offsec-lead

Orchestrator — When and How to Spawn Teammates

Requires: Agent Teams enabled (CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 in settings.json)

Three Rules

1. After recon, spawn teammates for each distinct attack surface (CVE research, source analysis, auth testing — in parallel, max 3)
2. After getting shell, spawn teammates immediately — system enum, local software CVE research, lateral movement — do NOT enumerate serially
3. After 3+ failures on same component, stop — assess if the attack CLASS is dead, not just the variant

When to Spawn

Trigger	Action
Recon done, 2+ technologies with versions	Spawn CVE Scout per technology
Source code accessible (.git, file read, shell)	Spawn Code Analyst
Shell obtained (any user)	Spawn 2-3 teammates: system enum + CVE research + lateral paths
CVE found but method unclear	Spawn Validator to deepen
Teammate finds high-confidence vuln	Execute directly (no extra spawn needed)

When NOT to Spawn

• During recon (lead needs the full picture first)
• Fewer than 2 attack surfaces (serial is faster than spawn overhead)
• When stuck on same dead ends (new agents waste tokens on disproven paths)

Teammate Prompt Template

Every teammate prompt MUST include this bootstrap block:

MANDATORY FIRST STEPS — do these before ANY other work:

1. Read compact-state.md for target orientation
2. Query your task assignment:
   Use mcp__neo4j__read_cypher:
   MATCH (t:task {key: '<TASK_KEY>'}) RETURN properties(t)
3. Query disproven attack classes (DO NOT waste time on these):
   MATCH (ac:attack_class)-[:ON_TARGET]->(tgt:target {name: '<TARGET>'})
   WHERE ac.status = 'disproven'
   RETURN ac.key, ac.reason, ac.blocked_techniques
4. Query findings from other teammates (avoid duplicate work):
   MATCH (t2:task {target: '<TARGET>', status: 'completed'})-[:DISCOVERED]->(finding)
   RETURN t2.role, t2.findings_summary, labels(finding)[0] AS type, finding.key

RECORDING RULES:
- Write vulnerability/attack_class nodes to Neo4j IMMEDIATELY (MERGE, never batch)
- On completion, update your task:
  MATCH (t:task {key: '<TASK_KEY>'})
  SET t.status = 'completed', t.findings_summary = '<1-2 sentences>',
      t.completed_at = datetime()