菜单
Run the Phase 3 static analysis, exploitation, and reporting orchestrator — analyzes JavaScript, exploits findings, and produces HTML+Markdown reports (confirmed & manual-validation) plus a reconciliation audit, with persistent false-positive/triage marking
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Produce a unified, top-to-bottom markdown reference document for a selected phase (1, 2, or 3) — assembles the skill entry point, orchestrator pattern, task graph, shared procedures, and every task prompt in execution order
Knowledge Base Audit — read-only health check of knowledge/ (index accuracy, frontmatter completeness, stale entries, coverage gaps, ledger and profile health)
Knowledge Base Consolidation — merge duplicates, upgrade confidence, deprecate stale entries, and keep indexes accurate, one category at a time
Knowledge Base Harvest — convert raw task notes in knowledge/_staging/ into structured, reusable technique files, update indexes, and record technique outcomes in the effectiveness ledger
Run the Phase 1 login discovery orchestrator — identifies the login flow and authenticates all users defined in project.json
Run the Phase 2 application crawl orchestrator — crawls all accessible pages as each authenticated user role
| name | VirtueWebAgent-Phase3 |
| description | Run the Phase 3 static analysis, exploitation, and reporting orchestrator — analyzes JavaScript, exploits findings, and produces HTML+Markdown reports (confirmed & manual-validation) plus a reconciliation audit, with persistent false-positive/triage marking |
| argument-hint | [dry-run] |
Read the shared orchestrator-worker pattern file at prompts/orchestrator-worker.md and follow ALL instructions in it exactly.
You are the Phase 3 Orchestrator. Your goal is to perform static analysis of JavaScript files discovered during crawling, attempt exploitation of identified vulnerabilities, and produce the human-readable reports. Reporting is deterministic: the report-confirmed and report-manual-validation tasks run scripts/build_phase3_report.py to emit self-contained HTML dashboards + Markdown; the report-reconciliation task then runs the builder's --type audit to surface any finding that did not reach a report. Findings can be marked as false positives (or other triage statuses) in the user-owned overlay findings/phase3/false-positives.json, which persists across regeneration; the report tasks remind the user how to do this.
Your phase configuration:
prompts/phase3/tasks.jsonstate/phase3/state.jsonstate/phase3/session-summary.mdPhase 3 — Static Analysis, Exploitation, & ReportingclaudeUser Arguments: $ARGUMENTS
Usage:
/VirtueWebAgent-Phase3 — run the phase normally, resuming from last saved state/VirtueWebAgent-Phase3 dry-run — validate the task graph, prompt files, and input files without launching any agentsBegin immediately with the Startup Procedure defined in the orchestrator-worker pattern.