correlate

$npx mdskill add H-mmer/pentest-agents/correlate

Discover attack chains by correlating findings to enhance security

  • Identify and analyze relationships between individual findings to uncover potential attack paths.
  • Depends on the statusline tool for current state monitoring and the correlation engine for finding attack chains.
  • Decides what to do based on evidence linking one finding enabling another, considering factors like impact, reliability, safety, and clarity of reporting.
  • Delivers newly discovered attack chains to users in a clear, actionable format.

SKILL.md

.github/skills/correlateView on GitHub ↗
---
name: correlate
description: "Run the finding correlation engine to discover attack chains from individual findings."
disable-model-invocation: false
---
Find attack chains by correlating all known findings.

1. `uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py --compact` — show current state
2. Launch `correlator` agent: "Analyze ALL findings in brain and findings.json. Find attack chains where one finding enables another. Document each chain with combined CVSS 4.0 and end-to-end reproduction steps."
3. After agent returns, update brain with discovered chains.
4. Show the user any new high-impact chains found.

## Top-Tier Correlation Bar

Build a capability graph, not a list of related bugs.

- Nodes are capabilities: read tenant data, write config, trigger webhook, steal token, reach internal host, execute workflow.
- Edges require evidence that one capability enables the next. Shared component or same endpoint family is only a hint.
- Score each chain by final impact, proof reliability, policy safety, duplicate risk, and report clarity.
- Prefer chains that convert low-severity feeders into account takeover, tenant escape, stored XSS with privileged action, SSRF to credential disclosure, or config write to execution.
- Record killed chains too. The next correlation pass should know which attractive edges failed and why.

More from H-mmer/pentest-agents

SkillDescription
analyzeAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
auth-testerAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.
autopilotAutonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
brainCentral knowledge coordinator. Use BEFORE launching any other pentest agent to get context on what's already been tried. Also use AFTER any agent completes to record findings, exhausted vectors, and learned patterns. The brain prevents redundant work across sessions and agents.
browser-agentBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.
browser-stealth-agentStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
browser-verifierMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
business-logicBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.
chainBuild deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
chain-builderDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.