Red Team
Category: Engineering
Domain: Offensive Security
Overview
The Red Team skill provides tools for planning and scoping security engagements. It helps define rules of engagement, select methodologies, scope targets, plan attack phases, and generate engagement documentation.
Clarify First
Before planning the engagement, confirm these inputs. If any is unknown or vague, ASK — do not assume:
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
Quick Start
# Plan a red team engagement
python scripts/engagement_planner.py --type red-team --target "web application" --duration 2w
# Plan a penetration test
python scripts/engagement_planner.py --type pentest --target "api,network" --duration 1w --compliance pci-dss
# Generate rules of engagement document
python scripts/engagement_planner.py --type red-team --target "full-org" --output engagement_plan.json --format json
Tools Overview
| Tool |
Purpose |
Key Flags |
engagement_planner.py |
Plan red team engagements with scope, rules, and methodology |
--type, --target, --duration, --compliance |
engagement_planner.py
Generates comprehensive engagement plans including:
- Scope definition and boundaries
- Rules of engagement (ROE)
- Methodology selection (MITRE ATT&CK, OWASP, PTES, etc.)
- Phase breakdown with timelines
- Communication and escalation procedures
- Deliverables checklist
Workflows
Full Red Team Engagement
- Define engagement objectives and scope with
engagement_planner.py
- Review generated rules of engagement with stakeholders
- Get formal sign-off on scope and ROE
- Execute phases per the plan timeline
- Document findings throughout
- Deliver final report
Compliance-Driven Pentest
- Run planner with
--compliance flag for framework-specific requirements
- Map test cases to compliance controls
- Execute against compliance-specific checklist
- Generate evidence for auditors
Reference Documentation
- Red Team Methodology - Frameworks, attack phases, and engagement standards
Common Patterns
Engagement Types
- Red Team: Full adversary simulation, stealth required, tests detection/response
- Penetration Test: Authorized vulnerability exploitation, known to defenders
- Purple Team: Collaborative attack/defense, real-time knowledge sharing
- Bug Bounty Triage: Structured vulnerability validation from external reports
1---2name: red-team-33description: This skill should be used when the user asks to "plan a red team engagement", "scope a penetration test", "design a security assessment methodology", "create rules of engagement", or "plan an adversary simulation".4license: MIT + Commons Clause5---6
7# Red Team
8
9> **Category:** Engineering
10> **Domain:** Offensive Security
11
12## Overview
13
14The **Red Team** skill provides tools for planning and scoping security engagements. It helps define rules of engagement, select methodologies, scope targets, plan attack phases, and generate engagement documentation.
15
16## Clarify First
17
18Before planning the engagement, confirm these inputs. If any is unknown or vague, ASK — do not assume:
19
20- [ ] **Authorization & ROE owner** — who has signed off and the escalation contacts (no engagement plan without confirmed authorization)
21- [ ] **In-scope targets & boundaries** — the exact assets in and explicitly out of bounds (drives scope and `--target`)
22- [ ] **Engagement type** — red-team / pentest / purple / bug-bounty (sets stealth, methodology, and `--type`)
23- [ ] **Compliance framework** — e.g. pci-dss (maps test cases to controls via `--compliance`)
24
25Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
26
27## Quick Start
28
29```bash
30# Plan a red team engagement
31python scripts/engagement_planner.py --type red-team --target "web application" --duration 2w
32
33# Plan a penetration test
34python scripts/engagement_planner.py --type pentest --target "api,network" --duration 1w --compliance pci-dss
35
36# Generate rules of engagement document
37python scripts/engagement_planner.py --type red-team --target "full-org" --output engagement_plan.json --format json
38```
39
40## Tools Overview
41
42| Tool | Purpose | Key Flags |
43|------|---------|-----------|
44| `engagement_planner.py` | Plan red team engagements with scope, rules, and methodology | `--type`, `--target`, `--duration`, `--compliance` |
45
46### engagement_planner.py
47
48Generates comprehensive engagement plans including:
49- Scope definition and boundaries
50- Rules of engagement (ROE)
51- Methodology selection (MITRE ATT&CK, OWASP, PTES, etc.)
52- Phase breakdown with timelines
53- Communication and escalation procedures
54- Deliverables checklist
55
56## Workflows
57
58### Full Red Team Engagement
591. Define engagement objectives and scope with `engagement_planner.py`
602. Review generated rules of engagement with stakeholders
613. Get formal sign-off on scope and ROE
624. Execute phases per the plan timeline
635. Document findings throughout
646. Deliver final report
65
66### Compliance-Driven Pentest
671. Run planner with `--compliance` flag for framework-specific requirements
682. Map test cases to compliance controls
693. Execute against compliance-specific checklist
704. Generate evidence for auditors
71
72## Reference Documentation
73
74- [Red Team Methodology](references/red-team-methodology.md) - Frameworks, attack phases, and engagement standards
75
76## Common Patterns
77
78### Engagement Types
79- **Red Team**: Full adversary simulation, stealth required, tests detection/response
80- **Penetration Test**: Authorized vulnerability exploitation, known to defenders
81- **Purple Team**: Collaborative attack/defense, real-time knowledge sharing
82- **Bug Bounty Triage**: Structured vulnerability validation from external reports
majiayu000