rtexit-method 0.1.0 → 0.1.2

package/packaged-assets/.agents/skills/rt-exploit-auth/workflow.md

@@ -0,0 +1,68 @@
+# Workflow - rt-exploit-auth
+
+## Purpose
+
+This workflow standardizes how $skill is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.
+
+## Authorization Gate
+
+Before execution, confirm:
+
+- SEAD exists and explicitly covers the target asset or activity.
+- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
+- The operator knows the evidence handling rules.
+- Any active or sensitive validation has client approval.
+
+If any item is unclear, pause and invoke 
+
+## Required Inputs
+
+| Input | Source | Notes |
+|---|---|---|
+| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
+| Target asset(s) | Scope document | Must be explicitly approved. |
+| Operator name | Config/user context | Used in timeline entries. |
+| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
+| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |
+
+## Execution Steps
+
+1. Load current engagement configuration.
+2. Read scope, exclusions, and current findings.
+3. Build a small test plan for this skill with target, expected control, and evidence type.
+4. Run the lowest-risk validation first.
+5. Capture baseline behavior before proof behavior.
+6. Record exact timestamp, account/role used, and affected asset.
+7. Stop when evidence is sufficient; avoid unnecessary data access.
+8. Create or update findings through the RTExit finding tracker.
+9. Map remediation owner and recommended timeline.
+10. Add a timeline entry and evidence chain entry.
+
+## Evidence Requirements
+
+| Evidence | Required? | Notes |
+|---|---|---|
+| Command or action summary | Yes | Redact secrets and tokens. |
+| Screenshot or transcript | If useful | Store under evidence folder. |
+| Request/response pair | For web/API | Redact cookies and bearer tokens. |
+| Config excerpt | For cloud/infra | Include only relevant lines. |
+| Business impact note | Yes | Explain why it matters. |
+
+## Autodoc Commands
+
+`ash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-auth --phase auto --cmd "workflow execution" --output "summary"
+python _rtexit/scripts/finding_tracker.py list
+`
+
+## Completion Criteria
+
+- Scope and authorization are referenced.
+- Evidence is stored and redacted.
+- Findings are added or explicitly marked as not found.
+- Remediation guidance is actionable.
+- Timeline and chain of custody are updated where applicable.
+
+## Handoff
+
+Send confirmed findings to 

package/packaged-assets/.agents/skills/rt-exploit-bec/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: rt-exploit-bec
+description: "Business Email Compromise awareness and process-control assessment skill. Requires explicit SEAD authorization and focuses on verification workflows, payment-change resilience, executive impersonation resistance, and remediation."
+---
+
+# rt-exploit-bec - Business Email Compromise Simulation
+
+> This skill is for authorized control assessment only. Do not use real bank details, live fraud infrastructure, or deceptive production-ready templates.
+
+## Overview
+
+BEC testing evaluates whether business processes resist impersonation, urgency pressure, payment redirection, payroll-change requests, and executive authority abuse. The finding is usually not "a user clicked"; it is "the process allowed a high-risk request without independent verification."
+
+## Prerequisites
+
+- SEAD explicitly authorizes BEC simulation.
+- Approved target departments and sample size.
+- Approved sender identity and disclaimers.
+- No real funds, payroll, vendor, or customer changes.
+- Client escalation contact and stop phrase.
+- Post-test notification plan.
+
+## Scenarios For Approval
+
+| Scenario | Control Tested | Sensitive Action Must Be Simulated |
+|---|---|---|
+| Vendor bank detail change | Accounts payable verification | Yes |
+| Payroll direct deposit update | HR identity verification | Yes |
+| Executive urgent purchase | Authority challenge process | Yes |
+| Invoice approval pressure | Finance dual approval | Yes |
+| M&A confidentiality request | Legal/comms escalation | Yes |
+
+## Workflow
+
+1. Define business process and control objective.
+2. Draft simulation artifact with clear internal test tracking.
+3. Obtain client approval for text, timing, recipients, and success criteria.
+4. Execute through approved platform or mailbox.
+5. Measure response: reply, escalation, verification, reporting, unsafe compliance.
+6. Debrief client and produce process-level recommendations.
+
+## Evidence
+
+Capture:
+
+- Approved scenario.
+- Recipient group count.
+- Timeline.
+- Responses by category.
+- Whether out-of-band verification occurred.
+- Whether the event was reported.
+
+Do not publish employee names in executive summaries.
+
+## Remediation
+
+- Require callback verification to known numbers.
+- Add payment-change workflows with dual approval.
+- Harden display-name spoofing controls.
+- Enforce DMARC reject where possible.
+- Train finance/HR/executive assistants with process-specific examples.
+- Add easy suspicious-email reporting.
+
+## Autodoc
+
+```bash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-bec --phase exploitation --cmd "authorized BEC simulation" --output "summary metrics only"
+```
+