What problem does it solve? Operators on authorized red-team engagements frequently self-throttle: stopping at the first 403, retracting valid findings after one failed recheck, skipping sister applications, or treating blockers like WAFs and captchas as stop signs. This Skill corrects those conservative defaults so the engagement actually achieves its "gain access, prove impact" objective instead of degrading into a shallow WAPT-style scan. ## Core Features & Use Cases - Self-Throttling Detection: Lists 10+ explicit anti-patterns (mid-loop permission re-asks, single-probe testing, skill-gap-as-stop-condition) to flag and correct immediately. - Per-Host Completion Cadence: Defines a concrete checklist of what a finished host looks like — path probing, robots.txt/sitemap mining, JS bundle secret greping, full SQLi and auth-bypass class sweeps per parameter. - Blocker Decision Trees: Provides escalation paths for captchas, WAFs, rate limits, and slow timing-based exfiltration instead of declaring "not feasible". - Use Case: At the start of an authorized external red-team engagement, load this Skill to set scope discipline (access-yielding bugs over WAPT-class bugs), then consult it whenever stuck or tempted to stop, and use its pre/during/post-engagement checklists to validate completeness. ## Quick Start Load the redteam-mindset skill at the start of this authorized red-team engagement and use its checklists to decide whether each host is truly finished.
