# How to Customize the Attack‑Chain Workflow in reverse‑skill for Specific Red Team Scenarios

> Customize the reverse-skill attack-chain workflow for red team scenarios. Create playbooks, adjust roles, and extend work-items with phase-gate enforcement for tailored operations.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-05

---

**Customize the attack‑chain workflow by creating scenario‑specific playbooks, adjusting role mappings, and extending timeline work‑items with phase‑gate enforcement.**

The **attack‑chain** skill in [zhaoxuya520/reverse‑skill](https://github.com/zhaoxuya520/reverse-skill) serves as the central orchestrator for multi‑stage red‑team engagements. Sitting between the routing matrix and specialist sub‑skills, it drives the full kill‑chain from reconnaissance to evidence cleanup. This guide explains how to customize the attack‑chain workflow for specific red team scenarios using the framework's modular architecture.

## Core Components of the Attack‑Chain Architecture

The attack‑chain workflow is composed of several interconnected components that define how an engagement progresses from initial objective to final report.

| Component | Purpose | Source Location |
|-----------|---------|---------------|
| **Attack‑Chain SKILL** | Defines end‑to‑end workflow, phase gates, and role‑based hand‑off | [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) |
| **Routing Matrix** | Maps user intents to the attack‑chain skill | [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) |
| **Lifecycle Checklist** | Enforces per‑phase approvals, evidence collection, and scope validation | [`skills/attack-chain/references/lifecycle-checklist.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/lifecycle-checklist.md) |
| **Playbooks** | Ready‑made step‑by‑step paths for common scenarios | [`skills/attack-chain/references/attack-playbooks.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/attack-playbooks.md) |
| **Ops – Role Map** | Declares lead and specialist roles for hand‑offs | [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) |
| **Timeline / Workitems** | Persistent log of phase deliverables; used by self‑check loop | [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) |
| **Tool‑Index** | Concrete paths for external binaries; bootstrap auto‑installs missing tools | [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) |
| **Docs‑Generator** | Produces final report from accumulated evidence chain | [`skills/docs-generator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/SKILL.md) |
| **Field‑Journal** | Stores anonymized post‑mortem notes for knowledge‑base evolution | [`skills/field-journal/precedent-pentest.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-pentest.md) |

The workflow follows a **decision‑tree** structure defined in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) under the "路径规划决策树" section. This tree evaluates four critical questions before selecting a playbook:

1. **Target type** — Web, internal, cloud, mobile, or IoT
2. **Existing foothold** — None, external shell, internal host, or domain credentials
3. **Ultimate objective** — Domain controller, data exfiltration, or impact
4. **Operational constraints** — Stealth requirements, time windows, or forbidden systems

Based on these answers, the attack‑chain instantiates a playbook and iterates through built‑in phases: **Recon → Initial Access → Privilege Escalation → Lateral Movement → Persistence → Evasion → Cleanup**.

## Step‑by‑Step Customization for a Specific Scenario

Consider a **"Phishing → Internal Network"** scenario that emphasizes **low‑noise credential harvesting** before any lateral movement. The following steps customize the attack‑chain workflow for this requirement.

### Step 1: Create a Custom Playbook

Fork an existing playbook in [`skills/attack-chain/references/attack-playbooks.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/attack-playbooks.md) or create a new section.

```markdown

# skills/attack-chain/references/attack-playbooks.md (excerpt)

## Playbook 2-Stealth: Phishing → Internal Network (Credential Harvesting)

**Target:** Internal network via phishing foothold  
**Constraint:** High stealth, no noisy lateral movement until credential validation

### Decision Matrix (lines 115-127)

| Condition | Action |
|-----------|--------|
| Phishing successful, shell obtained | **仅收集凭据 → 立即清理日志** |
| Credentials harvested | Validate via passive LDAP bind only |
| No validated credentials | Terminate, no lateral movement |

### Phase Overrides

- Skip automated lateral scanning
- Mandate memory‑only credential extraction
- Require explicit lead authorization for any network pivot

```

### Step 2: Configure Role Mapping for Specialist Hand‑Off

Edit [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) to define a specialized lead role with appropriate specialist assignments.

```yaml

# skills/ops/role-map.md (excerpt)

lead:
  name: stealth-lead
  specialist_roles:
    - email-security          # Phishing infrastructure

    - edr-bypass-re           # Endpoint evasion

    - pentest-tools           # Standard tooling

    - diagram-generator       # Visualization

```

This ensures hand‑offs route to the correct toolset throughout the engagement.

### Step 3: Extend Timeline with Stealth‑Tagged Work‑Items

Override the default timeline template in [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) to enforce stealth constraints.

```yaml

# skills/ops/timeline-workitem.md (excerpt)

- phase: Initial Access
  id: TA-01
  title: Phishing Email Delivery
  tags: [stealth, email]
  status: pending

- phase: Credential Harvest
  id: CH-01
  title: Mimikatz Hash Dump (memory‑only)
  tags: [stealth, memory, high-value]
  status: pending
  constraints: 
    - no_disk_write: true
    - max_execution_time: 30s

- phase: Privilege Escalation
  id: PE-01
  title: Deferred — Awaiting Stealth Review
  tags: [stealth, gated]
  status: blocked

```

The self‑check loop parses these tags and warns if subsequent phases violate stealth constraints.

### Step 4: Update Tool Dependencies

Add any scenario‑specific tools to [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). The bootstrap system automatically fetches missing tools.

```yaml

# skills/tool-index.md (excerpt)

tools:
  gophish:
    path: /opt/tools/gophish/gophish
    source: github-release
    repo: gophish/gophish
    bootstrap: auto
    
  safetykatz:
    path: /opt/tools/safetykatz/SafetyKatz.exe
    source: git-clone
    repo: GhostPack/SafetyKatz
    tags: [stealth, memory]
    bootstrap: auto

```

If `tool-index check safetykatz` returns **NOT FOUND**, the bootstrap triggers automatically:

```powershell

# Triggered by attack-chain bootstrap

bootstrap-reverse.ps1 -Tool safetykatz -Source github-release

```

### Step 5: Add Phase‑Gate Enforcement (Optional)

Extend the lifecycle checklist to require explicit review before sensitive transitions.

```markdown

# skills/attack-chain/references/lifecycle-checklist.md (excerpt)

| 阶段 | 角色 | 本包 skill | 完成标准 |
|------|------|------------|----------|
| 2 Initial Access | stealth-lead | attack-chain | Shell obtained, beacon stable 24h |
| 2.5 Stealth Gate | stealth-lead | attack-chain | **Stealth Review** ✅ — no noisy payloads, logs cleared, memory‑only confirmed |
| 3 Privilege Escalation | stealth-lead | attack-chain | Validated credentials OR explicit waiver |

```

The attack‑chain blocks progression until the lead marks the gate as passed.

## Implementing the Custom Workflow: Code Examples

### Initialize a Case with Custom Playbook

```powershell

# scripts/case-init.ps1 — create stealth phishing engagement

$case = "phish-stealth-2026-08"
New-Item -Path "work/$case" -ItemType Directory -Force

@"
name: $case
description: Phishing → Internal Network (stealth)
playbook: attack-chain/references/attack-playbooks.md#playbook-2-stealth
lead: stealth-lead
constraints:
  - stealth: high
  - lateral_movement: deferred
  - max_noise_level: minimal
"@ | Set-Content "work/$case/scope.md"

Write-Host "Case initialized: $case"
Write-Host "Next: Run 'reverse-skill attack-chain --case $case --start'"

```

### Execute Phase with Automatic Tool Bootstrap

```bash

# From AI console or automation script

$ reverse-skill attack-chain --case phish-stealth-2026-08 --phase credential-harvest

[INFO] Loading playbook: attack-playbooks.md#playbook-2-stealth
[INFO] Phase: Credential Harvest (CH-01)
[WARN] Tool 'safetykatz' not found in tool-index
[INFO] Triggering bootstrap for safetykatz...
[OK]   safetykatz downloaded and verified
[INFO] Executing: SafetyKatz.exe --memonly
[INFO] Evidence captured to field-journal/phish-stealth-2026-08/
[INFO] Work-item CH-01 marked complete
[BLOCK] Phase 3 (Privilege Escalation) gated — awaiting Stealth Review

```

### Generate Final Stealth‑Focused Report

```bash
$ reverse-skill docs-generator --case phish-stealth-2026-08 --template stealth-reduced

[INFO] Compiling evidence chain from field-journal/
[INFO] Applying stealth template: IOCs minimized, timeline compressed
[OK]   Report generated: reports/phish-stealth-2026-08-stealth-summary.pdf

```

## Key Files for Attack‑Chain Customization

| File | Purpose | Direct Link |
|------|---------|-------------|
| [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) | Master orchestrator and phase definitions | [View](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) |
| [`skills/attack-chain/references/attack-playbooks.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/attack-playbooks.md) | Playbook library and decision matrices | [View](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/attack-playbooks.md) |
| [`skills/attack-chain/references/lifecycle-checklist.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/lifecycle-checklist.md) | Phase gates and approval requirements | [View](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/lifecycle-checklist.md) |
| [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) | Lead and specialist role definitions | [View](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) |
| [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) | Per‑phase work‑item tracking with tags | [View](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) |
| [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) | External tool paths and bootstrap triggers | [View](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) |

## Summary

- The **attack‑chain skill** in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) orchestrates multi‑stage engagements through a decision‑tree that selects playbooks based on target, foothold, objective, and constraints.
- **Custom playbooks** live in [`skills/attack-chain/references/attack-playbooks.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/attack-playbooks.md) and override default phase behavior, tool selection, and routing decisions.
- **Role mapping** via [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) ensures specialist hand‑offs target the correct sub‑skills for your scenario.
- **Timeline work‑items** with constraint tags in [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) enable the self‑check loop to enforce operational requirements like stealth or time windows.
- **Lifecycle checklist** modifications in [`skills/attack-chain/references/lifecycle-checklist.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/lifecycle-checklist.md) add mandatory gates between sensitive phases.
- **Tool‑index entries** trigger automatic bootstrap for missing dependencies, maintaining reproducibility across environments.

## Frequently Asked Questions

### What is the minimum set of files to modify when customizing the attack‑chain workflow?

Modify three files minimum: [`skills/attack-chain/references/attack-playbooks.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/references/attack-playbooks.md) for your scenario logic, [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) for specialist routing, and [`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md) for tracking. The lifecycle checklist and tool‑index are optional unless you need phase gates or new tools.

### How does the attack‑chain enforce stealth constraints during execution?

The self‑check loop evaluates **tags** on timeline work‑items. If a phase is tagged `[stealth]` and a subsequent operation would violate that constraint (e.g., disk write, noisy network scan), the loop blocks progression and alerts the lead role. Explicit waiver or checklist approval is required to proceed.

### Can multiple custom playbooks coexist in the same reverse‑skill installation?

Yes. The routing matrix in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) maps user intents to specific playbook anchors (e.g., `attack-playbooks.md#playbook-2-stealth`). Multiple playbooks can reference the same specialist roles or maintain isolated tool chains as needed.

### What happens if a required tool is missing when the attack‑chain starts a phase?

The attack‑chain invokes `tool-index check <tool>`. If the tool is **NOT FOUND**, it automatically triggers `bootstrap-reverse.ps1` with the source defined in [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). Once downloaded and verified, execution resumes without manual intervention.