Difference Between attack-chain and pentest-tools Skills in reverse-skill

The attack-chain skill orchestrates multi-stage penetration testing workflows from initial access to post-exploitation, while pentest-tools provides the concrete command-line utilities—such as Nmap, Nuclei, and SQLMap—that execute individual reconnaissance and exploitation tasks.

The reverse-skill repository defines specialized capabilities through modular skill definitions. Understanding the difference between attack-chain and pentest-tools skills is essential for operators designing red-team workflows, as one handles strategic orchestration while the other handles tactical execution.

What is the attack-chain Skill?

The attack-chain skill functions as the strategic orchestrator within the framework. Defined in skills/attack-chain/SKILL.md, this skill manages the complete lifecycle of a penetration test by defining phases from boundary breach through lateral movement to persistence and post-exploitation.

Rather than executing tools directly, attack-chain maintains a high-level plan that selects downstream skills based on the current operational phase. It tracks progress across the kill-chain and determines when to invoke specialized capabilities like pentest-tools, windows-ad, or firmware-pentest according to the routing matrix defined in skills/routing.md.

What is the pentest-tools Skill?

The pentest-tools skill serves as the tactical execution layer, providing concrete implementations for active scanning and exploitation. According to skills/pentest-tools/SKILL.md, this skill wraps popular security tools including Nmap for port scanning, Nuclei for vulnerability detection, SQLMap for injection testing, and Hashcat for password cracking.

When invoked, pentest-tools runs specific command-line operations via MCP (Model Context Protocol) backends, generating evidence files such as scan logs and vulnerability reports. These outputs feed back into the broader workflow, supplying the raw intelligence that attack-chain uses to make progression decisions.

Key Differences Between attack-chain and pentest-tools

While both skills operate within the red-team domain, they differ fundamentally in scope and function:

• Strategic vs. Tactical: attack-chain handles mission-wide choreography and phase planning, whereas pentest-tools executes individual technical commands.
• Abstraction Level: The attack-chain skill operates at the kill-chain abstraction (e.g., "move from reconnaissance to exploitation"), while pentest-tools operates at the command-line abstraction (e.g., "run nmap -sV on target subnet").
• Output Type: attack-chain produces timelines and phase checklists; pentest-tools produces concrete evidence files and tool logs that populate those timelines.

How They Interact in the Routing Matrix

The relationship between these skills is hierarchical yet interdependent. As documented in skills/routing.md, attack-chain calls pentest-tools as a downstream dependency when the operational phase requires active scanning or exploitation.

Conversely, pentest-tools supplies the vulnerability data and foothold information that attack-chain consumes to validate phase completion and determine the next stage. This creates a feedback loop where the orchestrator directs the scanner, and the scanner's results inform the orchestrator's next move.

Practical Implementation Examples

The following examples demonstrate how to invoke these skills within the reverse-skill framework.

When planning a multi-stage operation using attack-chain:

# Example: Selecting a skill based on the current phase

phase: initial-access
if: "${phase}" == "initial-access"
  use: attack-chain   # plan the boundary-breach path

else if: "${phase}" == "recon"
  use: pentest-tools   # run Nmap & Subfinder

When executing specific tools via pentest-tools:

# Inside a pentest-tools run (MCP call)

mcp run nmap -sV -sC target.example.com   # information-gathering

mcp run nuclei -t /path/to/templates/     # vulnerability scan

In orchestration code, you might see this conditional logic from the routing implementation:

# In an attack-chain orchestration script (pseudo-code)

if vulnerable_services:
    plan = {
        "stage": "exploitation",
        "tool": "pentest-tools",
        "action": "sqlmap",
        "target": vulnerable_services[0]
    }
    execute(plan)

Summary

• attack-chain in skills/attack-chain/SKILL.md provides strategic orchestration across the kill-chain phases, calling downstream skills as needed.
• pentest-tools in skills/pentest-tools/SKILL.md offers tactical execution of security tools like Nmap, Nuclei, and SQLMap via MCP backends.
• The primary difference between attack-chain and pentest-tools skills lies in abstraction: orchestration versus execution.
• These skills interact through skills/routing.md, where attack-chain consumes output from pentest-tools to drive mission progression.
• Use attack-chain when planning full-attack timelines; use pentest-tools when running specific reconnaissance or exploitation commands.

Frequently Asked Questions

Can pentest-tools operate independently without attack-chain?

Yes. While pentest-tools is designed to integrate with the broader reverse-skill framework, it can function as a standalone capability for running specific security assessments. However, using it within an attack-chain workflow provides better context tracking and automated phase progression between kill-chain stages.

What specific tools are included in the pentest-tools skill?

According to skills/pentest-tools/SKILL.md, the skill includes integrations for Nmap (port scanning and service detection), Nuclei (vulnerability scanning), SQLMap (SQL injection testing), and Hashcat (password cracking), among others. Each tool connects through MCP backends to standardize invocation patterns across the framework.

How does attack-chain determine when to switch phases?

The attack-chain skill evaluates output from downstream skills like pentest-tools to determine phase completion. When pentest-tools reports successful exploitation or credential acquisition, attack-chain references skills/routing.md to transition the workflow to the appropriate next stage, such as lateral movement or persistence.

Where can I find the complete routing configuration for these skills?

The complete routing matrix defining how attack-chain and pentest-tools interact is located in skills/routing.md. This file maps skill dependencies and defines the decision trees that govern which skill executes based on current operational context and previous outputs.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}