How do I install the Tradecraft Pivot Decisions skill?

Run npx skillmds@latest add noorqureshi/tradecraft-pivot-decisions in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Tradecraft Pivot Decisions safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Tradecraft Pivot Decisions?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Tradecraft Pivot Decisions free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Tradecraft Pivot Decisions?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Tradecraft Pivot Decisions by noorqureshi

Name: Tradecraft Pivot Decisions
Author: NoorQureshi

Tradecraft Pivot Decisions

Decide what to do next after a result — the branching logic that turns a single outcome into the next lead. Load whenever a step just finished (success, partial, or dead end) and it's unclear where to go: "what now", "I got a shell/creds/a hash", "this didn't work", triaging which of several leads to pursue. This is the decision engine between techniques.

NoorQureshi Updated Sep 17, 2026

File contents

Pivoting: deciding the next move

When it applies

A step just produced a result and you must choose the next action instead of blindly running the next tool. Applies after every meaningful step — this is what keeps an engagement adaptive.

Why it works

Value comes from routing on evidence: a result changes the probability and payoff of every other lead. Making the routing explicit (what the result unlocks, what it rules out) avoids both tunnel-vision and aimless scanning, and produces the decision + rationale entries the Attack Map is built from.

Method

Classify the result: confirmed / partial / blocked / failed. Record it as the lead's status.
Ask what it unlocks (route by artifact — the signal → skill map):
- creds / hash → crack or spray (network-credential-cracking, network-password-spraying)
- a shell → enumerate & escalate (privesc-enumeration → privesc-*)
- SSRF / file read → reach internal services, metadata (cloud-imds-ssrf, web-ssrf)
- a token / key → what identity does it become? (cloud-iam-privesc, ad-*)
- two small bugs that combine → exploit-chaining
- internal foothold → network-pivoting-tunneling, map the graph (tradecraft-attack-path-mapping)
Score the candidates: impact toward the objective × likelihood × cost/noise; pick the top one.
On a dead end, don't just stop: record why (so it's not retried), then fall back to the next-best lead from the scenario. "Blocked by infra" ≠ "not vulnerable" — say which.
Update the plan: re-order remaining leads; note the new pivot. Then act on the single top lead.

Gotchas

Sunk cost: abandon a low-yield lead even after effort if a better one appeared.
"It failed" without a reason is a lost lesson — always record the mechanism of the failure.
Chasing novelty over objective: the next move is the one that best advances the stated goal.

Verify success

After each result there is a recorded decision (status + rationale) and exactly one chosen next lead that advances the objective — the engagement never stalls on "what now".

References

OODA loop applied to offense; MITRE ATT&CK tactic transitions; the exploit-chaining skill.

---name: tradecraft-pivot-decisionsdescription: Decide what to do next after a result — the branching logic that turns a single outcome into the next lead. Load whenever a step just finished (success, partial, or dead end) and it's unclear where to go: "what now", "I got a shell/creds/a hash", "this didn't work", triaging which of several leads to pursue. This is the decision engine between techniques.---# Pivoting: deciding the next move## When it appliesA step just produced a result and you must choose the next action instead of blindly running thenext tool. Applies after every meaningful step — this is what keeps an engagement adaptive.## Why it worksValue comes from routing on evidence: a result changes the probability and payoff of every otherlead. Making the routing explicit (what the result unlocks, what it rules out) avoids bothtunnel-vision and aimless scanning, and produces the `decision` + `rationale` entries the AttackMap is built from.## Method1. **Classify the result**: confirmed / partial / blocked / failed. Record it as the lead's `status`.2. **Ask what it unlocks** (route by artifact — the signal → skill map): - creds / hash → crack or spray (`network-credential-cracking`, `network-password-spraying`) - a shell → enumerate & escalate (`privesc-enumeration` → `privesc-*`) - SSRF / file read → reach internal services, metadata (`cloud-imds-ssrf`, `web-ssrf`) - a token / key → what identity does it become? (`cloud-iam-privesc`, `ad-*`) - two small bugs that combine → `exploit-chaining` - internal foothold → `network-pivoting-tunneling`, map the graph (`tradecraft-attack-path-mapping`)3. **Score the candidates**: impact toward the objective × likelihood × cost/noise; pick the top one.4. **On a dead end**, don't just stop: record *why* (so it's not retried), then fall back to the next-best lead from the scenario. "Blocked by infra" ≠ "not vulnerable" — say which.5. **Update the plan**: re-order remaining leads; note the new pivot. Then act on the single top lead.## Gotchas- Sunk cost: abandon a low-yield lead even after effort if a better one appeared.- "It failed" without a reason is a lost lesson — always record the mechanism of the failure.- Chasing novelty over objective: the next move is the one that best advances the stated goal.## Verify successAfter each result there is a recorded decision (status + rationale) and exactly one chosen nextlead that advances the objective — the engagement never stalls on "what now".## ReferencesOODA loop applied to offense; MITRE ATT&CK tactic transitions; the `exploit-chaining` skill.

Frequently asked questions