Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SeaOf0/dsh-redteam-model --skill ad-playbookgit clone --depth 1 https://github.com/SeaOf0/dsh-redteam-modelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seaof0/dsh-redteam-model/ad-playbook)<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/ad-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/ad-playbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/ad-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/ad-playbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 12 findings, up to critical
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- critical YARA Match · line 191 YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).Fix: Remove the webshell code immediately. Webshells provide unauthorized remote command execution. Audit the skill for additional backdoors or persistence mechanisms.
- high YARA Match · line 4 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high YARA Match · line 241 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Server-Side Request Forgery · line 345 Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
- high Server-Side Request Forgery · line 450 Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
- high YARA Match · line 395 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- high Privilege Escalation · line 406 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 447 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 448 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Privilege Escalation · line 423 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 431 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
- medium Privilege Escalation · line 927 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00381 | $0.28288 |
| Opus 5 | $0.00191 | $0.14144 |
| Sonnet 5 | $0.00076 | $0.05658 |
| Haiku 4.5 | $0.00038 | $0.02829 |
Grade F, and why
ad-playbook scanned grade F with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **起手（SSH 落点线）**：拿到 ssh 权限：低权限→尝试提权（内核漏洞/sudo 配置/suid/ Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
① **云 CLI 配置文件**：~/.aws/credentials、~/.aliyun/config.json、~/.tencentcloud/、 Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
/ dsquery 可用性）+ 云特征（169.254.169.254 metadata 探测、~/.aws·~/.aliyun· Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| 外部探活/指纹/入口盘点 | curl/httpx（轻通道先行） | kali MCP（nmap_scan/whatweb_scan/wafw00f_scan）→ 脚本 | How it starts
The opening of the file, as written. The whole thing — 1,065 lines — stays where its author put it; the contents beside it link to each section on GitHub.
攻防评估作战手册
本技能随 attack-defense 预设走。 persona 中的硬规则（底线、证据标准、评分纪律、阶段纪律、负面清单、表达纪律（拒答修复由宿主插件 dsh-refusal-guard 兜底）、claude 逻辑）不在此重复。
定位与设计依据
- 2026 主线：Gartner 将 Agentic Red Teaming 列为攻防平台胜负手——本模式即本地 agentic red teaming 编排器。行业坐标与工具锚点见 refs/trends/ad-trends-2025-2026.md。
- 评估形态：AEV（Adversarial Exposure Validation）思路——持续验证暴露面 + 修复复测闭环，不是一次性报告。
- 遵循用户需求指令 + 提供扩展性思路和方向（persona 已写）。
权限与数据主线（主观念）
主观念锚点：评估围绕权限与数据主线自主扩展实施——服务器权限（最高权限/提权）、 Web 权限（webshell 上传）、数据库权限（SQLi 读写与提权）、严重敏感数据泄露、未授权访问、 登录绕过。每阶段向主线目标靠拢，面外发现照常纳入。
| 主线目标 | 作业形态与判定要点 |
|---|---|
| 服务器最高权限 | 提权链验证（suid/内核/服务缺陷/计划任务/组策略）→ whoami/id 级证据（最小影响）；提权只做可行性证明，不破坏服务 |
| Web 权限（webshell 上传） | 上传点→落地路径→可访问性→执行回显（whoami 级）；webshell 用最小无害探针，落地文件与路径登记 residue |
| 内存马 | 仅 Java 系中间件评估场景：注入可行性验证（不残留或登记制登记）；判定要点=过滤链差异/类加载点 |
| 数据库权限 | SQLi 读（库/表/用户哈希）→ 写文件/读文件可行性（OS 层交互只做 whoami 级回显）→ 数据库账号权限枚举 |
| 严重敏感数据泄露 | 数据外带证明最小化（行数/字段名/掩码样本）；完整数据集不外带不落地，只登记位置与类型 |
| 未授权 / 登录绕过 | 会话对照重放（带/不带凭证）、接口直调、前端校验绕过（后端是否独立校验） |
痕迹纪律（主观念红线）：攻击作业全程本地记录关键攻击痕迹（命令/时间戳/产物哈希进 evidence-index），作业结束后清理目标侧攻击痕迹（webshell/上传文件/计划任务/账户等）—— 清理清单与步骤写入 persistence-registry/residue，由用户确认后执行；先留证后清理，不裸删； 对目标固有数据的删除操作严禁执行，只提示可疑并呈报；横向场景的痕迹四类清理面与清痕 顺序纪律见内网章 §12。POC 交付：验证通过的发现直接生成 完整 python 复现脚本（exp/.py）——参数化目标、默认 whoami 级最小影响、 破坏性步骤默认关闭、退出码 0=复现成功——随报告交付客户手动复现。
阶段编排
- 侦察 → 2. 突破 → 3. 横向 → 4. 持久化 → 5. 报告；每阶段只基于上一阶段的已验证结果推进。
- 侦察/突破阶段主线见「外网打点作战流程」章（测绘找面→入口面提级序→登陆口专线→衔接横向）；人面入口并行线见「社工与钓鱼作战线」章（系统面与人面可并行，授权含社会工程面时必评估）。
- 各阶段用 workflow 扇出，子代理分工：侦察组 / 突破验证组 / 横向组 / 报告组。
- 关键发现经独立子代理交叉复核后才进报告。
- 每阶段产出物登记证据索引（哈希 + 时间戳）。
- 横向阶段以「单机落点信息收集」SOP 为前置（见下节）：每拿下一台主机先过收集 SOP，再谈横向路径。
- 横向阶段的主线战法见「内网攻防作战流程」章（单机 SOP 管"一台怎么挖"，作战流程管"整个内网怎么打"）。
- 持久化阶段定义（persona 硬规则）：可行性验证 = 真实落地→验证生效→立即登记
persistence-registry.md（技术类型 / 落点主机与位置 / 建立时间 / 生效验证证据 / 手动排除步骤——写到照做能拆的程度），不自动清理；报告必须附持久化清单， detection gap 汇总中每条持久化对应「目标侧是否检测到」。
阶段默认通道（装备栏：流程定默认，能力定降级；内网按监测姿态分叉）
元原则同 pentest：通道成本随流程递增、轻重分离；通道缺失按「工具使用策略·通道完整阶梯」 降级（已挂 → 自配 → 问装 → 脚本 → 诚实降级）；跨阶段复用查附录 C-2；内网动作先过 §0.5 姿态卡。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +34 lines 58b07d6e1803
- 7d ago Changed · +2 lines a17de48d53c5
- 11d ago First seen · 1,029 lines · 381 tokens per session scan F 9a1cbec18e0d
ad-playbook is a skill published in the GitHub repository SeaOf0/dsh-redteam-model (354 stars, last pushed yesterday), licensed MIT. It adds 381 tokens to every session and 28,288 once invoked, about $0.0019 per session on Opus 5. A static security scan graded it F with 4 findings (asks for root, reaches for credential files, cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ov-experience-memory
Retrieve and apply OpenViking Experience memories through the Agent runtime's generic OpenViking search and read tools. Use before or during executable, multi-step, or tool-based work such as coding, file or data changes, configuration, deployment, workflow execution, and failure recovery when prior operational…
novel-reviewer
A review and editing workflow for existing novel chapters. It checks story logic, timelines, character states, unresolved clues, world rules, and writing style.
workflow-manager
A writing workflow tracker for chapter-based projects. It records whether each chapter is being assembled, drafted, reviewed, confirmed, polished, or archived.
review-chapter
A six-part review of a manuscript chapter. It compares the chapter with the outline and reports quality, coverage, review status, and problems supported by evidence from the text.
workflow
A command set for starting and managing step-by-step automated workflows.
local-search
A local search component that finds web results using installed command-line tools and page parsers. It supports general web search and extra sources for areas such as Chinese pages, news, code questions, academic work, and reference material.