菜单
Internal utility library - not an invokable skill. Contains phase0.sh (session state, intel relay, memory read) and signals.sh (append-only signal emission). Sourced by all other skills via `source ~/.claude/skills/_shared/phase0.sh`.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when starting any pentesting engagement, receiving a target domain or IP, saying "new engagement", "start a pentest", "plan this target", or beginning any offensive security assessment. Invoke this FIRST before any other skill. Also triggers on "bug bounty on X", "test X for me", "attack X", "scope is X".
Use when encountering HTTP 403 Forbidden responses during pentests or bug bounty hunting, testing access control bypasses, trying to reach restricted endpoints, admin panels, or protected API routes. Also trigger when the user says "403 bypass", "bypass forbidden", "access denied bypass", "forbidden page bypass", or "trying to access restricted endpoint". Use this whenever a 403 needs to be tested - not just blindly accepted.
Use when attacking Active Directory environments, hunting Kerberoastable accounts, AS-REP roasting, DCSync, Pass-the-Hash, Pass-the-Ticket, BloodHound path analysis, LDAP enumeration, GPO abuse, ACL abuse, or full AD domain compromise chains. Also use when the user says "attack AD", "domain compromise", "Kerberoast", "DCSync", "BloodHound", or "lateral movement".
Use when auditing cloud infrastructure for misconfigurations, testing AWS IAM privilege escalation, enumerating exposed S3 buckets, attacking GCP service accounts, testing Azure RBAC misconfigs, hunting for exposed Kubernetes API servers, or finding cloud credential leaks in metadata services. Also use when the user says "cloud audit", "AWS pentest", "GCP attack", "K8s attack", "S3 exposed", "metadata service", or "cloud misconfiguration".
Use when context is running long during a pentest engagement, at phase boundaries after completing a full phase, or when the user says "compact", "compress context", "trim context", or "save tokens". Compresses completed phase outputs while keeping session.json as the authoritative source of truth.
Use when running exploitation phase of a pentest, testing for SQL injection, XSS, SSRF, JWT confusion, deserialization, prototype pollution, HTTP smuggling, cache poisoning, SSTI, XXE, GraphQL, SAML, LFI, file upload bypass, CORS, WebSocket hijacking, IDOR, mass assignment, account takeover chains, 2FA bypass, or any class of web/API vulnerability. Also use when the user says "run exploit", "phase 3", "start exploitation", "test for XSS/SQLi/SSRF", or names any specific vuln class.
| name | _shared |
| description | Internal utility library - not an invokable skill. Contains phase0.sh (session state, intel relay, memory read) and signals.sh (append-only signal emission). Sourced by all other skills via `source ~/.claude/skills/_shared/phase0.sh`. |
This directory contains bash libraries sourced by all Akira skills. It is not an invokable skill.
phase0.sh - canonical Phase 0 functions: p0_init_vars, p0_state_gate, p0_read_relay, p0_read_memory, p0_read_hypotheses, p0_manifest_write, p0_relay_write, p0_completion_gatesignals.sh - atomic append-only signal emission: emit_signal TYPE VALUE SOURCE CONFIDENCEsource ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh