Advanced Red Team Operations

What it does

Once installed, the agent follows a detailed red team methodology covering the whole lifecycle of a simulated attack: negotiating scope and rules of engagement, designing tiered command-and-control infrastructure, keeping operator activity logged and deconflicted, testing defensive evasion techniques, handling collected data with chain of custody, and writing structured reports with MITRE ATT&CK mappings and purple team debriefs. It is a methodology document that shapes how the agent reasons and writes about these engagements; it does not add new tools, and the visible content is largely guidance and example commands rather than an automated attack runner.

Try asking

• “Help me draft rules of engagement and a deconfliction process for an authorized red team test of our bank.”Copy
• “Map this simulated attack chain to MITRE ATT&CK techniques and write the findings section of the report.”Copy
• “Outline a purple team debrief agenda to check whether our EDR caught the lateral movement we simulated.”Copy
• “Design a phased engagement plan with scope, out-of-scope systems, and notification thresholds.”Copy

Get better results

• Always provide signed authorization and a defined scope before asking for any technique guidance, and keep the agent focused on planning, detection and reporting.
• Ask for defensive outputs (detection rules, debrief questions, remediation priorities) to get the most value and reduce risky operational detail.
• Review any commands the agent suggests against your ROE and legal counsel before running them, since the example snippets reference real third-party services and live infrastructure.

What's inside

• SKILL.md