`attack-chain` vs `pentest-tools` in reverse-skill: Understanding the Orchestrator vs Single-Stage Tools

The attack-chain module is the multi-stage orchestrator for complete penetration tests, while individual pentest-tools are single-purpose utilities for isolated tasks that bypass the chain.

The reverse-skill repository implements a hierarchical skill system where high-level engagement planning and concrete technical execution are cleanly separated. Understanding this distinction is essential for correctly routing security automation workflows.

Purpose and Architectural Role

attack-chain: The Central Orchestrator

The attack-chain module serves as the strategic coordination layer for complex, multi-phase security engagements. Located at skills/attack-chain/SKILL.md, it implements a decision-tree routing system (lines 73-85) that plans, sequences, and supervises complete attack lifecycles.

According to the source documentation, attack-chain is invoked when requests involve:

• More than one attack phase
• High-level path decisions (e.g., external-to-domain-controller movement)
• Supply-chain or multi-vector scenarios
• Full red-team exercises requiring coherent kill-chain execution

The module evaluates attack surface, selects optimal sub-skill sequences, manages constraints and fallback paths, and updates case timelines, work-items, and evidence logs after each phase.

pentest-tools: Single-Stage Tactical Utilities

Individual pentest-tools are focused, single-stage utilities that perform discrete technical actions without cross-stage planning. The attack-chain/SKILL.md explicitly lists these as tasks that bypass the orchestrator entirely (lines 41-45).

Examples include:

• Port scanning with nmap
• SQL injection testing with sqlmap
• APK reverse-engineering
• Firmware extraction and analysis

These tools operate as leaf nodes in the decision tree—receiving well-defined inputs, executing concrete actions, and returning results directly without further delegation.

Routing Logic: When Each Component Handles the Request

The routing determination occurs at the entry point of the reverse-skill system. Per the source documentation in skills/attack-chain/SKILL.md:

Request Type	Routed To	Example
Multi-stage engagement with sequential phases	attack-chain orchestrator	"Perform full penetration test from recon to domain admin"
Single technical action without dependencies	Individual pentest-tool	"Run port scan on 10.0.0.1"

The orchestrator's decision logic (simplified from lines 73-85):

# Multi-stage: routed through attack-chain orchestrator

request:
  description: "Full penetration test on target.example.com"
  stages: ["recon", "initial_access", "privilege_escalation", "lateral_movement"]

# Single-stage: bypasses attack-chain, direct tool execution

request:
  description: "Identify open ports on 10.0.0.1"
  tool: "nmap"
  args: "-Pn -p-"

Scope of Responsibilities

attack-chain Responsibilities

• Attack surface determination: Maps target environment and identifies viable entry points
• Sequence optimization: Orders phases to maximize efficiency and minimize detection
• Sub-skill delegation: Hands off each phase to appropriate tools (including pentest-tools, apk-reverse, cloud-k8s)
• State management: Maintains case context across phases
• Evidence chain generation: Triggers final report creation via docs-generator

pentest-tools Responsibilities

• Concrete execution: Runs specific technical procedures (e.g., nmap, sqlmap, custom scripts)
• Immediate output production: Returns scan results, extracted artifacts, or shell access
• No cross-stage awareness: Operates independently without knowledge of broader engagement context

Evidence and Output Models

The attack-chain module generates a complete evidence chain that feeds into automated reporting. Individual pentest-tools produce technical outputs that become evidence artifacts only when integrated by the orchestrator.

# Simplified orchestration pattern from attack-chain/SKILL.md

if ($request.stages.Count -gt 1) {
    # Multi-stage: plan and coordinate

    $phase1 = Invoke-Tool -Path "../firmware-pentest/scripts/extract.sh" -Args $firmware
    $phase2 = Invoke-Tool -Path "../apk-reverse/tools/jadx" -Args $extracted_apk
    # ...continue with dependency-aware sequencing

    Update-EvidenceChain -PhaseResults @($phase1, $phase2)
}

# Direct single-stage invocation (bypasses orchestrator)

nmap -Pn -p- 10.0.0.1 -oN scan.txt

Physical File Structure

Despite the conceptual importance of pentest-tools, no dedicated folder exists with that name. Instead, individual tools are distributed across specialized skill directories:

Path	Content
skills/attack-chain/SKILL.md	Core orchestrator definition and routing rules
skills/attack-chain/references/lifecycle-checklist.md	Stage-gate validation checklist
skills/INDEX.md	High-level skill matrix linking orchestrator to sub-skills
skills/firmware-pentest/scripts/	Firmware extraction and analysis tools
skills/apk-reverse/tools/	Android reverse-engineering utilities
skills/cloud-k8s/	Container and Kubernetes assessment tools

This distributed organization reflects the design principle: tools are grouped by target domain, not by "single-stage vs multi-stage" classification.

Practical Workflow Examples

Scenario A: Full Red-Team Engagement

# Request enters through attack-chain

engagement:
  type: "full_redteam"
  target: "corporate-network.example.com"
  objectives: ["domain_admin", "sensitive_data_exfil"]

# attack-chain/SKILL.md executes:

# 1. Recon phase → delegates to external-recon tools

# 2. Initial access → selects viable entry vector

# 3. Privilege escalation → chains appropriate techniques

# 4. Lateral movement → coordinates across subnets

# 5. Impact → executes exfiltration with evidence logging

# 6. Final report → triggers docs-generator with complete chain

Scenario B: Isolated APK Analysis

# Request routed directly to tool, bypassing attack-chain

java -jar skills/apk-reverse/tools/jadx/bin/jadx \
  -d output_dir/ \
  target_application.apk

# Result returned immediately without orchestration overhead

Summary

• attack-chain is the multi-stage orchestrator for complex engagements, implementing decision-tree routing and cross-phase coordination
• pentest-tools are single-stage utilities for isolated tasks, explicitly bypassing the orchestrator per skills/attack-chain/SKILL.md lines 41-45
• Routing determination depends on request complexity: multi-phase requests flow through attack-chain, single actions go direct
• Physical implementation distributes tools across domain-specific directories (firmware-pentest, apk-reverse, cloud-k8s) rather than a central pentest-tools folder
• Evidence handling differs: attack-chain builds integrated chains, individual tools produce raw technical output

Frequently Asked Questions

When should I route a request through attack-chain versus a direct tool invocation?

Route through attack-chain when the request involves multiple sequential phases, requires strategic planning across the kill-chain, or needs coherent evidence integration. Use direct tool invocation for isolated, single-action tasks with no dependencies—explicitly listed in skills/attack-chain/SKILL.md lines 41-45 as cases that bypass the orchestrator.

Why is there no pentest-tools directory in the repository?

The reverse-skill architecture organizes tools by target domain rather than execution mode. Individual utilities reside in specialized directories like skills/firmware-pentest/ and skills/apk-reverse/tools/. The term pentest-tools describes a functional category in the routing logic, not a physical filesystem location.

How does attack-chain maintain state across multiple pentest-tool invocations?

The orchestrator maintains case context through a timeline and work-item system defined in skills/attack-chain/references/lifecycle-checklist.md. After delegating to each sub-skill (including individual tools), it retrieves results, updates evidence logs, and determines subsequent phases based on accumulated findings.

Can a single tool be called both directly and through attack-chain?

Yes. The same underlying utility (e.g., a port scanner in skills/firmware-pentest/scripts/) can execute:

• Directly when a user requests "scan ports on X"
• Via attack-chain when that scan is one phase of a larger engagement, with output feeding into phase-transition logic and evidence chains

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}