What problem does it solve? Red-team operators often self-throttle during authorized engagements — retracting valid findings after one failed recheck, stopping at the first WAF block, or treating red-team scope like a bug-bounty scan — causing real vulnerabilities to be missed or incorrectly withdrawn. ## Core Features & Use Cases - Persistence Directives: Defines explicit anti-patterns and legitimate stop conditions so testers keep probing every live host, endpoint, and vulnerability class until scope is genuinely exhausted. - Scope Discipline: Separates red-team scope (access-yielding bugs like SQLi, RCE, SSRF, auth bypass) from WAPT-class bugs (CSRF, reflected XSS, missing headers) so effort goes toward findings that prove impact. - Blocker Decision Trees: Provides escalation paths for captchas, WAFs, rate limits, and slow targets, plus checklists for pre-, during-, and post-engagement phases. - Use Case: During an authorized external red-team engagement, a tester hits a 403 on an admin panel and is tempted to move on; this Skill directs them through 12+ auth-bypass classes, sister-app sweeps, and cross-validation before any host is declared complete. ## Quick Start Load the redteam-mindset skill at the start of this authorized red-team engagement and apply its persistence and scope rules to my testing plan.
