red-team-flow

Name: red-team-flow
Author: wiz-sec-public

172stars17forks

How to install red-team-flow?

wiz-sec-public/sitf/red-team-flow

$npx -y skills add wiz-sec-public/SITF --skill red-team-flow

Installs into the current project.

Summary

Generate SITF-compliant attack flow JSON from red team or pentest reports. Accepts report files, URLs, or pasted findings. Use when documenting offensive security engagements.

Files · 1

View on GitHub

SKILL.md

1	# Red Team Flow Generator
2
3	Generate SITF-compliant attack flow JSON files from red team or penetration testing reports.
4
5	## Usage
6
7	```
8	/red-team-flow <engagement-name> [source]
9	```
10
11	- `engagement-name`: Identifier for the engagement (e.g., "acme-2026q1", "client-sdlc-audit")
12	- `source`: One of:
13	- `--file <path>`: Path to report file (markdown, txt, json, pdf)
14	- `--url <url>`: URL to report or findings page
15	- Omit to paste report text directly in conversation
16
17	Arguments: $ARGUMENTS
18
19	## Supported Input Formats
20
21	The skill accepts red team and pentest reports in various formats:
22
23	### Text-Based Reports
24	- Markdown reports with findings sections
25	- Plain text engagement notes
26	- Bullet-point attack chains
27	- Executive summaries with technical appendix
28
29	### Structured Formats
30	- JSON findings export
31	- CSV with columns: finding, target, technique, evidence
32	- YAML engagement summaries
33
34	### Report Sections Recognized
35	The skill looks for these common report patterns:
36	- "Findings", "Vulnerabilities", "Attack Path", "Kill Chain"
37	- "Initial Access", "Lateral Movement", "Privilege Escalation"
38	- "Recommendations", "Remediation" (used for control mapping)
39	- Numbered steps (1., 2., 3. or Step 1, Step 2)
40	- MITRE ATT&CK references (T1xxx)
41
42	## Instructions
43
44	When this skill is invoked:
45
46	### Phase 1: Report Ingestion
47
48	1. If `--file` specified:
49	- Read the file content
50	- Detect format (markdown, txt, json, csv, yaml)
51	- Extract structured findings
52
53	2. If `--url` specified:
54	- Fetch the URL content
55	- Parse as report or findings page
56
57	3. If no source specified:
58	- Prompt user to paste report content
59	- Or use context from current conversation
60
61	4. Normalize the input:
62	- Extract attack steps/findings into a structured list
63	- Identify: target component, action taken, evidence, outcome
64	- Preserve attack chain order if present
65
66	### Phase 2: Technique Mapping
67
68	1. Read `techniques.json` to get the full SITF technique library.
69
70	2. For each finding/attack step, find the best matching technique:
71	- Match by action semantics, not surface keywords
72	- Map pentest terminology to SITF:
73	- "GitHub Actions exploit" → T-C003 (PWN Request) or T-C004 (Script Injection)
74	- "Stole AWS creds from logs" → T-C005 (Secret Exfiltration from Workflow)
75	- "Published malicious package" → T-R004 (Publishing Malicious Package)
76	- "Accessed prod via stolen token" → T-P001 (Abuse Production Credentials)
77	- If MITRE ATT&CK IDs are in the report, cross-reference with SITF mappings
78
79	3. If no matching SITF technique exists:
80	- Check if finding is in-scope for SITF (SDLC/supply-chain related)
81	- If in-scope: Create placeholder with `"type": "technique-gap"`
82	- If out-of-scope (generic infra attack): Note in output, reference MITRE ATT&CK
83
84	4. For pentest reports with isolated findings (not chained):
85	- Group findings by target component
86	- Create parallel technique nodes within each component
87	- Connect entry point to each finding independently
88
89	### Phase 3: Layout Calculation
90
91	Apply these layout rules (consistent with `/attack-flow`):
92
93	#### Rule 1: Component Layout (Left-to-Right by Attack Flow)
94	- Order components by their sequence in the attack chain
95	- If findings aren't chained, order by: endpoint → vcs → cicd → registry → production
96	- Component x-positions: Use increments of ~300px starting from x=50
97
98	#### Rule 2: Technique Ordering (Top-to-Bottom)
99	- Chained attacks: Order by attack sequence
100	- Isolated findings: Order by severity (Critical → High → Medium → Low)
101	- Vertical gap between techniques: ~130px
102	- First technique starts at y = component.y + 80
103
104	#### Rule 3: Technique-Component Centering
105	- technique.x = component.x + (component.width - technique.width) / 2
106	- With component.width=250 and technique.width=160: offset = 45
107	- Example: component at x=50 → technique at x=95
108
109	#### Rule 4: Component Sizing
110	- Width = 250px (standard)
111	- Height = max(500, (technique_count × 130) + 160)
112
113	#### Rule 5: Edge Connections
114	- Connect source.bottom → target.top for vertical flows within component
115	- Connect source.right → target.left for cross-component flows
116	- Add labels from report evidence ("Stolen AWS_ACCESS_KEY_ID", "via PR #123")
117	- Use `"type": "smoothstep"` for all edges
118
119	### Phase 4: JSON Generation
120
121	Generate attack flow JSON with this structure (identical to `/attack-flow` output):
122
123	```json
124	{
125	"metadata": {
126	"name": "Engagement Name",
127	"title": "Canvas Display Title",
128	"created": "ISO-8601 timestamp",
129	"version": "1.0",
130	"framework": "SITF",
131	"source": "red-team-report",
132	"description": "Brief engagement description"

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

red-team-flow

172stars17forks

View on GitHub

How to install red-team-flow?

wiz-sec-public/sitf/red-team-flow

$npx -y skills add wiz-sec-public/SITF --skill red-team-flow

Installs into the current project.

Summary

Generate SITF-compliant attack flow JSON from red team or pentest reports. Accepts report files, URLs, or pasted findings. Use when documenting offensive security engagements.

Files · 1

View on GitHub

SKILL.md

1	# Red Team Flow Generator
2
3	Generate SITF-compliant attack flow JSON files from red team or penetration testing reports.
4
5	## Usage
6
7	```
8	/red-team-flow <engagement-name> [source]
9	```
10
11	- `engagement-name`: Identifier for the engagement (e.g., "acme-2026q1", "client-sdlc-audit")
12	- `source`: One of:
13	- `--file <path>`: Path to report file (markdown, txt, json, pdf)
14	- `--url <url>`: URL to report or findings page
15	- Omit to paste report text directly in conversation
16
17	Arguments: $ARGUMENTS
18
19	## Supported Input Formats
20
21	The skill accepts red team and pentest reports in various formats:
22
23	### Text-Based Reports
24	- Markdown reports with findings sections
25	- Plain text engagement notes
26	- Bullet-point attack chains
27	- Executive summaries with technical appendix
28
29	### Structured Formats
30	- JSON findings export
31	- CSV with columns: finding, target, technique, evidence
32	- YAML engagement summaries
33
34	### Report Sections Recognized
35	The skill looks for these common report patterns:
36	- "Findings", "Vulnerabilities", "Attack Path", "Kill Chain"
37	- "Initial Access", "Lateral Movement", "Privilege Escalation"
38	- "Recommendations", "Remediation" (used for control mapping)
39	- Numbered steps (1., 2., 3. or Step 1, Step 2)
40	- MITRE ATT&CK references (T1xxx)
41
42	## Instructions
43
44	When this skill is invoked:
45
46	### Phase 1: Report Ingestion
47
48	1. If `--file` specified:
49	- Read the file content
50	- Detect format (markdown, txt, json, csv, yaml)
51	- Extract structured findings
52
53	2. If `--url` specified:
54	- Fetch the URL content
55	- Parse as report or findings page
56
57	3. If no source specified:
58	- Prompt user to paste report content
59	- Or use context from current conversation
60
61	4. Normalize the input:
62	- Extract attack steps/findings into a structured list
63	- Identify: target component, action taken, evidence, outcome
64	- Preserve attack chain order if present
65
66	### Phase 2: Technique Mapping
67
68	1. Read `techniques.json` to get the full SITF technique library.
69
70	2. For each finding/attack step, find the best matching technique:
71	- Match by action semantics, not surface keywords
72	- Map pentest terminology to SITF:
73	- "GitHub Actions exploit" → T-C003 (PWN Request) or T-C004 (Script Injection)
74	- "Stole AWS creds from logs" → T-C005 (Secret Exfiltration from Workflow)
75	- "Published malicious package" → T-R004 (Publishing Malicious Package)
76	- "Accessed prod via stolen token" → T-P001 (Abuse Production Credentials)
77	- If MITRE ATT&CK IDs are in the report, cross-reference with SITF mappings
78
79	3. If no matching SITF technique exists:
80	- Check if finding is in-scope for SITF (SDLC/supply-chain related)
81	- If in-scope: Create placeholder with `"type": "technique-gap"`
82	- If out-of-scope (generic infra attack): Note in output, reference MITRE ATT&CK
83
84	4. For pentest reports with isolated findings (not chained):
85	- Group findings by target component
86	- Create parallel technique nodes within each component
87	- Connect entry point to each finding independently
88
89	### Phase 3: Layout Calculation
90
91	Apply these layout rules (consistent with `/attack-flow`):
92
93	#### Rule 1: Component Layout (Left-to-Right by Attack Flow)
94	- Order components by their sequence in the attack chain
95	- If findings aren't chained, order by: endpoint → vcs → cicd → registry → production
96	- Component x-positions: Use increments of ~300px starting from x=50
97
98	#### Rule 2: Technique Ordering (Top-to-Bottom)
99	- Chained attacks: Order by attack sequence
100	- Isolated findings: Order by severity (Critical → High → Medium → Low)
101	- Vertical gap between techniques: ~130px
102	- First technique starts at y = component.y + 80
103
104	#### Rule 3: Technique-Component Centering
105	- technique.x = component.x + (component.width - technique.width) / 2
106	- With component.width=250 and technique.width=160: offset = 45
107	- Example: component at x=50 → technique at x=95
108
109	#### Rule 4: Component Sizing
110	- Width = 250px (standard)
111	- Height = max(500, (technique_count × 130) + 160)
112
113	#### Rule 5: Edge Connections
114	- Connect source.bottom → target.top for vertical flows within component
115	- Connect source.right → target.left for cross-component flows
116	- Add labels from report evidence ("Stolen AWS_ACCESS_KEY_ID", "via PR #123")
117	- Use `"type": "smoothstep"` for all edges
118
119	### Phase 4: JSON Generation
120
121	Generate attack flow JSON with this structure (identical to `/attack-flow` output):
122
123	```json
124	{
125	"metadata": {
126	"name": "Engagement Name",
127	"title": "Canvas Display Title",
128	"created": "ISO-8601 timestamp",
129	"version": "1.0",
130	"framework": "SITF",
131	"source": "red-team-report",
132	"description": "Brief engagement description"

People who liked this also viewed

6 picks

Type