Guide · Agent skill
How to use the Attack Chain Orchestration agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The attack-chain skill is an agent skill that makes an AI agent plan and coordinate multi-stage security assessments, such as tracing a path from an external foothold to an internal domain controller. It is meant for authorized penetration tests and red-team exercises only. After this guide you will know what the skill does, how to install it, how to phrase requests so it triggers, and what it needs before it runs.
Attack Chain Orchestrationzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Confirm authorization. Get written permission for the exact targets and scope before you start. The skill will not act without a granted authorization status.
- 2Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills.
- 3Prepare the dependencies. Install the referenced security tools separately and make sure the sibling skill folders and the PowerShell case initialization script are available.
- 4Describe the multi-stage goal. Ask in plain language for a path from your starting point to the stated objective, and include the scope and off-limits systems.
- 5Review the plan and proceed by stage. Check the phase plan and each proposed command, then approve stages one at a time while the agent updates its timeline and evidence records.
What the attack-chain skill makes the agent do
The skill turns the agent into a planner for work that spans several stages: reconnaissance, initial access, privilege escalation, lateral movement and impact assessment. It sets the order of the stages, decides which tools and methods each stage needs, and hands individual stages to other specialist skills.
If your task only covers one stage, such as a single port scan or a single SQL injection test, the skill's own guidance is to send it straight to the relevant specialist skill rather than run the full chain.
- Plans a path from the starting point to the stated goal
- Tracks each phase with a checklist and timeline
- Routes single-stage tasks to specialist skills
- Requires a written scope and authorization record before acting
How to install the attack-chain skill
You can install the skill in either of two ways. Download the ZIP file from this page and unzip it into your user skills folder (~/.claude/skills/) or into a project's .claude/skills/ folder. Alternatively, upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
After installing, confirm that the attack-chain folder contains SKILL.md and the references folder, which holds attack-playbooks.md, evasion-cheatsheet.md and lifecycle-checklist.md.
- User-wide: unzip into ~/.claude/skills/
- Project-only: unzip into the project's .claude/skills/
- Claude apps: Settings, then Capabilities, then Skills, then upload the ZIP
How to trigger the skill with natural requests
You do not need a special command. Describe a multi-stage goal in plain language, and state that the work is authorized. The skill's description targets tasks that span several phases, so requests that name a full path tend to match it best.
Examples of phrasing that fits the skill's described use cases include planning a full penetration test from information gathering through reporting, assessing the attack surface of one target, and asking what a single vulnerability could lead to once chained with other steps.
- Help me plan an authorized penetration test of our company from external recon through reporting.
- Plan an attack path from our external web application to the internal domain controller, under our signed scope.
- Assess the attack surface of this target across several stages and propose the order of work.
- I already have a webshell on an authorized test host. Plan the next stages.
What you need before running it
The skill depends on material that is not in the downloaded files. Its instructions refer to sibling skill folders and scripts by relative path, including a PowerShell case initialization script at ../scripts/case-init.ps1, an operations folder, a tool index and a pentest-tools folder. Those must be present for the workflow to run as written.
The security tools it references, such as subfinder, amass, httpx, nmap, nuclei, sqlmap, hydra, winPEAS and linPEAS, must be installed separately. Running the case initialization script needs a PowerShell environment. The skill also reads and writes files, and it uses the network.
- Sibling skill folders and ops files referenced by relative path (not included in the download)
- Security tools installed separately
- A PowerShell environment for the case initialization script
- Working knowledge of the tools and of Active Directory; the skill does not teach these
../scripts/case-init.ps1Safety notes: authorization, scripts and network use
The skill's instructions require a scope and authorization file to be completed before any action. They state that if the authorization status is not granted, the agent must not perform actions against the target. Treat this as a hard gate, not a formality.
The skill runs scripts and uses the network. Use it only against systems you own or have written permission to test, and keep the work within the agreed scope. Much of the visible text is a reference catalogue of intrusion, phishing and credential-attack techniques, so review what the agent proposes before anything is executed.
- Do not use it without written authorization for every target
- Confirm the scope file is complete and the authorization status is granted before the agent acts
- Review every command the agent proposes before running it
- Run it in an environment whose network access you have approved
Tips for getting useful output
Give the agent the goal, the starting position and any constraints up front: what you already have, what the final objective is, and what systems are off limits. The skill's planning step is built around those inputs.
Expect the output to be a plan with stage gates. If a path fails, ask the agent to replan an alternative route rather than forcing the same one. Keep the timeline and evidence records the skill creates, since the report is meant to link each finding to its evidence.
- State scope and off-limits systems in the first message
- Ask for stage-by-stage gates rather than one long action list
- Ask for an alternative path when one route fails
- Keep the generated timeline and evidence records for the report
What people use it for
- Planning a scoped red-team exercise that moves from an external foothold toward an internal domain controller
- Structuring a full penetration test from reconnaissance through to a report with linked evidence
- Assessing how far a single confirmed vulnerability could be chained within an agreed scope
Frequently asked questions
How do I install the attack-chain agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
What does the attack-chain skill need to run?
It needs the referenced sibling skill folders and scripts, which are not included in the download, plus security tools such as nmap and nuclei installed separately. The case initialization script needs a PowerShell environment, and the skill runs scripts and uses the network.
Is the attack-chain skill free to use?
The source is listed under the MIT licence. Check the licence file in the repository for the full terms before you use or redistribute it.
Can I use this skill for a simple port scan or single SQL injection test?
The skill's guidance is to send single-stage tasks directly to their specialist skill, such as pentest-tools, instead of running the full multi-stage chain. Use the attack-chain skill when the task spans several phases.
Why won't the agent start testing my target?
The skill requires a scope and authorization file to be completed, with the authorization status set to granted, before any action. If that status is not granted, the agent is instructed not to act, so complete the scope file first.
Is there an alternative if I only want a learning guide?
This skill assumes working knowledge of tools such as nmap, sqlmap and Active Directory attacks and does not explain safe lab practice. For beginner learning, use a dedicated course or a lab environment you own, and reserve this skill for authorized engagements.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security professionals running an authorized penetration test or red-team exercise who want a structured, stage-gated attack-path plan. It is not suitable for anyone without written authorization for the target, or for beginners looking for a general learning guide, since it assumes prior tool knowledge and does not teach safe lab practice.
Download the skill