How to Customize the Attack‑Chain Workflow in reverse‑skill for Specific Red Team Scenarios

Customize the attack‑chain workflow by creating scenario‑specific playbooks, adjusting role mappings, and extending timeline work‑items with phase‑gate enforcement.

The attack‑chain skill in zhaoxuya520/reverse‑skill serves as the central orchestrator for multi‑stage red‑team engagements. Sitting between the routing matrix and specialist sub‑skills, it drives the full kill‑chain from reconnaissance to evidence cleanup. This guide explains how to customize the attack‑chain workflow for specific red team scenarios using the framework's modular architecture.

Core Components of the Attack‑Chain Architecture

The attack‑chain workflow is composed of several interconnected components that define how an engagement progresses from initial objective to final report.

Component	Purpose	Source Location
Attack‑Chain SKILL	Defines end‑to‑end workflow, phase gates, and role‑based hand‑off	skills/attack-chain/SKILL.md
Routing Matrix	Maps user intents to the attack‑chain skill	skills/routing.md
Lifecycle Checklist	Enforces per‑phase approvals, evidence collection, and scope validation	skills/attack-chain/references/lifecycle-checklist.md
Playbooks	Ready‑made step‑by‑step paths for common scenarios	skills/attack-chain/references/attack-playbooks.md
Ops – Role Map	Declares lead and specialist roles for hand‑offs	skills/ops/role-map.md
Timeline / Workitems	Persistent log of phase deliverables; used by self‑check loop	skills/ops/timeline-workitem.md
Tool‑Index	Concrete paths for external binaries; bootstrap auto‑installs missing tools	skills/tool-index.md
Docs‑Generator	Produces final report from accumulated evidence chain	skills/docs-generator/SKILL.md
Field‑Journal	Stores anonymized post‑mortem notes for knowledge‑base evolution	skills/field-journal/precedent-pentest.md

The workflow follows a decision‑tree structure defined in skills/attack-chain/SKILL.md under the "路径规划决策树" section. This tree evaluates four critical questions before selecting a playbook:

1. Target type — Web, internal, cloud, mobile, or IoT
2. Existing foothold — None, external shell, internal host, or domain credentials
3. Ultimate objective — Domain controller, data exfiltration, or impact
4. Operational constraints — Stealth requirements, time windows, or forbidden systems

Based on these answers, the attack‑chain instantiates a playbook and iterates through built‑in phases: Recon → Initial Access → Privilege Escalation → Lateral Movement → Persistence → Evasion → Cleanup.

Step‑by‑Step Customization for a Specific Scenario

Consider a "Phishing → Internal Network" scenario that emphasizes low‑noise credential harvesting before any lateral movement. The following steps customize the attack‑chain workflow for this requirement.

Step 1: Create a Custom Playbook

Fork an existing playbook in skills/attack-chain/references/attack-playbooks.md or create a new section.

# skills/attack-chain/references/attack-playbooks.md (excerpt)

## Playbook 2-Stealth: Phishing → Internal Network (Credential Harvesting)

**Target:** Internal network via phishing foothold  
**Constraint:** High stealth, no noisy lateral movement until credential validation

### Decision Matrix (lines 115-127)

| Condition | Action |
|-----------|--------|
| Phishing successful, shell obtained | **仅收集凭据 → 立即清理日志** |
| Credentials harvested | Validate via passive LDAP bind only |
| No validated credentials | Terminate, no lateral movement |

### Phase Overrides

- Skip automated lateral scanning
- Mandate memory‑only credential extraction
- Require explicit lead authorization for any network pivot

Step 2: Configure Role Mapping for Specialist Hand‑Off

Edit skills/ops/role-map.md to define a specialized lead role with appropriate specialist assignments.

# skills/ops/role-map.md (excerpt)

lead:
  name: stealth-lead
  specialist_roles:
    - email-security          # Phishing infrastructure

    - edr-bypass-re           # Endpoint evasion

    - pentest-tools           # Standard tooling

    - diagram-generator       # Visualization

This ensures hand‑offs route to the correct toolset throughout the engagement.

Step 3: Extend Timeline with Stealth‑Tagged Work‑Items

Override the default timeline template in skills/ops/timeline-workitem.md to enforce stealth constraints.

# skills/ops/timeline-workitem.md (excerpt)

- phase: Initial Access
  id: TA-01
  title: Phishing Email Delivery
  tags: [stealth, email]
  status: pending

- phase: Credential Harvest
  id: CH-01
  title: Mimikatz Hash Dump (memory‑only)
  tags: [stealth, memory, high-value]
  status: pending
  constraints: 
    - no_disk_write: true
    - max_execution_time: 30s

- phase: Privilege Escalation
  id: PE-01
  title: Deferred — Awaiting Stealth Review
  tags: [stealth, gated]
  status: blocked

The self‑check loop parses these tags and warns if subsequent phases violate stealth constraints.

Step 4: Update Tool Dependencies

Add any scenario‑specific tools to skills/tool-index.md. The bootstrap system automatically fetches missing tools.

# skills/tool-index.md (excerpt)

tools:
  gophish:
    path: /opt/tools/gophish/gophish
    source: github-release
    repo: gophish/gophish
    bootstrap: auto
    
  safetykatz:
    path: /opt/tools/safetykatz/SafetyKatz.exe
    source: git-clone
    repo: GhostPack/SafetyKatz
    tags: [stealth, memory]
    bootstrap: auto

If tool-index check safetykatz returns NOT FOUND, the bootstrap triggers automatically:

# Triggered by attack-chain bootstrap

bootstrap-reverse.ps1 -Tool safetykatz -Source github-release

Step 5: Add Phase‑Gate Enforcement (Optional)

Extend the lifecycle checklist to require explicit review before sensitive transitions.

# skills/attack-chain/references/lifecycle-checklist.md (excerpt)

| 阶段 | 角色 | 本包 skill | 完成标准 |
|------|------|------------|----------|
| 2 Initial Access | stealth-lead | attack-chain | Shell obtained, beacon stable 24h |
| 2.5 Stealth Gate | stealth-lead | attack-chain | **Stealth Review** ✅ — no noisy payloads, logs cleared, memory‑only confirmed |
| 3 Privilege Escalation | stealth-lead | attack-chain | Validated credentials OR explicit waiver |

The attack‑chain blocks progression until the lead marks the gate as passed.

Implementing the Custom Workflow: Code Examples

Initialize a Case with Custom Playbook

# scripts/case-init.ps1 — create stealth phishing engagement

$case = "phish-stealth-2026-08"
New-Item -Path "work/$case" -ItemType Directory -Force

@"
name: $case
description: Phishing → Internal Network (stealth)
playbook: attack-chain/references/attack-playbooks.md#playbook-2-stealth
lead: stealth-lead
constraints:
  - stealth: high
  - lateral_movement: deferred
  - max_noise_level: minimal
"@ | Set-Content "work/$case/scope.md"

Write-Host "Case initialized: $case"
Write-Host "Next: Run 'reverse-skill attack-chain --case $case --start'"

Execute Phase with Automatic Tool Bootstrap

# From AI console or automation script

$ reverse-skill attack-chain --case phish-stealth-2026-08 --phase credential-harvest

[INFO] Loading playbook: attack-playbooks.md#playbook-2-stealth
[INFO] Phase: Credential Harvest (CH-01)
[WARN] Tool 'safetykatz' not found in tool-index
[INFO] Triggering bootstrap for safetykatz...
[OK]   safetykatz downloaded and verified
[INFO] Executing: SafetyKatz.exe --memonly
[INFO] Evidence captured to field-journal/phish-stealth-2026-08/
[INFO] Work-item CH-01 marked complete
[BLOCK] Phase 3 (Privilege Escalation) gated — awaiting Stealth Review

Generate Final Stealth‑Focused Report

$ reverse-skill docs-generator --case phish-stealth-2026-08 --template stealth-reduced

[INFO] Compiling evidence chain from field-journal/
[INFO] Applying stealth template: IOCs minimized, timeline compressed
[OK]   Report generated: reports/phish-stealth-2026-08-stealth-summary.pdf

Key Files for Attack‑Chain Customization

File	Purpose	Direct Link
skills/attack-chain/SKILL.md	Master orchestrator and phase definitions	View
skills/attack-chain/references/attack-playbooks.md	Playbook library and decision matrices	View
skills/attack-chain/references/lifecycle-checklist.md	Phase gates and approval requirements	View
skills/ops/role-map.md	Lead and specialist role definitions	View
skills/ops/timeline-workitem.md	Per‑phase work‑item tracking with tags	View
skills/tool-index.md	External tool paths and bootstrap triggers	View

Summary

• The attack‑chain skill in skills/attack-chain/SKILL.md orchestrates multi‑stage engagements through a decision‑tree that selects playbooks based on target, foothold, objective, and constraints.
• Custom playbooks live in skills/attack-chain/references/attack-playbooks.md and override default phase behavior, tool selection, and routing decisions.
• Role mapping via skills/ops/role-map.md ensures specialist hand‑offs target the correct sub‑skills for your scenario.
• Timeline work‑items with constraint tags in skills/ops/timeline-workitem.md enable the self‑check loop to enforce operational requirements like stealth or time windows.
• Lifecycle checklist modifications in skills/attack-chain/references/lifecycle-checklist.md add mandatory gates between sensitive phases.
• Tool‑index entries trigger automatic bootstrap for missing dependencies, maintaining reproducibility across environments.

Frequently Asked Questions

What is the minimum set of files to modify when customizing the attack‑chain workflow?

Modify three files minimum: skills/attack-chain/references/attack-playbooks.md for your scenario logic, skills/ops/role-map.md for specialist routing, and skills/ops/timeline-workitem.md for tracking. The lifecycle checklist and tool‑index are optional unless you need phase gates or new tools.

How does the attack‑chain enforce stealth constraints during execution?

The self‑check loop evaluates tags on timeline work‑items. If a phase is tagged [stealth] and a subsequent operation would violate that constraint (e.g., disk write, noisy network scan), the loop blocks progression and alerts the lead role. Explicit waiver or checklist approval is required to proceed.

Can multiple custom playbooks coexist in the same reverse‑skill installation?

Yes. The routing matrix in skills/routing.md maps user intents to specific playbook anchors (e.g., attack-playbooks.md#playbook-2-stealth). Multiple playbooks can reference the same specialist roles or maintain isolated tool chains as needed.

What happens if a required tool is missing when the attack‑chain starts a phase?

The attack‑chain invokes tool-index check <tool>. If the tool is NOT FOUND, it automatically triggers bootstrap-reverse.ps1 with the source defined in skills/tool-index.md. Once downloaded and verified, execution resumes without manual intervention.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}