Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SeaOf0/dsh-redteam-model --skill pentest-playbookgit clone --depth 1 https://github.com/SeaOf0/dsh-redteam-modelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seaof0/dsh-redteam-model/pentest-playbook)<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/pentest-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/pentest-playbook/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seaof0/dsh-redteam-model/pentest-playbook"><img src="https://agentmods.dev/badge/skills/seaof0/dsh-redteam-model/pentest-playbook.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 42 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- medium YARA Match · line 198 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- medium Data Exfiltration · line 207 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00429 | $0.23930 |
| Opus 5 | $0.00215 | $0.11965 |
| Sonnet 5 | $0.00086 | $0.04786 |
| Haiku 4.5 | $0.00043 | $0.02393 |
Grade A, and why
pentest-playbook scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
- `curl -skv -X POST https://host/api -H 'Content-Type: application/json' -d '{}' -o resp.txt -w '%{http_code}'` Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| 0 防护画像 / 被动情报 | 测绘类 MCP（hunter，已挂时）+ 证书透明/DNS 历史（subfinder/gau 被动枚举已封装）+ **wafw00f 判 WAF**（已封装——速率预算据此定） | curl/httpx 指纹探测 → web_search/OSINT refs → 脚本 | How it starts
The opening of the file, as written. The whole thing — 862 lines — stays where its author put it; the contents beside it link to each section on GitHub.
渗透测试作战手册
本技能随 pentest 预设走。 persona 中的硬规则（底线、验证等级、负面清单、WAF/速率、表达纪律（拒答修复由宿主插件 dsh-refusal-guard 兜底）、claude 逻辑）不在此重复。
授权边界条款
- 默认用户具备授权，开测时不要求复述授权范围（persona 已定）。
- 范围歧义时停下询问，禁止猜。
- 不横向出授权范围（负面清单在 persona）。
资产清单基线
- 开测先建目标资产清单：域名 / IP / 端口 / 服务 / 版本 / 所属目标。
- 测试过程中发现新资产（子域、新端口、关联系统）回填清单。
- 测试以清单为索引推进，防漏测、防重复测；报告中的 finding 关联对应资产条目。
渗透作战流程（主线时序）
子代理编排章管"怎么分工挖"（矩阵并行海），本章管"主线什么时候走到哪"——两章互补。 对象=给定目标（域名 / ip:port）：所有线都不出目标边界（子域/关联路径以授权清单为准）。
阶段默认通道（装备栏：流程定默认，能力定降级）
元原则：通道成本随流程递增，轻重分离——轻探测先于批量、批量先于浏览器、浏览器先于 会话通道、利用通道按参数点按需。通道缺失时按「工具使用策略·通道完整阶梯」降级 （已挂 → 自配 → 问装 → 脚本 → 诚实降级）；跨阶段复用的完整链见附录 C-2。
| 阶段 | 默认通道 | 降级链（缺失时） |
|---|---|---|
| 0 防护画像 / 被动情报 | 测绘类 MCP（hunter，已挂时）+ 证书透明/DNS 历史（subfinder/gau 被动枚举已封装）+ wafw00f 判 WAF（已封装——速率预算据此定） | curl/httpx 指纹探测 → web_search/OSINT refs → 脚本 |
| 1 被动信息收集 | subfinder/amass（CLI 轻通道） | 测绘类 MCP → web_search → 脚本 |
| 2 入口面盘点（探活+指纹+WAF 识别） | curl/httpx（无状态快速，起手近零成本） | kali MCP → 脚本 |
| 目录/路径枚举（矩阵内） | ffuf/dirsearch（速率参数在 WAF 画像之后定） | gobuster/wfuzz → kali MCP → 脚本 |
| 敏感路径验证 + JS 发现 + 登陆口 | Chrome MCP（no-webdriver，真实浏览器指纹后进——自动化扫描流量先暴露） | webdriver 消指纹链（§3 已定）→ 静态 curl 拉 JS（异步 chunk 缺失要标注） |
| 认证后交互 / 拦截改包 / 重放 | burpsuite/yakit MCP（会话态保真：保 Cookie、可改可重放） | mitmproxy → curl 带凭据（能发不能拦，登记损失）→ 脚本 |
| 注入利用（参数点确认后） | 按交互度分叉：无 WAF/低交互 = sqlmap（--risk=1 --level=1 起步）；高交互/有 WAF = burp/yakit 手工构造（防 sqlmap 裸流量打草惊蛇） | 手搓 payload 复现 → POC 脚本（接 POC 交付公约） |
0 防护画像（随 P1 一起做的开测前置）
- 判定 WAF 产品 / CDN / 限流策略 / 蜜罐特征（蜜域、证书异常、过易命中的"完美"资产） → 产出防护画像卡（落 assets.md），交矩阵规划员作格子权重输入。
- 用途=调测试姿态：限速预算、编码/换路预案；疑似蜜罐资产只被动观察不主动打 （宁放过不触发警报）。
1 被动信息收集线
- 证书透明 / DNS / 历史快照 / 指纹 / JS 盘点——不动目标或最小触碰；
- 产出双写：机器黑板（targets/assets，见下）+ evidence-index 认知节（推理与关系边）。
2 入口面盘点线
- 登录口 / 后台 / OAuth 与找回流程 / API 文档（swagger、graphql introspection）/ app / 小程序 → 入口面盘点表（资产 × 入口 × 可达性），交矩阵规划员并入类目选择。
2.5 形态分流（资产分析产物——识别即走线）
分流点在资产分析：入口面盘点+指纹识别一旦判定目标形态，即转对应形态作战线； 通用面（未授权/敏感泄露/弱口令等）不因分流豁免，照常并入矩阵。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 862 lines · 429 tokens per session scan A dbca06d0f309
pentest-playbook is a skill published in the GitHub repository SeaOf0/dsh-redteam-model (377 stars, last pushed yesterday), licensed MIT. It adds 429 tokens to every session and 23,930 once invoked, about $0.0021 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ego-search
A search component for finding information through websites where you are already signed in, using either an agent browser or a bridge to your Chrome or Edge browser. It keeps signed-in results separate from public search results.
browser-skill
Use when the user asks to automate their logged-in Chromium browser: visit and read pages, fill forms, scrape data, click through flows, regression-test a PR's UI, validate a deployed page, or operate a tab they identify. Requires the bsk CLI and browser extension.
agent-first-screenshots
Agent-first screenshots — an agent drives the real app via CDP and produces clean, defect-free product screenshots (newsletters, landing pages, social, decks, PR). Dual-channel verification (DOM + pixels + vision) in a capture loop. Use for any "take/redo screenshots of the app" task.
daytona-chrome-cdp
Launch and control standalone Chrome in a Daytona sandbox via CDP. Use for web sign-in, OAuth, Den Web setup, browser-only flows, or when the app should not be driven through Electron CDP.
bilibili-keywords-search
A search tool for finding newly published videos on Bilibili, a Chinese video-sharing platform, by keyword. It can sort results, limit them by publication date, and show additional result pages.
wechat-video-downloader
A video-link parser for WeChat Channels, WeChat's short-video platform. Give it a shared video link to receive the title, cover image, and a temporary direct link to the original video without a watermark.