Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/2233admin/reverse-skill-evolver/attack-chainnpx skills add 2233admin/reverse-skill-evolver --skill attack-chaingit clone --depth 1 https://github.com/2233admin/reverse-skill-evolverWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.05542 |
| Opus 5 | $0.00000 | $0.02771 |
| Sonnet 5 | $0.00000 | $0.01108 |
| Haiku 4.5 | $0.00000 | $0.00554 |
Grade F, and why
attack-chain scanned grade F with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
# sudo 滥用 Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
echo "ssh-rsa AAAA..." >> /root/.ssh/authorized_keys Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "$url" | grep -oP '(api[_-]?key|secret|token|password)\s*[:=]\s*["\047][^"\047]+' How it starts
The opening of the file, as written. The whole thing — 630 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Attack Chain Orchestration Skill
多阶段攻击路径规划与执行的总指挥。当任务需要"从 A 打到 B"的完整链路时，本 Skill 负责编排各阶段、协调子 Skill、规划攻击路径。 不是"红队专属"——任何需要跨阶段组合的渗透场景都从这里开始。
何时路由到本 Skill
以下场景必须先经过本 Skill 做全链路规划，再分发到具体子 Skill 执行：
| 场景 | 为什么需要编排 |
|---|---|
| "帮我做一次完整的渗透测试" | 需要规划从信息收集到报告的全流程 |
| "从外网打到域控" | 跨越边界突破→提权→横向→AD 多个阶段 |
| "HW 攻防演练" | 需要完整攻击链 + 隐蔽性 + 痕迹清理 |
| "评估这个目标的攻击面" | 需要多维度信息收集 + 路径规划 |
| "我拿到了一个 webshell，下一步怎么办" | 需要从当前据点规划后续路径 |
| "帮我规划攻击路径" | 明确需要路径编排 |
| "从这个漏洞能打到什么程度" | 需要评估漏洞的链式利用价值 |
| "Bug Bounty 持续监控" | 需要自动化多阶段流程 |
| "内网渗透全流程" | 横向移动 + 提权 + 域攻击组合 |
| "近源渗透方案" | 物理接入 + 内网渗透组合 |
| "供应链攻击路径" | 跨组织多跳攻击 |
| "钓鱼 + 后渗透" | 初始访问 + 后续利用组合 |
单阶段任务不需要经过本 Skill：
- 只做端口扫描 → 直接去
pentest-tools/ - 只做 SQL 注入 → 直接去
pentest-tools/ - 只做 APK 逆向 → 直接去
apk-reverse/ - 只做域渗透 → 直接去
pentest-tools/references/network-attack-defense.md
编排原则
本 Skill 的角色
用户提出多阶段任务
↓
attack-chain/SKILL.md（本文件）
↓ 规划攻击路径、确定阶段顺序
↓ 评估每阶段所需工具和方法
↓
分发到具体子 Skill 执行：
├── pentest-tools/ → 工具调用、漏洞利用
├── apk-reverse/ → 移动端渗透
├── js-reverse/ → Web 前端突破
├── reverse-engineering/ → 二进制分析
├── ida-reverse/ → 深度逆向
└── browser-automation/ → 自动化操作
↓
每阶段完成后回到本 Skill 评估下一步
↓
全部完成 → docs-generator 生成报告
路径规划决策树
拿到目标后：
1. 目标是什么？（Web/内网/云/移动/IoT）
2. 当前有什么？（外部视角/已有凭据/已有据点）
3. 最终目标是什么？（域控/数据/特定系统/证明影响）
4. 约束条件？（时间/隐蔽性/不可触碰的系统）
↓
根据以上信息规划最短路径
↓
一条路走不通 → 回到本 Skill 重新规划备选路径
完整攻击链阶段
一、信息收集阶段（Reconnaissance）
1.1 企业数字资产测绘
# 子公司关联域名发现
subfinder -d target.com -o subdomains.txt
amass enum -d target.com -passive -o amass_results.txt
# 合并去重
cat subdomains.txt amass_results.txt | sort -u > all_subs.txt
# 存活探测
httpx -l all_subs.txt -status-code -title -tech-detect -o alive.txt
# 端口扫描（全端口）
naabu -l all_subs.txt -top-ports 1000 -o ports.txt
nmap -sV -sC -iL targets.txt -oA nmap_results
实战要点：
- 通过企查查/天眼查获取子公司列表，扩大攻击面
- 关注测试环境（test.、dev.、staging.）和新上线系统
- 证书透明度日志（crt.sh）发现隐藏域名
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 630 lines · 0 tokens per session scan F a511a06fee05
attack-chain is a skill published in the GitHub repository 2233admin/reverse-skill-evolver (13 stars, last pushed 21d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 5,542 tokens. A static security scan graded it F with 4 findings (asks for root, reaches for credential files, cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…