engagement-memory
starsforks
How to install engagement-memory?
hypnguyen1209/offensive-claude/engagement-memory
$npx -y skills add hypnguyen1209/offensive-claude --skill engagement-memoryUse when recalling prior techniques at recon/weaponize, or recording a confirmed finding at report — cross-engagement pattern memory ranked by impact
SKILL.md
| 1 | # Engagement Memory (cross-engagement learning) |
| 2 | |
| 3 | ## When to Activate |
| 4 | |
| 5 | - At **recon/weaponize**: recall what already worked against this target class / tech stack. |
| 6 | - At **report**: persist each `[CONFIRMED]` finding as a reusable pattern (ranked by impact). |
| 7 | - Periodic housekeeping: compact the pattern DB / rotate the audit log. |
| 8 | |
| 9 | ## Model |
| 10 | |
| 11 | Append-only JSONL store (`~/.claude/engagement-memory/patterns.jsonl`, override `$ENGAGEMENT_DB`). |
| 12 | Three record types in their own files so they never mix: **patterns** (`patterns.jsonl`), |
| 13 | **target profiles** (`profiles.jsonl`), **audit log** (`audit.jsonl`, disposable). A pattern is keyed |
| 14 | by `(target, vuln_class, technique)`, ranked by **severity / CVSS / confidence** (real impact, never |
| 15 | payout), and carries a **lifecycle status** (`proposed/active/stale/deprecated/...`). Recall is an |
| 16 | **explicit top-N query** (anti-context-bloat). Duplicates **merge** (count bumped, most-recent status |
| 17 | wins), never blind-discarded; `compact` runs automatically over a size threshold and stays lossless. |
| 18 | TTL `stale` patterns and `deprecated/rejected` ones drop out of default recall but are kept. |
| 19 | |
| 20 | ## Commands |
| 21 | |
| 22 | ```bash |
| 23 | # RECALL — relevance-ranked (stdlib BM25 + aliases), active-only by default |
| 24 | python skills/engagement-memory/scripts/pattern_db.py match --vuln-class ssrf --query "imds metadata" --tech-stack aws |
| 25 | # INJECT — budgeted prior-intel card for a phase (top-N, byte-capped; $ENGAGEMENT_MEMORY_MODE=auto|debug|off) |
| 26 | python skills/engagement-memory/scripts/pattern_db.py inject --vuln-class ssrf --query imds --max-bytes 1500 |
| 27 | |
| 28 | # RECORD a confirmed finding (flags or finding JSON). A key collision needs --resolve update|merge|reject|force. |
| 29 | python skills/engagement-memory/scripts/pattern_db.py record --target acme.com --vuln-class ssrf \ |
| 30 | --cwe CWE-918 --attack-id T1190 --severity high --cvss 9.1 --tech-stack nginx,aws --technique "metadata theft" |
| 31 | python skills/engagement-memory/scripts/pattern_db.py record --json '<finding json from validate_findings>' |
| 32 | |
| 33 | # LIFECYCLE + cross-client |
| 34 | python skills/engagement-memory/scripts/pattern_db.py promote --target acme.com --vuln-class ssrf --technique "metadata theft" [--global] |
| 35 | python skills/engagement-memory/scripts/pattern_db.py deprecate --target acme.com --vuln-class ssrf --technique "metadata theft" |
| 36 | python skills/engagement-memory/scripts/pattern_db.py match --vuln-class ssrf --include-global # add sanitized cross-client TTPs |
| 37 | |
| 38 | # PROFILES + housekeeping + observability |
| 39 | python skills/engagement-memory/scripts/pattern_db.py profile --target acme.com --tech-stack nginx,aws --endpoints /api,/admin |
| 40 | python skills/engagement-memory/scripts/pattern_db.py recall-profile --target acme.com |
| 41 | python skills/engagement-memory/scripts/pattern_db.py compact # manual lossless dedup-merge |
| 42 | python skills/engagement-memory/scripts/pattern_db.py stats # patterns by class + profile count |
| 43 | python skills/engagement-memory/scripts/pattern_db.py audit-stats # action log: by tool/action/outcome |
| 44 | ``` |
| 45 | |
| 46 | Or use the `/engage.memory` command (recall | inject | record | promote | deprecate | gc | stats). |
| 47 | |
| 48 | ## OPSEC & Detection |
| 49 | |
| 50 | | Concern | Note | |
| 51 | |---------|------| |
| 52 | | Secrets at rest | Stores technique + CWE/CVSS + an evidence *reference*, never loot. A **secret-input guard** rejects `evidence_ref`/`source` that look like inline secrets (private keys, `password=`, AKIA, JWTs, tokens) — store a path; **rotate** the exposed credential, don't just delete. | |
| 53 | | Cross-client bleed | Per-client isolation is the default (`$ENGAGEMENT_DB`). The shared global store is opt-in (`promote --global` / `record --global`) and **sanitized** (target + evidence blanked); recall it only with `--include-global`. | |
| 54 | | Trust | New auto-captures can be `proposed`; only confirmed/reviewed findings are `active`. A key collision is **review-gated** (`--resolve`), not silently merged. | |
| 55 | | Auditability | Every record/match/compact/promote — and every refused line (`denial`) — is written to `audit.jsonl` (rotated by discard, with a retention-gap marker). The append-only patterns journal + audit log ARE the history. | |
| 56 | | Integrity | Records carry `schema_version`; malformed/type-poisoned/foreign lines are skipped on read, never trusted. | |
| 57 | |
| 58 | ## Deep Dives |
| 59 | |
| 60 | - `scripts/schemas.py` — record types (pattern/audit/target_profile/retention_gap), val |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
