# `attack-chain` vs `pentest-tools` in reverse-skill: Understanding the Orchestrator vs Single-Stage Tools

> Explore the difference between attack-chain orchestrators and individual pentest tools in reverse-skill. Understand how to leverage both for complete penetration tests and isolated tasks.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-14

---

**The `attack-chain` module is the multi-stage orchestrator for complete penetration tests, while individual `pentest-tools` are single-purpose utilities for isolated tasks that bypass the chain.**

The reverse-skill repository implements a hierarchical skill system where high-level engagement planning and concrete technical execution are cleanly separated. Understanding this distinction is essential for correctly routing security automation workflows.

## Purpose and Architectural Role

### `attack-chain`: The Central Orchestrator

The `attack-chain` module serves as the **strategic coordination layer** for complex, multi-phase security engagements. Located at [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md), it implements a decision-tree routing system (lines 73-85) that plans, sequences, and supervises complete attack lifecycles.

According to the source documentation, `attack-chain` is invoked when requests involve:
- More than one attack phase
- High-level path decisions (e.g., external-to-domain-controller movement)
- Supply-chain or multi-vector scenarios
- Full red-team exercises requiring coherent kill-chain execution

The module evaluates attack surface, selects optimal sub-skill sequences, manages constraints and fallback paths, and updates case timelines, work-items, and evidence logs after each phase.

### `pentest-tools`: Single-Stage Tactical Utilities

Individual `pentest-tools` are **focused, single-stage utilities** that perform discrete technical actions without cross-stage planning. The [`attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/attack-chain/SKILL.md) explicitly lists these as tasks that **bypass the orchestrator entirely** (lines 41-45).

Examples include:
- Port scanning with `nmap`
- SQL injection testing with `sqlmap`
- APK reverse-engineering
- Firmware extraction and analysis

These tools operate as **leaf nodes** in the decision tree—receiving well-defined inputs, executing concrete actions, and returning results directly without further delegation.

## Routing Logic: When Each Component Handles the Request

The routing determination occurs at the entry point of the reverse-skill system. Per the source documentation in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md):

| Request Type | Routed To | Example |
|-------------|-----------|---------|
| Multi-stage engagement with sequential phases | `attack-chain` orchestrator | "Perform full penetration test from recon to domain admin" |
| Single technical action without dependencies | Individual `pentest-tool` | "Run port scan on 10.0.0.1" |

The orchestrator's decision logic (simplified from lines 73-85):

```yaml

# Multi-stage: routed through attack-chain orchestrator

request:
  description: "Full penetration test on target.example.com"
  stages: ["recon", "initial_access", "privilege_escalation", "lateral_movement"]

```

```yaml

# Single-stage: bypasses attack-chain, direct tool execution

request:
  description: "Identify open ports on 10.0.0.1"
  tool: "nmap"
  args: "-Pn -p-"

```

## Scope of Responsibilities

### `attack-chain` Responsibilities

- **Attack surface determination**: Maps target environment and identifies viable entry points
- **Sequence optimization**: Orders phases to maximize efficiency and minimize detection
- **Sub-skill delegation**: Hands off each phase to appropriate tools (including `pentest-tools`, `apk-reverse`, `cloud-k8s`)
- **State management**: Maintains case context across phases
- **Evidence chain generation**: Triggers final report creation via `docs-generator`

### `pentest-tools` Responsibilities

- **Concrete execution**: Runs specific technical procedures (e.g., `nmap`, `sqlmap`, custom scripts)
- **Immediate output production**: Returns scan results, extracted artifacts, or shell access
- **No cross-stage awareness**: Operates independently without knowledge of broader engagement context

## Evidence and Output Models

The `attack-chain` module generates a **complete evidence chain** that feeds into automated reporting. Individual `pentest-tools` produce **technical outputs** that become evidence artifacts only when integrated by the orchestrator.

```powershell

# Simplified orchestration pattern from attack-chain/SKILL.md

if ($request.stages.Count -gt 1) {
    # Multi-stage: plan and coordinate

    $phase1 = Invoke-Tool -Path "../firmware-pentest/scripts/extract.sh" -Args $firmware
    $phase2 = Invoke-Tool -Path "../apk-reverse/tools/jadx" -Args $extracted_apk
    # ...continue with dependency-aware sequencing

    Update-EvidenceChain -PhaseResults @($phase1, $phase2)
}

```

```bash

# Direct single-stage invocation (bypasses orchestrator)

nmap -Pn -p- 10.0.0.1 -oN scan.txt

```

## Physical File Structure

Despite the conceptual importance of `pentest-tools`, **no dedicated folder exists** with that name. Instead, individual tools are distributed across specialized skill directories:

| Path | Content |
|------|---------|
| [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) | Core orchestrator definition and routing rules |
| [`skills/attack-chain/references/lifecycle-checklist.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/lifecycle-checklist.md) | Stage-gate validation checklist |
| [`skills/INDEX.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/INDEX.md) | High-level skill matrix linking orchestrator to sub-skills |
| `skills/firmware-pentest/scripts/` | Firmware extraction and analysis tools |
| `skills/apk-reverse/tools/` | Android reverse-engineering utilities |
| `skills/cloud-k8s/` | Container and Kubernetes assessment tools |

This distributed organization reflects the design principle: **tools are grouped by target domain, not by "single-stage vs multi-stage" classification**.

## Practical Workflow Examples

### Scenario A: Full Red-Team Engagement

```yaml

# Request enters through attack-chain

engagement:
  type: "full_redteam"
  target: "corporate-network.example.com"
  objectives: ["domain_admin", "sensitive_data_exfil"]

# attack-chain/SKILL.md executes:

# 1. Recon phase → delegates to external-recon tools

# 2. Initial access → selects viable entry vector

# 3. Privilege escalation → chains appropriate techniques

# 4. Lateral movement → coordinates across subnets

# 5. Impact → executes exfiltration with evidence logging

# 6. Final report → triggers docs-generator with complete chain

```

### Scenario B: Isolated APK Analysis

```bash

# Request routed directly to tool, bypassing attack-chain

java -jar skills/apk-reverse/tools/jadx/bin/jadx \
  -d output_dir/ \
  target_application.apk

# Result returned immediately without orchestration overhead

```

## Summary

- **`attack-chain`** is the **multi-stage orchestrator** for complex engagements, implementing decision-tree routing and cross-phase coordination
- **`pentest-tools`** are **single-stage utilities** for isolated tasks, explicitly bypassing the orchestrator per [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) lines 41-45
- **Routing determination** depends on request complexity: multi-phase requests flow through `attack-chain`, single actions go direct
- **Physical implementation** distributes tools across domain-specific directories (`firmware-pentest`, `apk-reverse`, `cloud-k8s`) rather than a central `pentest-tools` folder
- **Evidence handling** differs: `attack-chain` builds integrated chains, individual tools produce raw technical output

## Frequently Asked Questions

### When should I route a request through `attack-chain` versus a direct tool invocation?

Route through `attack-chain` when the request involves multiple sequential phases, requires strategic planning across the kill-chain, or needs coherent evidence integration. Use direct tool invocation for isolated, single-action tasks with no dependencies—explicitly listed in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) lines 41-45 as cases that bypass the orchestrator.

### Why is there no `pentest-tools` directory in the repository?

The reverse-skill architecture organizes tools by **target domain** rather than execution mode. Individual utilities reside in specialized directories like `skills/firmware-pentest/` and `skills/apk-reverse/tools/`. The term `pentest-tools` describes a **functional category** in the routing logic, not a physical filesystem location.

### How does `attack-chain` maintain state across multiple pentest-tool invocations?

The orchestrator maintains case context through a **timeline and work-item system** defined in [`skills/attack-chain/references/lifecycle-checklist.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/lifecycle-checklist.md). After delegating to each sub-skill (including individual tools), it retrieves results, updates evidence logs, and determines subsequent phases based on accumulated findings.

### Can a single tool be called both directly and through `attack-chain`?

Yes. The same underlying utility (e.g., a port scanner in `skills/firmware-pentest/scripts/`) can execute:
- **Directly** when a user requests "scan ports on X"
- **Via `attack-chain`** when that scan is one phase of a larger engagement, with output feeding into phase-transition logic and evidence chains