@jakkrichm/create-nexus-devflow 2.0.0 → 2.0.1

package/template/.agents/skills/red-team-tactics/SKILL.md

@@ -1,199 +1,199 @@
----
-name: red-team-tactics
-description: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
-allowed-tools: Read, Glob, Grep
----
-
-# Red Team Tactics
-
-> Adversary simulation principles based on MITRE ATT&CK framework.
-
----
-
-## 1. MITRE ATT&CK Phases
-
-### Attack Lifecycle
-
-```
-RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
-       ↓              ↓              ↓            ↓
-   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
-       ↓              ↓              ↓            ↓
-LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
-```
-
-### Phase Objectives
-
-| Phase | Objective |
-|-------|-----------|
-| **Recon** | Map attack surface |
-| **Initial Access** | Get first foothold |
-| **Execution** | Run code on target |
-| **Persistence** | Survive reboots |
-| **Privilege Escalation** | Get admin/root |
-| **Defense Evasion** | Avoid detection |
-| **Credential Access** | Harvest credentials |
-| **Discovery** | Map internal network |
-| **Lateral Movement** | Spread to other systems |
-| **Collection** | Gather target data |
-| **C2** | Maintain command channel |
-| **Exfiltration** | Extract data |
-
----
-
-## 2. Reconnaissance Principles
-
-### Passive vs Active
-
-| Type | Trade-off |
-|------|-----------|
-| **Passive** | No target contact, limited info |
-| **Active** | Direct contact, more detection risk |
-
-### Information Targets
-
-| Category | Value |
-|----------|-------|
-| Technology stack | Attack vector selection |
-| Employee info | Social engineering |
-| Network ranges | Scanning scope |
-| Third parties | Supply chain attack |
-
----
-
-## 3. Initial Access Vectors
-
-### Selection Criteria
-
-| Vector | When to Use |
-|--------|-------------|
-| **Phishing** | Human target, email access |
-| **Public exploits** | Vulnerable services exposed |
-| **Valid credentials** | Leaked or cracked |
-| **Supply chain** | Third-party access |
-
----
-
-## 4. Privilege Escalation Principles
-
-### Windows Targets
-
-| Check | Opportunity |
-|-------|-------------|
-| Unquoted service paths | Write to path |
-| Weak service permissions | Modify service |
-| Token privileges | Abuse SeDebug, etc. |
-| Stored credentials | Harvest |
-
-### Linux Targets
-
-| Check | Opportunity |
-|-------|-------------|
-| SUID binaries | Execute as owner |
-| Sudo misconfiguration | Command execution |
-| Kernel vulnerabilities | Kernel exploits |
-| Cron jobs | Writable scripts |
-
----
-
-## 5. Defense Evasion Principles
-
-### Key Techniques
-
-| Technique | Purpose |
-|-----------|---------|
-| LOLBins | Use legitimate tools |
-| Obfuscation | Hide malicious code |
-| Timestomping | Hide file modifications |
-| Log clearing | Remove evidence |
-
-### Operational Security
-
-- Work during business hours
-- Mimic legitimate traffic patterns
-- Use encrypted channels
-- Blend with normal behavior
-
----
-
-## 6. Lateral Movement Principles
-
-### Credential Types
-
-| Type | Use |
-|------|-----|
-| Password | Standard auth |
-| Hash | Pass-the-hash |
-| Ticket | Pass-the-ticket |
-| Certificate | Certificate auth |
-
-### Movement Paths
-
-- Admin shares
-- Remote services (RDP, SSH, WinRM)
-- Exploitation of internal services
-
----
-
-## 7. Active Directory Attacks
-
-### Attack Categories
-
-| Attack | Target |
-|--------|--------|
-| Kerberoasting | Service account passwords |
-| AS-REP Roasting | Accounts without pre-auth |
-| DCSync | Domain credentials |
-| Golden Ticket | Persistent domain access |
-
----
-
-## 8. Reporting Principles
-
-### Attack Narrative
-
-Document the full attack chain:
-1. How initial access was gained
-2. What techniques were used
-3. What objectives were achieved
-4. Where detection failed
-
-### Detection Gaps
-
-For each successful technique:
-- What should have detected it?
-- Why didn't detection work?
-- How to improve detection
-
----
-
-## 9. Ethical Boundaries
-
-### Always
-
-- Stay within scope
-- Minimize impact
-- Report immediately if real threat found
-- Document all actions
-
-### Never
-
-- Destroy production data
-- Cause denial of service (unless scoped)
-- Access beyond proof of concept
-- Retain sensitive data
-
----
-
-## 10. Anti-Patterns
-
-| ❌ Don't | ✅ Do |
-|----------|-------|
-| Rush to exploitation | Follow methodology |
-| Cause damage | Minimize impact |
-| Skip reporting | Document everything |
-| Ignore scope | Stay within boundaries |
-
----
-
-> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.
+---
+name: red-team-tactics
+description: Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
+allowed-tools: Read, Glob, Grep
+---
+
+# Red Team Tactics
+
+> Adversary simulation principles based on MITRE ATT&CK framework.
+
+---
+
+## 1. MITRE ATT&CK Phases
+
+### Attack Lifecycle
+
+```
+RECONNAISSANCE → INITIAL ACCESS → EXECUTION → PERSISTENCE
+       ↓              ↓              ↓            ↓
+   PRIVILEGE ESC → DEFENSE EVASION → CRED ACCESS → DISCOVERY
+       ↓              ↓              ↓            ↓
+LATERAL MOVEMENT → COLLECTION → C2 → EXFILTRATION → IMPACT
+```
+
+### Phase Objectives
+
+| Phase | Objective |
+|-------|-----------|
+| **Recon** | Map attack surface |
+| **Initial Access** | Get first foothold |
+| **Execution** | Run code on target |
+| **Persistence** | Survive reboots |
+| **Privilege Escalation** | Get admin/root |
+| **Defense Evasion** | Avoid detection |
+| **Credential Access** | Harvest credentials |
+| **Discovery** | Map internal network |
+| **Lateral Movement** | Spread to other systems |
+| **Collection** | Gather target data |
+| **C2** | Maintain command channel |
+| **Exfiltration** | Extract data |
+
+---
+
+## 2. Reconnaissance Principles
+
+### Passive vs Active
+
+| Type | Trade-off |
+|------|-----------|
+| **Passive** | No target contact, limited info |
+| **Active** | Direct contact, more detection risk |
+
+### Information Targets
+
+| Category | Value |
+|----------|-------|
+| Technology stack | Attack vector selection |
+| Employee info | Social engineering |
+| Network ranges | Scanning scope |
+| Third parties | Supply chain attack |
+
+---
+
+## 3. Initial Access Vectors
+
+### Selection Criteria
+
+| Vector | When to Use |
+|--------|-------------|
+| **Phishing** | Human target, email access |
+| **Public exploits** | Vulnerable services exposed |
+| **Valid credentials** | Leaked or cracked |
+| **Supply chain** | Third-party access |
+
+---
+
+## 4. Privilege Escalation Principles
+
+### Windows Targets
+
+| Check | Opportunity |
+|-------|-------------|
+| Unquoted service paths | Write to path |
+| Weak service permissions | Modify service |
+| Token privileges | Abuse SeDebug, etc. |
+| Stored credentials | Harvest |
+
+### Linux Targets
+
+| Check | Opportunity |
+|-------|-------------|
+| SUID binaries | Execute as owner |
+| Sudo misconfiguration | Command execution |
+| Kernel vulnerabilities | Kernel exploits |
+| Cron jobs | Writable scripts |
+
+---
+
+## 5. Defense Evasion Principles
+
+### Key Techniques
+
+| Technique | Purpose |
+|-----------|---------|
+| LOLBins | Use legitimate tools |
+| Obfuscation | Hide malicious code |
+| Timestomping | Hide file modifications |
+| Log clearing | Remove evidence |
+
+### Operational Security
+
+- Work during business hours
+- Mimic legitimate traffic patterns
+- Use encrypted channels
+- Blend with normal behavior
+
+---
+
+## 6. Lateral Movement Principles
+
+### Credential Types
+
+| Type | Use |
+|------|-----|
+| Password | Standard auth |
+| Hash | Pass-the-hash |
+| Ticket | Pass-the-ticket |
+| Certificate | Certificate auth |
+
+### Movement Paths
+
+- Admin shares
+- Remote services (RDP, SSH, WinRM)
+- Exploitation of internal services
+
+---
+
+## 7. Active Directory Attacks
+
+### Attack Categories
+
+| Attack | Target |
+|--------|--------|
+| Kerberoasting | Service account passwords |
+| AS-REP Roasting | Accounts without pre-auth |
+| DCSync | Domain credentials |
+| Golden Ticket | Persistent domain access |
+
+---
+
+## 8. Reporting Principles
+
+### Attack Narrative
+
+Document the full attack chain:
+1. How initial access was gained
+2. What techniques were used
+3. What objectives were achieved
+4. Where detection failed
+
+### Detection Gaps
+
+For each successful technique:
+- What should have detected it?
+- Why didn't detection work?
+- How to improve detection
+
+---
+
+## 9. Ethical Boundaries
+
+### Always
+
+- Stay within scope
+- Minimize impact
+- Report immediately if real threat found
+- Document all actions
+
+### Never
+
+- Destroy production data
+- Cause denial of service (unless scoped)
+- Access beyond proof of concept
+- Retain sensitive data
+
+---
+
+## 10. Anti-Patterns
+
+| ❌ Don't | ✅ Do |
+|----------|-------|
+| Rush to exploitation | Follow methodology |
+| Cause damage | Minimize impact |
+| Skip reporting | Document everything |
+| Ignore scope | Stay within boundaries |
+
+---
+
+> **Remember:** Red team simulates attackers to improve defenses, not to cause harm.

package/template/.agents/skills/release-git-operations/SKILL.md

@@ -1,97 +1,97 @@
----
-name: release-git-operations
-description: Handle commit, pull request, merge, deployment, and changelog work around Release. Use when packaging verified work for sharing, integration, deployment, or release communication.
----
-
-# Release Git Operations
-
-## Overview
-
-This skill groups release-adjacent git and deployment behavior that used to be spread across multiple companion workflows.
-
-It is the shared behavior layer behind:
-
-- `Commit`
-- `PR`
-- `Merge`
-- `Deploy`
-- `Changelog`
-
-## Related Foundation Skills
-
-This skill should reuse and align with:
-
-- `.agents/skills/git-workflow-and-versioning/SKILL.md`
-- `.agents/skills/shipping-and-launch/SKILL.md`
-- `.agents/skills/deployment-procedures/SKILL.md`
-
-## When to Use
-
-- After `/50-Verify` when verified work is ready for packaging
-- During `/70-Release` when the team needs commit, PR, merge, deployment, or changelog support after the report is already aligned
-- When release communication must be built from markdown-first stage artifacts
-
-## Supported Modes
-
-- `commit`
-- `pr`
-- `merge`
-- `deploy`
-- `changelog`
-
-## Process
-
-### 1. Confirm Release Context
-
-Read the minimum required artifacts:
-
-- `verify.md`
-- `release.md`
-- `report.md` when relevant
-- git state and repository policy when relevant
-
-### 2. Run The Appropriate Mode
-
-#### Commit
-
-- stage the intended scope
-- use disciplined commit messaging
-- preserve branch safety rules
-
-#### PR
-
-- build PR narrative from markdown-first artifacts
-- preserve repository template fidelity
-- route follow-up review work cleanly
-
-#### Merge
-
-- confirm verification and review gates are satisfied
-- integrate safely using repository policy
-- route conflicts back to implementation or follow-up
-
-#### Deploy
-
-- apply shipping and launch discipline
-- verify platform-specific readiness
-- keep rollback and health checks explicit
-
-#### Changelog
-
-- summarize user-facing changes from stage artifacts and git evidence
-- avoid leaking low-value internal detail
-
-### 3. Route Back
-
-- return to `/70-Release` when packaging is still in progress
-- return to `/60-Report` when communication is the remaining task
-- return to `/40-Implement`, `/50-Verify`, or `PR-Followup` if release blockers are discovered
-
-## Output
-
-Return:
-
-- mode executed
-- artifacts or git actions produced
-- risks, blockers, or follow-up needs
-- recommended next stage or companion command
+---
+name: release-git-operations
+description: Handle commit, pull request, merge, deployment, and changelog work around Release. Use when packaging verified work for sharing, integration, deployment, or release communication.
+---
+
+# Release Git Operations
+
+## Overview
+
+This skill groups release-adjacent git and deployment behavior that used to be spread across multiple companion workflows.
+
+It is the shared behavior layer behind:
+
+- `Commit`
+- `PR`
+- `Merge`
+- `Deploy`
+- `Changelog`
+
+## Related Foundation Skills
+
+This skill should reuse and align with:
+
+- `.agents/skills/git-workflow-and-versioning/SKILL.md`
+- `.agents/skills/shipping-and-launch/SKILL.md`
+- `.agents/skills/deployment-procedures/SKILL.md`
+
+## When to Use
+
+- After `/50-Verify` when verified work is ready for packaging
+- During `/70-Release` when the team needs commit, PR, merge, deployment, or changelog support after the report is already aligned
+- When release communication must be built from markdown-first stage artifacts
+
+## Supported Modes
+
+- `commit`
+- `pr`
+- `merge`
+- `deploy`
+- `changelog`
+
+## Process
+
+### 1. Confirm Release Context
+
+Read the minimum required artifacts:
+
+- `verify.md`
+- `release.md`
+- `report.md` when relevant
+- git state and repository policy when relevant
+
+### 2. Run The Appropriate Mode
+
+#### Commit
+
+- stage the intended scope
+- use disciplined commit messaging
+- preserve branch safety rules
+
+#### PR
+
+- build PR narrative from markdown-first artifacts
+- preserve repository template fidelity
+- route follow-up review work cleanly
+
+#### Merge
+
+- confirm verification and review gates are satisfied
+- integrate safely using repository policy
+- route conflicts back to implementation or follow-up
+
+#### Deploy
+
+- apply shipping and launch discipline
+- verify platform-specific readiness
+- keep rollback and health checks explicit
+
+#### Changelog
+
+- summarize user-facing changes from stage artifacts and git evidence
+- avoid leaking low-value internal detail
+
+### 3. Route Back
+
+- return to `/70-Release` when packaging is still in progress
+- return to `/60-Report` when communication is the remaining task
+- return to `/40-Implement`, `/50-Verify`, or `PR-Followup` if release blockers are discovered
+
+## Output
+
+Return:
+
+- mode executed
+- artifacts or git actions produced
+- risks, blockers, or follow-up needs
+- recommended next stage or companion command