[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DG679DTTP3MDFMYWVCS6ET":3,"skill-same:01M7DG679DTTP3MDFMYWVCS6ET":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DG679DTTP3MDFMYWVCS6ET","engagement-lifecycle",null,"Red team engagement lifecycle management — initiation, phase transitions, go\u002Fno-go gates, deconfliction, emergency procedures, completion.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fraptix\u002Fengagement-lifecycle\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: engagement-lifecycle\ndescription: \"Red team engagement lifecycle management — initiation, phase transitions, go\u002Fno-go gates, deconfliction, emergency procedures, completion.\"\nallowed-tools: Read\nmetadata:\n  subdomain: orchestration\n  when_to_use: \"start engagement, new engagement, engagement status, phase transition, go\u002Fno-go, deconfliction, emergency stop, engagement complete, wrap up\"\n  tags: engagement, lifecycle, planning, phase-transition, deconfliction, emergency, completion\n  upstream_ref: \"Raptix engagement lifecycle — orchestrator-level planning skill, no direct attack technique\"\n---\n\n# Engagement Lifecycle Management\n\n## Engagement Initiation\n\n### Pre-Flight Checklist\nBefore starting any engagement, verify:\n\n1. **Documents exist and are valid**:\n   - [ ] `roe.json` — Rules of Engagement with scope, restrictions, contacts\n   - [ ] `conops.json` — Concept of Operations with threat profile and kill chain phases\n   - [ ] `deconfliction.json` — Deconfliction identifiers and procedures\n   - [ ] `opplan.json` — Operational Plan with sequenced, acceptance-gated objectives\n   - [ ] All documents cross-reference consistently\n\n2. **Infrastructure ready**:\n   - [ ] Docker sandbox running with required tools\n   - [ ] C2 server reachable if post-exploitation is in scope: `nc -z c2-sliver 31337` (gRPC port)\n   - [ ] Operator config exists: `\u002Fworkspace\u002F.sliver-configs\u002Fraptix.cfg`\n   - [ ] Output directories created (`\u003Cengagement>\u002Frecon\u002F`, `\u003Cengagement>\u002Fexploit\u002F`, etc.)\n\n3. **If any document is missing**: Delegate to `soundwave` sub-agent first.\n\nAll paths below are relative to the engagement working directory (set via `cd` before commands run).\n\n### Engagement Types and Implications\n\n| Type | Starting Phase | Sub-Agents Used | Key Consideration |\n|------|---------------|-----------------|-------------------|\n| Full Scope | Planning → Recon | All (soundwave, recon, exploit, postexploit) | Longest duration, most OPSEC-sensitive |\n| Assumed Breach | Exploitation | exploit, postexploit | Skip recon, start from provided foothold |\n| Recon Only | Recon | recon only | No exploitation, intelligence gathering only |\n| Objective-Based | Varies | Targeted subset | Focus on specific crown jewels |\n\nRead `plan\u002Froe.json` to determine engagement type and adjust phase ordering accordingly.\n\n## Phase Transitions\n\n### Gate Checks (Go\u002FNo-Go Decisions)\n\nBefore transitioning between phases, verify the gate criteria from the `workflow` skill:\n\n```\nPlanning → Recon:    roe.json + conops.json + deconfliction.json + opplan.json exist and validated\nRecon → Exploit:     Attack surface identified, targets prioritized, vulns catalogued\nExploit → PostExploit: Initial foothold established, access type documented\nPostExploit → Report: All OPPLAN objectives resolved (passed or blocked)\n```\n\n### Phase Transition Protocol\n1. Read current phase objectives from opplan.json\n2. Check: are all current-phase objectives resolved?\n3. Check: does the next phase have pending objectives?\n4. Verify gate criteria (consult `workflow` skill for phase-specific gates)\n5. If gate passes → proceed. If not → identify what's missing and address it.\n\n### Handling Cross-Phase Dependencies\nSome objectives may uncover new targets or invalidate assumptions:\n- **New targets discovered during recon** → Update plan\u002Fopplan.json with new objectives\n- **Exploit fails, need more recon** → Return to recon phase for that specific target\n- **PostExploit reveals new network segments** → May need additional recon\u002Fexploit cycles\n\n## Deconfliction\n\n### Blue Team Coordination\nIf `roe.json` specifies deconfliction contacts:\n- Record all major actions with timestamps in `timeline.jsonl` only when a real event occurs\n- If blue team detects and responds, note this as a data point (MTTD measurement)\n- Never reveal TTPs to blue team during active engagement unless ROE requires it\n\n### Emergency Stop Procedure\nIf engagement must be halted:\n1. Immediately stop all active sub-agent tasks\n2. Document current state: which objectives in-progress, what's deployed\n3. Record the halt in `timeline.jsonl` and update the affected OPPLAN objectives\n4. Save plan\u002Fopplan.json with current status for potential resumption\n\n## Engagement Metrics\n\nTrack these throughout the engagement for the final report:\n\n| Metric | Description | Source |\n|--------|-------------|--------|\n| MTTD | Mean Time to Detect (per objective) | Blue team detection timestamps |\n| Dwell Time | Time from foothold to detection | `timeline.jsonl` timestamps |\n| Objectives Completed | Passed \u002F Total | opplan.json status counts |\n| Attack Path Depth | Number of hops from initial access | lateral movement log |\n| Credential Exposure | Unique credentials captured | post-exploit\u002Fcreds\u002F |\n\n## Engagement Completion\n\n### Final Reporting Checklist\nWhen all objectives are resolved:\n\n1. **Attack Path Documentation**:\n   - Every hop from initial recon to final objective\n   - Credentials used at each step\n   - Privilege levels achieved on each host\n\n2. **Findings Synthesis**:\n   - Read all `\u003Cengagement>\u002Ffindings\u002FFIND-*.md` entries\n   - Group by severity: Critical, High, Medium, Low\n   - Map each finding to MITRE ATT&CK technique\n\n3. **Remediation Recommendations**:\n   - For each successful attack path, suggest defensive controls\n   - Prioritize by: quick wins vs. strategic improvements\n   - Reference where in the kill chain the control would interrupt the attack\n\n4. **Evidence Preservation**:\n   - All scan outputs in `\u003Cengagement>\u002Frecon\u002F`\n   - All exploit artifacts in `\u003Cengagement>\u002Fexploit\u002F`\n   - All post-exploit evidence in `\u003Cengagement>\u002Fpost-exploit\u002F`\n   - Credential inventory (encrypted)\n\n5. **Cleanup**:\n   - List all artifacts deployed on target systems\n   - Document persistence mechanisms that need removal\n   - Verify no active implants remain (if applicable)\n","# Engagement Lifecycle Management\n\n## Engagement Initiation\n\n### Pre-Flight Checklist\nBefore starting any engagement, verify:\n\n1. **Documents exist and are valid**:\n   - [ ] `roe.json` — Rules of Engagement with scope, restrictions, contacts\n   - [ ] `conops.json` — Concept of Operations with threat profile and kill chain phases\n   - [ ] `deconfliction.json` — Deconfliction identifiers and procedures\n   - [ ] `opplan.json` — Operational Plan with sequenced, acceptance-gated objectives\n   - [ ] All documents cross-reference consistently\n\n2. **Infrastructure ready**:\n   - [ ] Docker sandbox running with required tools\n   - [ ] C2 server reachable if post-exploitation is in scope: `nc -z c2-sliver 31337` (gRPC port)\n   - [ ] Operator config exists: `\u002Fworkspace\u002F.sliver-configs\u002Fraptix.cfg`\n   - [ ] Output directories created (`\u003Cengagement>\u002Frecon\u002F`, `\u003Cengagement>\u002Fexploit\u002F`, etc.)\n\n3. **If any document is missing**: Delegate to `soundwave` sub-agent first.\n\nAll paths below are relative to the engagement working directory (set via `cd` before commands run).\n\n### Engagement Types and Implications\n\n| Type | Starting Phase | Sub-Agents Used | Key Consideration |\n|------|---------------|-----------------|-------------------|\n| Full Scope | Planning → Recon | All (soundwave, recon, exploit, postexploit) | Longest duration, most OPSEC-sensitive |\n| Assumed Breach | Exploitation | exploit, postexploit | Skip recon, start from provided foothold |\n| Recon Only | Recon | recon only | No exploitation, intelligence gathering only |\n| Objective-Based | Varies | Targeted subset | Focus on specific crown jewels |\n\nRead `plan\u002Froe.json` to determine engagement type and adjust phase ordering accordingly.\n\n## Phase Transitions\n\n### Gate Checks (Go\u002FNo-Go Decisions)\n\nBefore transitioning between phases, verify the gate criteria from the `workflow` skill:\n\n```\nPlanning → Recon:    roe.json + conops.json + deconfliction.json + opplan.json exist and validated\nRecon → Exploit:     Attack surface identified, targets prioritized, vulns catalogued\nExploit → PostExploit: Initial foothold established, access type documented\nPostExploit → Report: All OPPLAN objectives resolved (passed or blocked)\n```\n\n### Phase Transition Protocol\n1. Read current phase objectives from opplan.json\n2. Check: are all current-phase objectives resolved?\n3. Check: does the next phase have pending objectives?\n4. Verify gate criteria (consult `workflow` skill for phase-specific gates)\n5. If gate passes → proceed. If not → identify what's missing and address it.\n\n### Handling Cross-Phase Dependencies\nSome objectives may uncover new targets or invalidate assumptions:\n- **New targets discovered during recon** → Update plan\u002Fopplan.json with new objectives\n- **Exploit fails, need more recon** → Return to recon phase for that specific target\n- **PostExploit reveals new network segments** → May need additional recon\u002Fexploit cycles\n\n## Deconfliction\n\n### Blue Team Coordination\nIf `roe.json` specifies deconfliction contacts:\n- Record all major actions with timestamps in `timeline.jsonl` only when a real event occurs\n- If blue team detects and responds, note this as a data point (MTTD measurement)\n- Never reveal TTPs to blue team during active engagement unless ROE requires it\n\n### Emergency Stop Procedure\nIf engagement must be halted:\n1. Immediately stop all active sub-agent tasks\n2. Document current state: which objectives in-progress, what's deployed\n3. Record the halt in `timeline.jsonl` and update the affected OPPLAN objectives\n4. Save plan\u002Fopplan.json with current status for potential resumption\n\n## Engagement Metrics\n\nTrack these throughout the engagement for the final report:\n\n| Metric | Description | Source |\n|--------|-------------|--------|\n| MTTD | Mean Time to Detect (per objective) | Blue team detection timestamps |\n| Dwell Time | Time from foothold to detection | `timeline.jsonl` timestamps |\n| Objectives Completed | Passed \u002F Total | opplan.json status counts |\n| Attack Path Depth | Number of hops from initial access | lateral movement log |\n| Credential Exposure | Unique credentials captured | post-exploit\u002Fcreds\u002F |\n\n## Engagement Completion\n\n### Final Reporting Checklist\nWhen all objectives are resolved:\n\n1. **Attack Path Documentation**:\n   - Every hop from initial recon to final objective\n   - Credentials used at each step\n   - Privilege levels achieved on each host\n\n2. **Findings Synthesis**:\n   - Read all `\u003Cengagement>\u002Ffindings\u002FFIND-*.md` entries\n   - Group by severity: Critical, High, Medium, Low\n   - Map each finding to MITRE ATT&CK technique\n\n3. **Remediation Recommendations**:\n   - For each successful attack path, suggest defensive controls\n   - Prioritize by: quick wins vs. strategic improvements\n   - Reference where in the kill chain the control would interrupt the attack\n\n4. **Evidence Preservation**:\n   - All scan outputs in `\u003Cengagement>\u002Frecon\u002F`\n   - All exploit artifacts in `\u003Cengagement>\u002Fexploit\u002F`\n   - All post-exploit evidence in `\u003Cengagement>\u002Fpost-exploit\u002F`\n   - Credential inventory (encrypted)\n\n5. **Cleanup**:\n   - List all artifacts deployed on target systems\n   - Document persistence mechanisms that need removal\n   - Verify no active implants remain (if applicable)\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"upstream_ref":28},"engagement, lifecycle, planning, phase-transition, deconfliction, emergency, completion","orchestration","start engagement, new engagement, engagement status, phase transition, go\u002Fno-go, deconfliction, emergency stop, engagement complete, wrap up","Raptix engagement lifecycle — orchestrator-level planning skill, no direct attack technique","Read","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fraptix\u002Fengagement-lifecycle","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill engagement-lifecycle",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill engagement-lifecycle",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill engagement-lifecycle","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fraptix\u002Fengagement-lifecycle\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]