From communitytools
Orchestrates penetration testing workflow by spawning executor and validator agents, managing attack-chain.md, experiments.md, recon, and validation for security engagements.
npx claudepluginhub transilienceai/communitytoolsThis skill uses the workspace's default tool permissions.
Inline. Holds context. Thinks before every action.
Initializes pentesting or bug bounty engagements by extracting targets from messages, bootstrapping from memory.json, and generating 4-6 ranked probabilistic attack chain hypotheses.
Provides methodology guidance for authorized penetration testing and red team engagements, routing to 11 specialized agents covering the full MITRE ATT&CK kill chain.
Performs goal-directed penetration testing on running systems with source code access. Simulates adversarial attacks targeting trust boundaries to identify exploitable seams.
Share bugs, ideas, or general feedback.
Inline. Holds context. Thinks before every action.
P0: Ingest scope
↓
P1: Recon + read source code → write attack-chain.md + create experiments.md header
↓
┌→ P2: Think — read chain + experiments.md, dedup, design 1-2 experiments
│ P2b: Research (conditional) — see reference/creative-research.md
│ P3: Execute — spawn 1-2 executors with CHAIN_CONTEXT [+ RESEARCH_BRIEF]
│ P4: Integrate — read results, update chain, revise theory
│ No progress 2 batches → P4b
│ Goal → P5
└─ loop (max 30 experiments)
P4b: Reset — re-read all recon + source + chain. Creative Research (MANDATORY). Fresh theory.
P5: Validate + Report
formats/reconnaissance.md). Create {OUTPUT_DIR}/experiments.md with header row (see format below).attack-chain.mdskills/coordination/reference/VALIDATION.md){OUTPUT_DIR}/artifacts/validated/ → Transilience PDF via formats/transilience-report-style/SKILL.md (MANDATORY)At {OUTPUT_DIR}/attack-chain.md. Updated every batch. Sections: services, surface, theory, tested, next.
Keep it terse — bullet points, no prose.
At {OUTPUT_DIR}/experiments.md. Append-only table — never prune, never rewrite. Format: formats/logs.md.
count(technique, result=fail) >= 3 → triggers rule 12.Executors log every significant tool invocation to {OUTPUT_DIR}/tools/{NNN}_{tool}.md with input + output. See formats/logs.md.
Triggers — research when ANY of:
Method: follow reference/creative-research.md. Synthesize model knowledge + online sources + skill cross-reference into a RESEARCH_BRIEF (max 10 lines) appended to executor prompt.
Do NOT research every batch. Most batches skip P2b entirely.
Consult reference/context-injection.md before building any agent prompt.
executor = Read("skills/coordination/reference/executor-role.md")
chain = Read(f"{output_dir}/attack-chain.md")
experiments = Read(f"{output_dir}/experiments.md")
# Optional: if P2b produced a brief
# research = "RESEARCH_BRIEF:\n- [model] ...\n- [web] ...\n- [skills] ..."
# 1-2 executors per batch — pass only relevant PATT_URL, not full map
Agent(prompt=f"{executor}\nMISSION_ID: m-001\nEXPERIMENT_ID: E-001\n"
f"CHAIN_CONTEXT: {chain}\nEXPERIMENTS: {experiments}\n"
f"OBJECTIVE: ...\nSKILL_FILES: ...\nPATT_URL: ...\nOUTPUT_DIR: {output_dir}\n"
f"{research if research else ''}",
description="Blind SQLi /search", run_in_background=True)
# Wait. Read results. Think. Update attack-chain.md. THEN next batch.
# Validators — one per finding (BLIND REVIEW — see context-injection.md)
validator = Read("skills/coordination/reference/validator-role.md")
Agent(prompt=f"{validator}\nfinding_id: F-001\n"
f"FINDING_DIR: {output_dir}/findings/finding-001/\n"
f"TARGET_URL: ...\nOUTPUT_DIR: {output_dir}/artifacts",
run_in_background=True)
# After all validators complete:
# 1. Read artifacts/validated/ and artifacts/false-positives/
# 2. Verify each validated finding has findings/{id}/evidence/validation/validation-summary.md
# 3. Flag any finding that passed validation but has no proof
Pass only the relevant PATT_URL for this mission, not the full URL map.
| Role | File | Context |
|---|---|---|
| Executor | reference/executor-role.md | Full chain + skills |
| Validator | reference/validator-role.md | Evidence only (blind) |
See reference/context-injection.md for what each role receives and what is withheld.
formats/transilience-report-style/pentest-report.md.evidence/validation/validation-summary.md. Flag any that passed without proof.reference/creative-research.md. Max 3 WebSearch + 2 WebFetch per cycle.patt-fetcher/SKILL.md into executor prompts. Pass only the relevant PATT_URL.reference/ATTACK_INDEX.md · reference/OUTPUT_STRUCTURE.md · reference/VALIDATION.md · reference/GIT_CONVENTIONS.md · reference/context-injection.md · reference/creative-research.md · formats/INDEX.md