skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

attack-chain

Construct exploit chains from security primitives and findings into structured chain cards.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#exploit#pentest#recon#offsec
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill attack-chain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: attack-chain
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/meta/attack-chain
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill attack-chain

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the difficulty of connecting isolated security findings into a coherent, high-impact exploit chain that is ready for professional reporting.

Core Features & Use Cases

  • Exploit-Chain Builder: Converts raw primitives like IDORs or SSRFs into structured chain cards.
  • Impact Assessment: Uses a standardized rubric to score the severity and chainability of security findings.
  • Use Case: When a researcher identifies an IDOR, they can use this skill to pivot through related object families and determine if the finding leads to a critical privilege escalation or data breach.

Quick Start

Invoke the attack-chain skill by providing the identified primitive or finding to generate a structured chain card.

Frequently Asked Questions about attack-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect isolated security findings into a high-impact exploit chain?▼

An exploit chain connects isolated security primitives like IDORs or SSRFs into structured chain cards. It maps pivots and authority upgrades to transition from initial discovery to reportable impact.

What is the best way to determine the severity score of an IDOR vulnerability?▼

Assessing IDOR severity requires a standardized rubric to evaluate chainability and asset exposure. You pivot through related object families to determine if the finding leads to critical privilege escalation or a data breach.

How do I map authority upgrades when chaining security vulnerabilities?▼

Mapping authority upgrades requires evaluating boundary conditions and asset exposure across pivots. This tracks how initial findings escalate into broader data breaches to determine the final severity score.

Can I generate structured chain cards from raw security primitives for pentest reporting?▼

Yes, raw security primitives can be converted into structured chain cards for pentest reporting. This facilitates the transition from initial discovery to reportable impact by mapping exploit relationships.

When do I need to evaluate boundary conditions during exploit chain construction?▼

Boundary conditions must be evaluated during exploit chain construction to determine final severity scores. This systematic evaluation reveals whether findings expose critical assets and establishes vulnerability chainability.

Related Skills

Explore More Software Engineering Skills→
phatblatphatblat
12

WebAssessment

Automate web application security assessments with reconnaissance, threat modeling, and vulnerability analysis.

Community
Advanced
SuperagentsysSuperagentsys
650

penetration-assessment

Run authorized penetration tests using a six-phase workflow and report templates.

Community
Advanced
oalansilvaoalansilva

threat-modeling

Enumerate threats and map mitigations for software system risk assessment.

Community
Intermediate
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate