rtexit-method 0.1.0 → 0.1.1

package/packaged-assets/.agents/skills/rt-lateral-movement/workflow.md

@@ -0,0 +1,68 @@
+# Workflow - rt-lateral-movement
+
+## Purpose
+
+This workflow standardizes how $skill is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.
+
+## Authorization Gate
+
+Before execution, confirm:
+
+- SEAD exists and explicitly covers the target asset or activity.
+- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
+- The operator knows the evidence handling rules.
+- Any active or sensitive validation has client approval.
+
+If any item is unclear, pause and invoke 
+
+## Required Inputs
+
+| Input | Source | Notes |
+|---|---|---|
+| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
+| Target asset(s) | Scope document | Must be explicitly approved. |
+| Operator name | Config/user context | Used in timeline entries. |
+| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
+| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |
+
+## Execution Steps
+
+1. Load current engagement configuration.
+2. Read scope, exclusions, and current findings.
+3. Build a small test plan for this skill with target, expected control, and evidence type.
+4. Run the lowest-risk validation first.
+5. Capture baseline behavior before proof behavior.
+6. Record exact timestamp, account/role used, and affected asset.
+7. Stop when evidence is sufficient; avoid unnecessary data access.
+8. Create or update findings through the RTExit finding tracker.
+9. Map remediation owner and recommended timeline.
+10. Add a timeline entry and evidence chain entry.
+
+## Evidence Requirements
+
+| Evidence | Required? | Notes |
+|---|---|---|
+| Command or action summary | Yes | Redact secrets and tokens. |
+| Screenshot or transcript | If useful | Store under evidence folder. |
+| Request/response pair | For web/API | Redact cookies and bearer tokens. |
+| Config excerpt | For cloud/infra | Include only relevant lines. |
+| Business impact note | Yes | Explain why it matters. |
+
+## Autodoc Commands
+
+`ash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-lateral-movement --phase auto --cmd "workflow execution" --output "summary"
+python _rtexit/scripts/finding_tracker.py list
+`
+
+## Completion Criteria
+
+- Scope and authorization are referenced.
+- Evidence is stored and redacted.
+- Findings are added or explicitly marked as not found.
+- Remediation guidance is actionable.
+- Timeline and chain of custody are updated where applicable.
+
+## Handoff
+
+Send confirmed findings to 

package/packaged-assets/.agents/skills/rt-methodology-selector/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: rt-methodology-selector
+description: "Select the appropriate Red Team testing methodology based on engagement context. Compares PTES, NIST SP 800-115, OWASP WSTG, TIBER-EU, CBEST, and CREST IN-THROUGH-OUT. Configures the engagement methodology in config.user.toml."
+---
+
+# rt-methodology-selector
+
+# Methodology Selection Workflow
+
+## Step 1 — Understand Context
+Ask:
+- What industry/sector is the client? (financial, healthcare, government, tech, etc.)
+- Is there a regulatory requirement driving this test?
+- What is the primary testing domain? (web, infrastructure, mobile, full red team)
+- Is this a compliance test or a genuine security assessment?
+- What is the skill level of the security team being tested?
+
+## Step 2 — Methodology Comparison
+
+Load comparison data from: ./frameworks.csv
+
+### Quick Decision Guide:
+
+| Scenario | Recommended Methodology |
+|----------|------------------------|
+| Web application security test | OWASP WSTG |
+| General penetration test | PTES (7 phases) |
+| Compliance-driven test | NIST SP 800-115 |
+| Financial institution (EU) | TIBER-EU |
+| UK financial institution | CBEST |
+| Enterprise red team | CREST IN-THROUGH-OUT |
+| Mobile application | OWASP MASVS |
+
+## Step 3 — Configure Methodology
+Update: `_rtexit/config.user.toml`
+Set: `methodology = "selected_method"`
+
+## Step 4 — Adapt Phase Structure
+Based on methodology, adjust:
+- Phase names and sequence
+- Required deliverables
+- Report format
+
+## Step 5 — Brief Team
+All agents should know the selected methodology.
+Run: `/rt-party-mode` for a brief war-gaming session on methodology implications.
+
+## Selection Questions
+
+| Question | Why It Matters |
+|---|---|
+| Is this compliance-driven? | NIST, PCI, ISO, and SOC2 reporting needs differ. |
+| Is the target primarily web/API? | OWASP WSTG/API Top 10 gives best coverage. |
+| Is this a financial-sector simulation? | TIBER-EU or CBEST may be required. |
+| Is adversary emulation expected? | MITRE ATT&CK mapping should be central. |
+| Is this a broad penetration test? | PTES provides a general full-lifecycle structure. |
+
+## Output
+
+The skill should produce selected methodology, secondary references, required evidence artifacts, required report sections, and client approvals needed before active testing.
+
+## Example Recommendation
+
+```markdown
+Primary methodology: OWASP WSTG
+Secondary mapping: MITRE ATT&CK + CVSS 4.0
+Reason: Engagement scope is internet-facing web/API testing with executive and technical reporting.
+Required evidence: request/response pairs, screenshots, CVSS vectors, remediation roadmap.
+```

package/packaged-assets/.agents/skills/rt-methodology-selector/frameworks.csv

@@ -0,0 +1,10 @@
+framework,full_name,phases,primary_use,regulatory,domain
+ptes,Penetration Testing Execution Standard,7,General purpose pentesting,None,All
+nist,NIST SP 800-115,5,Compliance-driven testing,FISMA/FedRAMP,All
+owasp_wstg,OWASP Web Security Testing Guide,12 categories,Web application testing,None,Web
+owasp_masvs,OWASP Mobile Application Security,7 categories,Mobile app testing,None,Mobile
+tiber_eu,TIBER-EU Framework,3,EU financial institution red teaming,ECB/EBA,Finance
+cbest,CBEST Framework,4,UK financial institution testing,Bank of England,Finance/UK
+crest,CREST IN-THROUGH-OUT,4,Enterprise red teaming,CREST certification,Enterprise
+kill_chain,Cyber Kill Chain,7,Attack modeling,None,Adversary emulation
+mitre_attack,MITRE ATT&CK,14 tactics,Adversary behavior mapping,None,Threat intelligence

package/packaged-assets/.agents/skills/rt-methodology-selector/workflow.md

@@ -0,0 +1,68 @@
+# Workflow - rt-methodology-selector
+
+## Purpose
+
+This workflow standardizes how $skill is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.
+
+## Authorization Gate
+
+Before execution, confirm:
+
+- SEAD exists and explicitly covers the target asset or activity.
+- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
+- The operator knows the evidence handling rules.
+- Any active or sensitive validation has client approval.
+
+If any item is unclear, pause and invoke 
+
+## Required Inputs
+
+| Input | Source | Notes |
+|---|---|---|
+| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
+| Target asset(s) | Scope document | Must be explicitly approved. |
+| Operator name | Config/user context | Used in timeline entries. |
+| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
+| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |
+
+## Execution Steps
+
+1. Load current engagement configuration.
+2. Read scope, exclusions, and current findings.
+3. Build a small test plan for this skill with target, expected control, and evidence type.
+4. Run the lowest-risk validation first.
+5. Capture baseline behavior before proof behavior.
+6. Record exact timestamp, account/role used, and affected asset.
+7. Stop when evidence is sufficient; avoid unnecessary data access.
+8. Create or update findings through the RTExit finding tracker.
+9. Map remediation owner and recommended timeline.
+10. Add a timeline entry and evidence chain entry.
+
+## Evidence Requirements
+
+| Evidence | Required? | Notes |
+|---|---|---|
+| Command or action summary | Yes | Redact secrets and tokens. |
+| Screenshot or transcript | If useful | Store under evidence folder. |
+| Request/response pair | For web/API | Redact cookies and bearer tokens. |
+| Config excerpt | For cloud/infra | Include only relevant lines. |
+| Business impact note | Yes | Explain why it matters. |
+
+## Autodoc Commands
+
+`ash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-methodology-selector --phase auto --cmd "workflow execution" --output "summary"
+python _rtexit/scripts/finding_tracker.py list
+`
+
+## Completion Criteria
+
+- Scope and authorization are referenced.
+- Evidence is stored and redacted.
+- Findings are added or explicitly marked as not found.
+- Remediation guidance is actionable.
+- Timeline and chain of custody are updated where applicable.
+
+## Handoff
+
+Send confirmed findings to