offsec-campaign-orchestrator

Orchestrates offensive security campaigns across reconnaissance, manual testing, chain building, and reporting.

7|4|Updated Jun 22, 2026
One-click install
npx skills add https://github.com/dbx0/skills --skill offsec-campaign-orchestrator-dbx0
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: offsec-campaign-orchestrator
Source: https://github.com/dbx0/skills/tree/main/skills/methodology/orchestration/offsec-campaign-orchestrator
Command: npx skills add https://github.com/dbx0/skills --skill offsec-campaign-orchestrator-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Large offensive security engagements fail when testers chase isolated bugs without a unifying objective, losing track of surfaces, hypotheses, and chainable primitives across a long campaign. ## Core Features & Use Cases - Campaign Start Sequence: Selects a crown-jewel objective, builds a target dossier, imports HAR/Burp/Caido traffic into a request map, and ranks attack surfaces before choosing bug classes. - Three Operating Modes: Supports crown-jewel route planning, narrow-target deep manual hunting via /deep-hunt, and broad delegated campaigns with specialist subagent briefs. - Chain-Oriented Scoring: Invokes /attack-chain on any primitive to score findings for chainability rather than standalone severity, producing report-ready exploit-chain cards. - Use Case: Starting a bug bounty engagement on a new web target, you run /crown-jewel target.com, import captured traffic with /request-import traffic.har, deep-hunt the billing workflow, and convert a refund logic flaw into a documented exploit chain. ## Quick Start Ask the agent to start an offensive campaign against your in-scope target by choosing the crown-jewel objective and building a target dossier.

Frequently Asked Questions about offsec-campaign-orchestrator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start an offensive security campaign on a new target?

Begin by selecting a crown-jewel objective with /crown-jewel, then create a target dossier with /target-dossier. Import any captured HAR, Burp, or raw HTTP traffic with /request-import before ranking surfaces and choosing an operating mode.

How to import Burp or HAR traffic into a pentest workflow?

Use the /request-import mode with the path to your HAR, Burp, Caido, browser export, or raw HTTP file. It converts the traffic into an offensive request map that merges into the target dossier for endpoint clustering and workflow candidates.

What is the difference between deep-hunt and delegated campaign modes?

Deep-hunt mode attacks one narrow workflow through actor, object, state, shape, time, and side-effect boundaries. Delegated campaign mode splits a broad target across specialist subagents like surface mappers, business-logic hunters, and chain builders.

Can this workflow score findings for exploit chaining?

Yes, the /attack-chain mode takes any discovered primitive and produces a chain card with next pivots. Findings are scored for chainability into high-impact paths rather than only standalone severity.

When should I not use campaign orchestration for security testing?

Skip it for single-hypothesis tasks or quick one-off checks where full dossier and campaign-plan overhead adds no value. It is designed for engagements bigger than one hypothesis with multiple surfaces and workflows.