target-path> \
--agents all \
--endpoint http://localhost:3000 \
--domain localhost \
--identifier my_run
The orchestrator extracts JSON from ```json fences when agents emit
markdown-wrapped output (common pattern), so all four deliverables in
deliverables/ end up as valid JSON ready for the HTML generators.
Execute in phase order. Read .claude/security/redteam/CLAUDE.md for the full protocol.
| Phase | Agent(s) | Parallelism | Skill File |
|---|---|---|---|
| 1 | Recon + Code Analysis | Parallel | skills/01-recon-agent.md + skills/02-code-analysis-agent.md |
| 2 | Dependency + Infrastructure + SAST + Secrets | Parallel | skills/05-* through skills/08-* |
| 3 | PoC Execution | Sequential (needs Phase 1) | skills/03-poc-execution-agent.md |
| 4 | Remediation | Sequential (needs Phase 3) | skills/04-recommendation-agent.md |
deliverables/ as JSON10 JavaScript recon wrappers in .claude/security/redteam/tools/recon/, each implementing a 3-step dispatcher (external binary → Node-native fallback → structured error JSON):
dns_enum.js, whois_lookup.js, subdomain_discovery.js, port_scan.js, tls_scan.js, http_headers.js, tech_fingerprint.js, waf_detect.js, endpoint_discovery.js, ct_search.js
Additional standalone scanner wrappers in scripts/: nmap_scan.js (TCP-connect fallback), semgrep_scan.js, trufflehog_scan.js (with regex sweep fallback), osv_scan.js (with OSV.dev REST fallback), zap_scan.js (manual-run guide / --auto-docker). See .claude/references/security-redteam.md for the full matrix.
After each agent completes, generate its HTML report:
cd .claude/security/redteam
node scripts/recon_json_to_html.js deliverables/recon_deliverable.json
node scripts/code_analysis_json_to_html.js deliverables/code_analysis_deliverable.json
node scripts/poc_json_to_html.js deliverables/poc_testing.json
node scripts/remediation_json_to_html.js deliverables/remediation_report.json
After red team completes, findings should cross-reference with blue team:
.env files or production secrets[REDACTED-*] placeholders for credential values