agentleFS
Sign inStart free
LeostrukaLeostruka/devin-bundle/skills/red-team/SKILL.md

red-team

Skill0 starsChanged 3 months agoMITView on GitHub

Use when running an authorized offensive-security engagement against a declared target (binary, web app, network, wireless, firmware, mobile). Routes to domain skills (re-binary, web-probe, net-probe, wireless-probe, firmware-probe, mobile-probe) and enforces the engagement contract (target/window/ROE) plus evidence discipline.

28 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use codebase-design, domain-modeling and 5 more.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • GoogleSkill

    codebase-design

    Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.

    Also in 4 projects that use this

  • GoogleSkill

    domain-modeling

    Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.

    Also in 4 projects that use this

  • MicrosoftSkill

    grill-with-docs

    Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.

    Also in 4 projects that use this

  • AWSSkill

    ship

    Finalize dev work on an issue branch — update docs, push, and open a PR.

    Also in 3 projects that use this

  • +3 more from google

The file

We split this skill into the rules it gives an agent

4 rules. 0 are common, 3 are distinctive, and 1 is very specific to this project.

  • 0

    Common

    Most of the 27 edited versions we read keep these.

  • 3

    Distinctive

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Every offensive action requires, before any command runs:

    line 15
  2. Very specific:

    Every finding records: command argv, backend, tool version, target sha256 (for artifacts), confidence (confirmed|likely|unknown), and …

    line 52
  3. Distinctive:

    No novel payload authoring.

    line 61
  4. Distinctive:

    No credential harvesting, exfiltration of real secrets, or persistence.

    line 62

“Common” is measured: kept by at least 6 in 10 of the 27 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Red Team

Orchestrator for authorized offensive work. Sibling of security (defensive, audits our own code); this tree operates on declared targets under an explicit engagement contract.

Engagement contract (mandatory)

Every offensive action requires, before any command runs:

  • target: declared scope (host, URL, artifact path, device)
  • window: engagement window
  • roe: rules of engagement reference (allowed techniques, limits)

Missing contract = refuse and ask. Destructive or irreversible actions require explicit per-action confirmation. No credential harvesting. Missing tool = unknown, never fabricated; unsupported platform = unsupported_platform.

Domain routing

Target typeSkillEngine
Binary / APK / firmware REre-binaryextensions/rea-ops/wrapper.py
Web app / API / injectionweb-probeoffsec-tools (zap, sqlmap, nuclei, ffuf)
Host / network / SMB / TLSnet-probeoffsec-tools (nmap, netexec, testssl.sh)
Wi-Fi / RF / SDR / RFIDwireless-probeoffsec-tools (aircrack, hcxtools, kismet)
Firmware image / embeddedfirmware-probeoffsec-tools (binwalk, unblob, emba)
Android/iOS appmobile-probeoffsec-tools (jadx, apktool, mobsf, frida)

Environment check (always first)

python extensions/rea-ops/wrapper.py doctor        # REA CLI + engines
python extensions/offsec-tools/wrapper.py doctor   # tools x backends
python extensions/offsec-tools/wrapper.py capabilities

Backend order for offsec-tools run: --backend native|wsl|docker, else auto (native -> wsl -> docker). WSL2 covers most Linux-only tools; RF capture needs usbipd-win + hardware; native-linux-only tiers report unsupported_platform.

Evidence discipline

Every finding records: command argv, backend, tool version, target sha256 (for artifacts), confidence (confirmed|likely|unknown), and limitations. unknown is a valid answer; absence of evidence is not evidence of absence. Store engagement artifacts under .devin/scratch/ or the engagement workdir, never in target scope.

Boundaries

  • Defensive audits of our own code/config go to security skill.
  • No novel payload authoring; use documented tool capabilities.
  • No credential harvesting, exfiltration of real secrets, or persistence.
  • Active/destructive tool modes are gated by the wrapper (--confirm); confirm per action with the user, not per session.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free