rtexit-method 0.1.0 → 0.1.2

package/packaged-assets/.agents/skills/rt-exploit-ios/workflow.md

@@ -0,0 +1,68 @@
+# Workflow - rt-exploit-ios
+
+## Purpose
+
+This workflow standardizes how $skill is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.
+
+## Authorization Gate
+
+Before execution, confirm:
+
+- SEAD exists and explicitly covers the target asset or activity.
+- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
+- The operator knows the evidence handling rules.
+- Any active or sensitive validation has client approval.
+
+If any item is unclear, pause and invoke 
+
+## Required Inputs
+
+| Input | Source | Notes |
+|---|---|---|
+| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
+| Target asset(s) | Scope document | Must be explicitly approved. |
+| Operator name | Config/user context | Used in timeline entries. |
+| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
+| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |
+
+## Execution Steps
+
+1. Load current engagement configuration.
+2. Read scope, exclusions, and current findings.
+3. Build a small test plan for this skill with target, expected control, and evidence type.
+4. Run the lowest-risk validation first.
+5. Capture baseline behavior before proof behavior.
+6. Record exact timestamp, account/role used, and affected asset.
+7. Stop when evidence is sufficient; avoid unnecessary data access.
+8. Create or update findings through the RTExit finding tracker.
+9. Map remediation owner and recommended timeline.
+10. Add a timeline entry and evidence chain entry.
+
+## Evidence Requirements
+
+| Evidence | Required? | Notes |
+|---|---|---|
+| Command or action summary | Yes | Redact secrets and tokens. |
+| Screenshot or transcript | If useful | Store under evidence folder. |
+| Request/response pair | For web/API | Redact cookies and bearer tokens. |
+| Config excerpt | For cloud/infra | Include only relevant lines. |
+| Business impact note | Yes | Explain why it matters. |
+
+## Autodoc Commands
+
+`ash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-ios --phase auto --cmd "workflow execution" --output "summary"
+python _rtexit/scripts/finding_tracker.py list
+`
+
+## Completion Criteria
+
+- Scope and authorization are referenced.
+- Evidence is stored and redacted.
+- Findings are added or explicitly marked as not found.
+- Remediation guidance is actionable.
+- Timeline and chain of custody are updated where applicable.
+
+## Handoff
+
+Send confirmed findings to 

package/packaged-assets/.agents/skills/rt-exploit-iot/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: rt-exploit-iot
+description: "IoT and firmware security assessment skill for authorized device, firmware, protocol, and management-plane review. Covers firmware triage, interface inventory, communication security, update integrity, secrets handling, and remediation."
+---
+
+# rt-exploit-iot - IoT and Firmware Assessment
+
+> Use only with client-owned devices, approved lab firmware, or explicitly authorized test environments. Radio-frequency, safety-impacting, or production device testing requires separate written authorization.
+
+## Overview
+
+IoT security assessment combines hardware inventory, firmware review, protocol analysis, cloud/API review, and operational safety. This skill helps operators evaluate device risk without damaging devices or interfering with production operations.
+
+## Prerequisites
+
+- Device model, serial policy, and firmware version.
+- Ownership and test authorization.
+- Lab network separated from production.
+- Safety constraints for power, radio, mechanical, or industrial functions.
+- Approved data handling for captured traffic and firmware images.
+
+## Skill Levels
+
+| Level | Activities |
+|---|---|
+| BEGINNER | Device inventory, exposed service review, default configuration checks. |
+| INTERMEDIATE | Firmware extraction triage, secrets search, TLS review. |
+| ADVANCED | Protocol state review, update mechanism analysis, cloud/API chaining. |
+| EXPERT | Hardware debug interface analysis and architecture-level remediation. |
+
+## Workflow
+
+### Step 1 - Device Profile
+
+Record vendor, model, firmware version, interfaces, companion app, cloud endpoints, account roles, and physical access level.
+
+### Step 2 - Interface Inventory
+
+Assess:
+
+- Ethernet/WiFi/Bluetooth/Zigbee/NFC/RFID.
+- USB/UART/JTAG/SWD where authorized.
+- Web administration panels.
+- Mobile app/API pairings.
+- MQTT/CoAP/HTTP/WebSocket protocols.
+
+### Step 3 - Firmware Review
+
+Review firmware safely:
+
+- Version metadata.
+- Hardcoded credentials or API endpoints.
+- Private keys or certificates.
+- Update signatures and rollback protections.
+- Startup scripts and services.
+- File permissions and exposed debug functions.
+
+### Step 4 - Communication Security
+
+Validate:
+
+- TLS usage and certificate validation.
+- Sensitive data over cleartext channels.
+- Device identity and enrollment.
+- Replay resistance for commands.
+- Cloud API authorization.
+
+### Step 5 - Management Plane
+
+Review default passwords, forced password change, account lockout, local admin exposure, firmware update workflow, logging, and recovery mode.
+
+## Evidence
+
+Use photos only if approved. Store firmware hashes, version strings, traffic summaries, redacted endpoint lists, and screenshots of configuration issues.
+
+## Remediation
+
+- Unique per-device credentials.
+- Signed firmware updates and rollback prevention.
+- Secure boot where hardware supports it.
+- Certificate validation and modern TLS.
+- Disable debug interfaces in production.
+- Network isolation for device fleets.
+- Secure provisioning and decommissioning.
+
+## Autodoc
+
+```bash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-iot --phase exploitation --cmd "IoT assessment evidence summary" --output "firmware/version/control findings"
+```
+

package/packaged-assets/.agents/skills/rt-exploit-iot/workflow.md

@@ -0,0 +1,68 @@
+# Workflow - rt-exploit-iot
+
+## Purpose
+
+This workflow standardizes how $skill is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.
+
+## Authorization Gate
+
+Before execution, confirm:
+
+- SEAD exists and explicitly covers the target asset or activity.
+- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
+- The operator knows the evidence handling rules.
+- Any active or sensitive validation has client approval.
+
+If any item is unclear, pause and invoke 
+
+## Required Inputs
+
+| Input | Source | Notes |
+|---|---|---|
+| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
+| Target asset(s) | Scope document | Must be explicitly approved. |
+| Operator name | Config/user context | Used in timeline entries. |
+| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
+| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |
+
+## Execution Steps
+
+1. Load current engagement configuration.
+2. Read scope, exclusions, and current findings.
+3. Build a small test plan for this skill with target, expected control, and evidence type.
+4. Run the lowest-risk validation first.
+5. Capture baseline behavior before proof behavior.
+6. Record exact timestamp, account/role used, and affected asset.
+7. Stop when evidence is sufficient; avoid unnecessary data access.
+8. Create or update findings through the RTExit finding tracker.
+9. Map remediation owner and recommended timeline.
+10. Add a timeline entry and evidence chain entry.
+
+## Evidence Requirements
+
+| Evidence | Required? | Notes |
+|---|---|---|
+| Command or action summary | Yes | Redact secrets and tokens. |
+| Screenshot or transcript | If useful | Store under evidence folder. |
+| Request/response pair | For web/API | Redact cookies and bearer tokens. |
+| Config excerpt | For cloud/infra | Include only relevant lines. |
+| Business impact note | Yes | Explain why it matters. |
+
+## Autodoc Commands
+
+`ash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-iot --phase auto --cmd "workflow execution" --output "summary"
+python _rtexit/scripts/finding_tracker.py list
+`
+
+## Completion Criteria
+
+- Scope and authorization are referenced.
+- Evidence is stored and redacted.
+- Findings are added or explicitly marked as not found.
+- Remediation guidance is actionable.
+- Timeline and chain of custody are updated where applicable.
+
+## Handoff
+
+Send confirmed findings to