How to Orchestrate Full Attack Chains with the Red Team Module in reverse-skill

The red team module in reverse-skill uses the attack-chain skill to coordinate multi-stage penetration tests by routing authorized requests through a structured kill-chain that validates tools, tracks evidence, and generates final reports.

The reverse-skill repository provides a structured framework for authorized penetration testing and red-team exercises. When you need to orchestrate full attack chains with the red team module, the system leverages the centralized attack-chain skill to manage everything from initial reconnaissance to final reporting, ensuring that multi-stage operations remain organized and auditable.

Architecture of the Red Team Module

The red team module is embodied by the attack-chain skill located in skills/attack-chain/SKILL.md. This component acts as the central coordinator for any multi-stage penetration test, red-team exercise, or "hack-with-purpose" (HW) scenario, deliberately remaining agnostic to specific techniques while enforcing strict operational workflow.

Mission Brief Validation

Before execution begins, the orchestrator collects the mission brief by reading the user request and validating authorization. According to skills/attack-chain/SKILL.md, the system enforces an ACTION REQUIRED checklist that must be completed before the chain initiates, ensuring all activities are properly scoped and authorized.

Kill-Chain Planning

The module builds a decision tree that maps the target type, current foothold, final objective, and operational constraints—such as privacy, stealth, and time—into a standardized sequence of phases: Recon → Initial Access → Privilege Escalation → Lateral Movement → Impact.

How to Orchestrate Full Attack Chains

The orchestration logic ensures that any request spanning more than one phase must pass through this module, while single-stage tasks bypass it entirely.

Phase Routing to Specialist Skills

For each phase, the orchestrator routes work to appropriate specialist skills via the routing matrix defined in skills/routing.md. The system delegates to:

• pentest-tools for network scanning and enumeration phases
• windows-ad for Active Directory exploitation (as defined in skills/windows-ad/SKILL.md)
• apk-reverse for mobile payload development and analysis

Tool Validation and Bootstrapping

Before executing any phase, the system validates tool availability by loading tool-index.md. If a required tool is missing, the orchestrator triggers kali/scripts/bootstrap-reverse.sh to auto-install missing penetration testing tools rather than failing with path errors.

Evidence Tracking and Timeline Generation

Every command, result, and finding is recorded in timeline.md and workitems.md within the case directory. When a phase completes, evidence is promoted to a Finding that feeds back into the next planning step, creating a complete audit trail.

Step-by-Step Implementation

To orchestrate a full attack chain from the red-team console:

# 1️⃣ Initialise a new case and set the scope (must be authorized)

../scripts/case-init.ps1   # creates <case>/scope.md

# 2️⃣ Invoke the attack‑chain orchestrator with the high‑level goal

../skills/attack-chain/run.sh "From external network to domain controller"

# 3️⃣ The orchestrator asks you to confirm tool availability

#    (it will automatically pull missing tools via the bootstrap script)

../tools/bootstrap-reverse.sh   # runs only if a tool is missing

# 4️⃣ After each phase, inspect the generated timeline

cat work/<case>/timeline.md

# 5️⃣ When the chain is complete, generate the final report

../docs-generator/generate.sh <case>

Note that the actual run.sh script simply reads the ACTION REQUIRED section and follows the checklist—you do not need to edit any code to start a new attack chain.

Key Files in the Red Team Module

• skills/attack-chain/SKILL.md – Core orchestration definition, phases, and authorization checklist
• skills/routing.md – Routing matrix that forwards multi-stage requests to attack-chain
• skills/windows-ad/SKILL.md – Example specialist skill for AD attacks callable from the chain
• kali/scripts/bootstrap-reverse.sh – Auto-installs missing pentest tools when required
• docs-generator/generate.sh – Produces the final evidence-rich report after chain completion

Summary

• The attack-chain skill in skills/attack-chain/SKILL.md serves as the central orchestrator for multi-stage red-team operations.
• Single-stage tasks bypass the orchestrator and route directly to specialist skills, while multi-stage requests must pass through the full chain.
• The system enforces authorization via the ACTION REQUIRED checklist before executing any attack chain.
• Tool validation occurs through tool-index.md, with automatic bootstrapping via kali/scripts/bootstrap-reverse.sh for missing dependencies.
• Evidence collection happens continuously in timeline.md and workitems.md, feeding into the final report generated by docs-generator/generate.sh.

Frequently Asked Questions

What authorization is required before running an attack chain?

According to skills/attack-chain/SKILL.md, you must complete the ACTION REQUIRED checklist to validate that the activity is authorized before the orchestrator initializes the kill-chain. This ensures all penetration testing activities have proper scope and approval.

How does the orchestrator handle missing penetration testing tools?

The system validates tool availability by loading tool-index.md. If a required tool is missing, the orchestrator triggers kali/scripts/bootstrap-reverse.sh to auto-install the dependency rather than attempting to execute with missing binaries or incorrect paths.

Can I run single-stage attacks without the full attack-chain orchestrator?

Yes. Single-stage tasks—such as running a port scan—bypass the attack-chain orchestrator and route directly to the relevant specialist skill (e.g., pentest-tools). The red team module only activates when a request spans multiple phases.

Where is the evidence stored during and after an attack chain?

During execution, evidence is recorded in work/<case>/timeline.md and workitems.md within the case directory. When the chain completes, the docs-generator/generate.sh script produces a structured final report containing the complete evidence chain from all phases.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}