菜单
Use when scope-exploit has operator-approved attack paths and needs to generate the narrative red team playbook, execution steps, persistence, post-exploitation, and IAM policy JSON without detection or SOC guidance.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when constructing SCOPE attack candidate chains from audit artifacts and rejecting facts that do not form attacker progressions.
Use when formatting SCOPE controls detection candidates into detections.md, detections.json, dashboard-readable SPL sections, or controls-schema detection records.
Use when attaching schema-valid SCOPE evidence handles to attack candidates, hops, observations, assumptions, and caveats.
Use when scope-investigate completes an investigation and needs a facts-only analyst summary, evidence timeline, query appendix, investigation gaps, and optional saved investigation artifact.
Use when a SCOPE top-level agent starts a run and needs bounded environment knowledge, durable observations, reasoning notes, coverage gaps, and Splunk patterns before planning.
Use after SCOPE evidence review, final disposition, or operator-approved save to update durable environment knowledge, observations, coverage gaps, or proposed reasoning-note improvements.
| name | scope-exploit-playbook |
| description | Use when scope-exploit has operator-approved attack paths and needs to generate the narrative red team playbook, execution steps, persistence, post-exploitation, and IAM policy JSON without detection or SOC guidance. |
Use this skill after scope-exploit Gate 3 approval and before Gate 4 display.
The top-level agent owns permission discovery, path reasoning, research dispatch, gates, artifact writes, and results.json. This skill owns the playbook document shape only.
TARGET_ARNRUN_IDDISCOVERY_MODE: standalone or auditscope-researchAWS_CLI_REPLAY from scope-awscli-replayAWS_CLI_REPLAY.AWS_CLI_REPLAY.paths[].commands[].scope-controls and scope-investigate.# Red Team Playbook — [TARGET_ARN]
**Run ID:** [RUN_ID]
**Discovery mode:** [standalone | audit]
**Generated:** [ISO-8601 timestamp]
## Discovery Summary
[What was probed or loaded, what succeeded, what was denied, and what those results revealed.]
## Path 1: [Descriptive Name]
[Narrative explanation of the attack chain, the permissions that enable it, and where the chain leads. Weave research citations inline when present.]
### Step 1: [Action Description]
```bash
[Command from AWS_CLI_REPLAY.paths[].commands[]]
[Why this step comes first and what it enables.]
[Persistence steps available from this path.]
[Data access, lateral movement, or impact unlocked by the path.]
{
"Version": "2012-10-17",
"Statement": []
}
Repeat the path block for every operator-approved path.
## Output Contract
Return:
```text
EXPLOIT_PLAYBOOK
status: complete|skipped|error
path_count: N
sections:
- Discovery Summary
- Path N
write_ready: true|false
warnings:
- ...