skills.rest
Ed1s0nZ
Ed1s0nZCOMMUNITY
Explore all skills by this author →
GitHub

pentest-blackboard

Records penetration testing facts, vulnerabilities, and attack-chain relationships in a SQLite project blackboard.

6.2k|1.0k|Updated Nov 8, 2025
Search Tags:#penetration testing#sqlite#vulnerability management#Red Team#attack chain#Blackboard#fact graph
One-click install
npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill pentest-blackboard
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentest-blackboard
Source: https://github.com/Ed1s0nZ/CyberStrikeAI/tree/main/skills/pentest-blackboard
Command: npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill pentest-blackboard

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During long penetration testing engagements, context compression and multi-agent coordination cause critical findings, credentials, and attack-chain details to be lost. This Skill enforces a disciplined write-as-you-go workflow that persists every confirmed fact, vulnerability, and relationship edge into a project-bound SQLite blackboard instead of relying on conversation memory.

Core Features & Use Cases

  • Fact Graph Management: Upsert project facts with structured fact_key categories (target, auth, infra, finding, chain, exploit, poc), confidence levels (confirmed, tentative, deprecated), and relationship links forming a queryable attack graph.
  • Vulnerability Recording: Register deliverable findings via record_vulnerability with title, severity, type, target, POC, impact, and remediation, with deduplication through list_vulnerabilities.
  • Multi-Agent Coordination: Coordinators aggregate 'pending write' items from sub-agents without tool access and persist them, ensuring no evidence is lost across sessions.
  • Use Case: During an authorized web app pentest, after confirming a SQL injection on the login endpoint, immediately upsert a finding/sqli-login fact with full reproduction steps and links to the target fact, then record the formal vulnerability before continuing exploitation.

Quick Start

Ask the agent to record the currently confirmed finding as a project fact with confidence level and relationship links, then register it as a formal vulnerability in the bound project blackboard.

Frequently Asked Questions about pentest-blackboard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I record penetration testing findings without losing context?▼

Use upsert_project_fact immediately after confirming each new insight, writing a summary with what, where, and how to trigger, plus a full body with reproduction steps. Same fact_key overwrites previous versions, so update rather than duplicating entries.

What is the difference between a project fact and a recorded vulnerability?▼

Facts capture environment knowledge and exploitation context in the blackboard, while record_vulnerability creates the formal deliverable finding with severity, POC, impact, and remediation. A single discovery can be stored as both, one for context and one for reporting.

How do relationship links work in the attack graph?▼

Links are structured edges written during upsert, connecting facts with types like discovered_on, exploits, depends_on, and leads_to. Finding, chain, exploit, and poc entries must include links; omitting links preserves existing edges while passing links replaces all inbound edges.

Can sub-agents without blackboard tools still contribute findings?▼

Yes. Sub-agents append a 'pending write' section to their deliverables with suggested fact_key, summary, and body or POC points. The coordinating agent then writes these items into the blackboard on their behalf.

What confidence level should I use for unverified leads?▼

Mark unverified leads as tentative and only set confirmed after evidence-backed verification. False positives should be marked deprecated via deprecate_project_fact rather than deleted, preserving the audit trail.

What happens if no project is bound to the current conversation?▼

Blackboard tools will fail without a bound project. In that case, keep an evidence summary within the current session and note that blackboard writes are unavailable until a project is bound.

Related Skills

Explore More Software Engineering Skills→
BrownFineSecurityBrownFineSecurity
811

Nmap Scan

Automates two-phase Nmap scanning for ports, services, versions, and NSE vulnerabilities.

Official
Advanced
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
bordenetbordenet
8

wiki-debunker

Validate wiki page claims against git history, issue trackers, and meeting transcripts.

Community
Advanced
justinsenseijustinsensei
1

obsidian-semantic-lint

Analyze Obsidian notes for inconsistencies, stale summaries, and logical gaps.

Community
Intermediate