coordination
starsforks
How to install coordination?
transilienceai/communitytools/coordination
$npx -y skills add transilienceai/communitytools --skill coordinationPentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.
SKILL.md
| 1 | # Coordination |
| 2 | |
| 3 | Runs as a spawned subagent (one per target). Within its own context, the coordinator holds engagement state inline — it does not delegate its thinking to further sub-subagents. Thinks before every action. |
| 4 | |
| 5 | The parent orchestrator (main session) **must not** execute this workflow inline. If you find yourself doing P1-P5 in the main session, you skipped the spawn step in `skills/hackthebox/SKILL.md` (or the relevant platform skill) and the bookkeeping discipline is silently disabled. |
| 6 | |
| 7 | ## Principle (Rule 0) |
| 8 | |
| 9 | **Source code first.** Read all accessible source — application code, config, scripts, share contents — before any executor batch. Every answer is in the data you already have. Guessing without reading is the most common failure mode. |
| 10 | |
| 11 | ## Workflow |
| 12 | |
| 13 | ``` |
| 14 | P0: Ingest scope |
| 15 | ↓ |
| 16 | P1: Recon + read source code → write attack-chain.md → run preflight-checklist |
| 17 | ↓ |
| 18 | ┌→ P2: Think — read chain + experiments.md, write 3 hypotheses (≥1 [wildcard]), pick 1-2 to test |
| 19 | │ P2b: Research (conditional) — see reference/creative-research.md |
| 20 | │ P3: Execute — spawn 1-2 executors with CHAIN_CONTEXT [+ RESEARCH_BRIEF] |
| 21 | │ P4: Integrate — materialize each candidate; **validate it now** (interleaved, strict per-finding, |
| 22 | │ fresh blind agents) → CONFIRMED | REJECTED | CURE→re-validate | DROPPED; update chain, revise theory |
| 23 | │ Coverage flips only on VALID (coverage-by-VALID); REJECTED/DROPPED classes stay pending → keep searching |
| 24 | │ No progress 1 batch → consider P2b · goal_attempts ≥ 3 on any conceptual goal → P4b |
| 25 | └─ loop (max 30 experiments; mandatory skeptic at experiments 5, 15, 25) |
| 26 | |
| 27 | P4b: Reset — re-read all recon + source + chain. Creative Research (mandatory). Fresh theory. |
| 28 | P5: Engagement-thoroughness validation + Report (validated/ = VALID/REPAIRED only; drop-entirely, no gaps section) |
| 29 | ``` |
| 30 | |
| 31 | ### Steps |
| 32 | |
| 33 | 1. **Recon + Source Code** — read all accessible code (see `formats/reconnaissance.md`). Run pre-flight checklist (`reference/preflight-checklist.md`). |
| 34 | 2. **Think** — write 3 hypotheses to `attack-chain.md`, ≥1 tagged `[wildcard]`. Pick 1-2 to spawn. |
| 35 | 3. **Test** — 1-2 executors per batch, integrate before next. |
| 36 | 4. **Validate (interleaved)** — validate each candidate the instant INTEGRATE materializes it, on fresh blind agents (strict per-finding cure/drop loop → CONFIRMED | REJECTED | CURE | DROPPED); at loop end run the engagement-thoroughness validator (see `reference/validator-role.md`). |
| 37 | 5. **Report** — the `VALID`/`REPAIRED` findings in `{OUTPUT_DIR}/artifacts/validated/` (all of them, by construction) → Transilience PDF via `formats/transilience-report-style/SKILL.md`. |
| 38 | |
| 39 | ## attack-chain.md |
| 40 | |
| 41 | `{OUTPUT_DIR}/attack-chain.md`. Updated every batch. Sections: services, surface, theory (3 hypotheses + chosen), tested, next. Bullets, max 50 lines, prune old items to one-liners. |
| 42 | |
| 43 | ## Bookkeeping |
| 44 | |
| 45 | experiments.md ledger, tools/ logs, EXPERIMENT_ID injection, conceptual-goal counting — see `reference/bookkeeping.md`. |
| 46 | |
| 47 | ## Creative Research (P2b) |
| 48 | |
| 49 | Triggers: P4b reset (mandatory), goal_attempts ≥ 3 on any goal, novel error class, source code unreadable, every executor returned negative, no hypothesis at P2, no progress for 1 batch. See `reference/creative-research.md`. Most batches skip P2b. |
| 50 | |
| 51 | ## Spawning |
| 52 | |
| 53 | See `reference/spawning-recipes.md` for copy-paste-ready spawn patterns per role. Context contracts in `reference/context-injection.md`. Role boundaries in `reference/role-matrix.md`. |
| 54 | |
| 55 | ## Roles |
| 56 | |
| 57 | | Role | File | Context | When | |
| 58 | |------|------|---------|------| |
| 59 | | Executor (explore) | `reference/executor-role.md` | Full chain + skills | Recon / breadth | |
| 60 | | Executor (exploit) | `reference/executor-role.md` | Full chain + skills + scenarios | Confirmed theory | |
| 61 | | Skeptic | `reference/skeptic-role.md` | experiments.md + recon (no chain) | Mandatory at experiments 5, 15, 25 | |
| 62 | | Validator (finding) | `reference/validator-role.md` | Evidence only (blind) | Interleaved — each candidate the instant it's materialized; fresh each cure round | |
| 63 | | Executor (cure) | `reference/executor-role.md` | Only named `failed_checks` + `missing_evidence` (no theory) | On a DEMOTED verdict, before re-validation | |
| 64 | | Validator (engagement) | `reference/validator-role.md` | OUTPUT_DIR only (blind) | Once at loop end | |
| 65 | |
| 66 | ## Rules |
| 67 | |
| 68 | 1. **Autonomous.** Coordinator MUST NOT call `AskUserQuestion`. If a credential is missing, run `python3 tools/env-reader.py`; if it returns NOT_SET, terminate with `status=BLOCKED` and emit a clear blocker. Asking is the parent orchestrator's job. |
| 69 | 2. **Think before acting.** Write 3 hypotheses (≥1 wildcard) to attack-chain.md before every batch. Record rejected ones — they are the search tree. |
| 70 | 3. **Max 1-2 executors per batch.** Recon can use more. |
| 71 | 4. **Pass chain context + specific PATT_URL** to executors. Not the full PATT map. |
| 72 | 5. **30-experiment cap.** |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
