# Difference Between attack-chain and pentest-tools Skills in reverse-skill

> Understand the difference between attack chain and pentest tools skills. Attack chain orchestrates workflows, while pentest tools provide utilities for specific tasks in penetration testing.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-06

---

**The `attack-chain` skill orchestrates multi-stage penetration testing workflows from initial access to post-exploitation, while `pentest-tools` provides the concrete command-line utilities—such as Nmap, Nuclei, and SQLMap—that execute individual reconnaissance and exploitation tasks.**

The `reverse-skill` repository defines specialized capabilities through modular skill definitions. Understanding the difference between attack-chain and pentest-tools skills is essential for operators designing red-team workflows, as one handles strategic orchestration while the other handles tactical execution.

## What is the attack-chain Skill?

The `attack-chain` skill functions as the **strategic orchestrator** within the framework. Defined in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md), this skill manages the complete lifecycle of a penetration test by defining phases from boundary breach through lateral movement to persistence and post-exploitation.

Rather than executing tools directly, `attack-chain` maintains a high-level plan that selects downstream skills based on the current operational phase. It tracks progress across the kill-chain and determines when to invoke specialized capabilities like `pentest-tools`, `windows-ad`, or `firmware-pentest` according to the routing matrix defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md).

## What is the pentest-tools Skill?

The `pentest-tools` skill serves as the **tactical execution layer**, providing concrete implementations for active scanning and exploitation. According to [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md), this skill wraps popular security tools including **Nmap** for port scanning, **Nuclei** for vulnerability detection, **SQLMap** for injection testing, and **Hashcat** for password cracking.

When invoked, `pentest-tools` runs specific command-line operations via MCP (Model Context Protocol) backends, generating evidence files such as scan logs and vulnerability reports. These outputs feed back into the broader workflow, supplying the raw intelligence that `attack-chain` uses to make progression decisions.

## Key Differences Between attack-chain and pentest-tools

While both skills operate within the red-team domain, they differ fundamentally in scope and function:

- **Strategic vs. Tactical**: `attack-chain` handles mission-wide choreography and phase planning, whereas `pentest-tools` executes individual technical commands.
- **Abstraction Level**: The attack-chain skill operates at the kill-chain abstraction (e.g., "move from reconnaissance to exploitation"), while pentest-tools operates at the command-line abstraction (e.g., "run `nmap -sV` on target subnet").
- **Output Type**: `attack-chain` produces timelines and phase checklists; `pentest-tools` produces concrete evidence files and tool logs that populate those timelines.

## How They Interact in the Routing Matrix

The relationship between these skills is hierarchical yet interdependent. As documented in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), `attack-chain` calls `pentest-tools` as a downstream dependency when the operational phase requires active scanning or exploitation.

Conversely, `pentest-tools` supplies the vulnerability data and foothold information that `attack-chain` consumes to validate phase completion and determine the next stage. This creates a feedback loop where the orchestrator directs the scanner, and the scanner's results inform the orchestrator's next move.

## Practical Implementation Examples

The following examples demonstrate how to invoke these skills within the reverse-skill framework.

When planning a multi-stage operation using attack-chain:

```yaml

# Example: Selecting a skill based on the current phase

phase: initial-access
if: "${phase}" == "initial-access"
  use: attack-chain   # plan the boundary-breach path

else if: "${phase}" == "recon"
  use: pentest-tools   # run Nmap & Subfinder

```

When executing specific tools via pentest-tools:

```bash

# Inside a pentest-tools run (MCP call)

mcp run nmap -sV -sC target.example.com   # information-gathering

mcp run nuclei -t /path/to/templates/     # vulnerability scan

```

In orchestration code, you might see this conditional logic from the routing implementation:

```python

# In an attack-chain orchestration script (pseudo-code)

if vulnerable_services:
    plan = {
        "stage": "exploitation",
        "tool": "pentest-tools",
        "action": "sqlmap",
        "target": vulnerable_services[0]
    }
    execute(plan)

```

## Summary

- **`attack-chain`** in [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) provides strategic orchestration across the kill-chain phases, calling downstream skills as needed.
- **`pentest-tools`** in [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) offers tactical execution of security tools like Nmap, Nuclei, and SQLMap via MCP backends.
- The primary difference between attack-chain and pentest-tools skills lies in abstraction: orchestration versus execution.
- These skills interact through [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), where `attack-chain` consumes output from `pentest-tools` to drive mission progression.
- Use `attack-chain` when planning full-attack timelines; use `pentest-tools` when running specific reconnaissance or exploitation commands.

## Frequently Asked Questions

### Can pentest-tools operate independently without attack-chain?

Yes. While `pentest-tools` is designed to integrate with the broader reverse-skill framework, it can function as a standalone capability for running specific security assessments. However, using it within an `attack-chain` workflow provides better context tracking and automated phase progression between kill-chain stages.

### What specific tools are included in the pentest-tools skill?

According to [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md), the skill includes integrations for **Nmap** (port scanning and service detection), **Nuclei** (vulnerability scanning), **SQLMap** (SQL injection testing), and **Hashcat** (password cracking), among others. Each tool connects through MCP backends to standardize invocation patterns across the framework.

### How does attack-chain determine when to switch phases?

The `attack-chain` skill evaluates output from downstream skills like `pentest-tools` to determine phase completion. When `pentest-tools` reports successful exploitation or credential acquisition, `attack-chain` references [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) to transition the workflow to the appropriate next stage, such as lateral movement or persistence.

### Where can I find the complete routing configuration for these skills?

The complete routing matrix defining how `attack-chain` and `pentest-tools` interact is located in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md). This file maps skill dependencies and defines the decision trees that govern which skill executes based on current operational context and previous outputs.