opsec-discipline

Name: opsec-discipline
Author: hypnguyen1209

320stars55forks

How to install opsec-discipline?

hypnguyen1209/offensive-claude/opsec-discipline

$npx -y skills add hypnguyen1209/offensive-claude --skill opsec-discipline

Installs into the current project.

Summary

Use when about to take any outward or offensive action (request, payload, persistence, lateral movement, exfil, or feeding captured traffic to the model) — to decide detection footprint, cleanup, and secret redaction first

Files · 1

View on GitHub

SKILL.md

1	# OPSEC Discipline
2
3	## Overview
4
5	Decide the detection footprint and cleanup before acting, not after. Every offensive technique
6	in this repo pairs with the telemetry it generates and a detection signature — use that pairing to
7	choose the quieter path and to know what you'll need to clean up.
8
9	## Before acting, answer three questions
10
11	1. Detection — what telemetry does this generate? Which Sigma/EDR rule would catch it? (Each
12	domain skill's OPSEC & Detection table has this.) Pick the lower-noise variant when one exists.
13	2. Cleanup — what does this touch (files, registry, services, accounts, tickets)? How is it
14	reverted? Stage the cleanup before you create the artifact.
15	3. Secret hygiene — any captured traffic / output that reaches the model or the report must be
16	redacted at the boundary:
17	`python skills/coding-mastery/scripts/_lib/redact_headers.py < exchange.txt` (or `redact_text()`),
18	so Authorization/Cookie/API-key/JWT values never land in context or the report.
19
20	## Red Flags — STOP, decide OPSEC first
21
22	- "I'll worry about cleanup after I'm in" (you won't; decide now)
23	- "Just paste the raw request/response" (redact secrets at the boundary first)
24	- "Loudest exploit is fine, it works" (pick the variant with the smaller footprint)
25	- "Persistence now, document later" (persistence on un-authorized hosts is out — see scope-discipline)
26	- "The token's only in a log" (a logged secret is a leaked secret — mask it)
27
28	## Rationalizations
29
30	\| Excuse \| Reality \|
31	\|--------\|---------\|
32	\| "OPSEC slows me down" \| Unplanned noise/loot is how engagements get burned and how data leaks. \|
33	\| "It's an internal tool log" \| Logs get shipped, shared, and indexed. Redact. \|
34	\| "Cleanup is a reporting-phase task" \| You can't clean what you didn't track. Track at action time. \|
35
36	OPSEC is part of every action, not a phase. Detection-awareness also strengthens the defensive value
37	of the finding (you can tell the client exactly how to catch it).

People who liked this also viewed

6 picks

Type

opsec-discipline

320stars55forks

View on GitHub

How to install opsec-discipline?

hypnguyen1209/offensive-claude/opsec-discipline

$npx -y skills add hypnguyen1209/offensive-claude --skill opsec-discipline

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# OPSEC Discipline
2
3	## Overview
4
5	Decide the detection footprint and cleanup before acting, not after. Every offensive technique
6	in this repo pairs with the telemetry it generates and a detection signature — use that pairing to
7	choose the quieter path and to know what you'll need to clean up.
8
9	## Before acting, answer three questions
10
11	1. Detection — what telemetry does this generate? Which Sigma/EDR rule would catch it? (Each
12	domain skill's OPSEC & Detection table has this.) Pick the lower-noise variant when one exists.
13	2. Cleanup — what does this touch (files, registry, services, accounts, tickets)? How is it
14	reverted? Stage the cleanup before you create the artifact.
15	3. Secret hygiene — any captured traffic / output that reaches the model or the report must be
16	redacted at the boundary:
17	`python skills/coding-mastery/scripts/_lib/redact_headers.py < exchange.txt` (or `redact_text()`),
18	so Authorization/Cookie/API-key/JWT values never land in context or the report.
19
20	## Red Flags — STOP, decide OPSEC first
21
22	- "I'll worry about cleanup after I'm in" (you won't; decide now)
23	- "Just paste the raw request/response" (redact secrets at the boundary first)
24	- "Loudest exploit is fine, it works" (pick the variant with the smaller footprint)
25	- "Persistence now, document later" (persistence on un-authorized hosts is out — see scope-discipline)
26	- "The token's only in a log" (a logged secret is a leaked secret — mask it)
27
28	## Rationalizations
29
30	\| Excuse \| Reality \|
31	\|--------\|---------\|
32	\| "OPSEC slows me down" \| Unplanned noise/loot is how engagements get burned and how data leaks. \|
33	\| "It's an internal tool log" \| Logs get shipped, shared, and indexed. Redact. \|
34	\| "Cleanup is a reporting-phase task" \| You can't clean what you didn't track. Track at action time. \|
35
36	OPSEC is part of every action, not a phase. Detection-awareness also strengthens the defensive value
37	of the finding (you can tell the client exactly how to catch it).

People who liked this also viewed

6 picks

Type