CA Cybersecurity

• medium Broad scope meta-agent-memory-dump identity.md
  Agent memory / workspace files bundled with the skill (1) — likely a workspace dump with personal data or tokens

  identity.md

• low Risky intent intent-offensive-security authorization.md:7
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

  **Contents:** [The Three Questions](#the-three-questions) · [What Counts As Authorization](#what-counts-as-authorization) · [Rules Of Engagement](#rules-of-engagement) · [Fallbacks When Scope Is Missi

  quoted
• low Risky intent intent-offensive-security authorization.md:38
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **Techniques permitted**: exploitation or proof-of-existence only, credential attacks, lateral movement, social engineering, physical, denial of service. Each named, not implied.

• low Risky intent intent-offensive-security authorization.md:107
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  ## Running A Bug Bounty Or VDP

• low Risky intent intent-offensive-security compliance.md:102
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | Annual penetration test | Continuous testing and detection engineering find more | Do both; the annual test is the evidence, the continuous work is the security |

• low Risky intent intent-offensive-security compliance.md:123
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  Write it (`memory-template.md`): the scope boundary, in-scope systems, data classifications and retention minimums in `## Environment`; every audit finding, control gap and remediation as a `## Findin

• low Risky intent intent-offensive-security detection.md:23
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | 2 | EDR telemetry | Execution, persistence and lateral movement on the endpoint |

• low Risky intent intent-offensive-security detection.md:96
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | Credential access on the endpoint: LSASS handle, credential dumping tooling behaviour | EDR | Directly on the objective, not the tool |

• low Risky intent intent-offensive-security forensics.md:28
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **Memory before disk, always**, on any host still running that matters. Memory holds the decrypted payload, the C2 configuration, the process ancestry, and — during a ransomware run — sometimes the 

• low Risky intent intent-offensive-security forensics.md:52
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | Lateral movement out | RDP client artifacts, 3 network logons on the destination, `\\host\c$` access, remote service creation on the target |

• low Risky intent intent-offensive-security incident-response.md:47
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

  **Dwell time is why the window is wide.** Mandiant's M-Trends reports have tracked global median dwell time down into the sub-two-week range, but that median is dominated by ransomware, which announce

  quoted
• low Risky intent intent-offensive-security incident-response.md:65
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  Never as containment: power off (destroys memory and often the encryption keys still resident during a ransomware run), reimage before capture, restore from backup before root cause, or "run the AV sc

• low Risky intent intent-offensive-security memory-template.md:18
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | Recurring cadences: access review, key rotation, restore drill, tabletop, pentest, vendor reassessment, risk-acceptance expiry | `## Due` in `memory.md` | Fixed rows, dates updated |

• low Risky intent intent-offensive-security memory-template.md:128
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Ransomware playbook → `artifacts/playbook-ransomware.md`; read the moment encryption or extortion is suspected

• low Risky intent intent-offensive-security memory-template.md:166
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | SEC-…019 | Build server reachable from the office VLAN on 22 | high | Lateral movement to the signing key | user | 2026-08-12 | open |

• low Risky intent intent-offensive-security network-security.md:40
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | RDP (3389), SSH (22) with password authentication, VNC | Brute-forced and sprayed continuously; a favoured ransomware entry point |

• low Risky intent intent-offensive-security network-security.md:65
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  - **The highest-value segment boundary in most organizations is user-workstation to user-workstation.** Workstations rarely need to talk to each other; blocking SMB and RDP between them removes the la

  detector
• low Risky intent intent-offensive-security network-security.md:68
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Flat networks with a firewall only at the perimeter are the norm and are the reason lateral movement is trivial. Any internal boundary is a substantial improvement over none.

• low Risky intent intent-offensive-security network-security.md:75
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  **Allowing all outbound 443 allows command and control by definition.** Nearly every intrusion needs outbound connectivity; almost nobody constrains it.

• low Risky intent intent-offensive-security program.md:129
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | The pentest as the programme | It samples one path at one moment; findings feed the backlog, they are not the plan |

• low Risky intent intent-offensive-security program.md:137
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  Write it (`memory-template.md`): the current-state picture — crown jewels, systems, trust boundaries, log sources with their retention and gaps — in `## Environment`; every gap as a `## Findings` row 

• low Risky intent intent-offensive-security ransomware.md:1
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  # Ransomware And Extortion

• low Risky intent intent-offensive-security ransomware.md:5
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

  **Before anything**, read `incidents/<year>.md` and any `artifacts/playbook-ransomware.md` the `## Boxes` index in `~/Clawic/data/cybersecurity/memory.md` names — a playbook written calmly beats judge

  quoted
• low Risky intent intent-offensive-security ransomware.md:21
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  9. **Identify the family** from the note, the extension and a sample: ID Ransomware and the No More Ransom project both map notes and extensions to families, and free decryptors exist for a meaningful

• low Risky intent intent-offensive-security ransomware.md:116
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  After the incident, write it (`memory-template.md`): the incident row with awareness timestamp, encrypted scope, stolen-data assessment and outcome in `incidents/<year>.md`; the restore rate and the a

• low Risky intent intent-offensive-security SKILL.md:5
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  description: 'Runs defensive security: alert triage, compromise investigation, attack paths, vulnerability prioritization, detection, and risk reporting. Use when an alert, a suspicious login, a repor

  detector
• low Risky intent intent-offensive-security SKILL.md:55
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  - Deciding what to fix first: scanner output, a pentest report, a bug-bounty submission, an inherited backlog nobody has triaged

  detector
• low Risky intent intent-offensive-security SKILL.md:67
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row)

  | Files encrypted, ransom note, extortion mail with stolen data | Do not reboot; size the encryption and the theft separately; validate a restore before any negotiation | `ransomware.md` |

  table
• low Risky intent intent-offensive-security SKILL.md:71
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  | Scanner output, a pentest report, thousands of CVEs and no plan | KEV / EPSS / exposure gate, then the SLA clock (Rules 4 and 6) | `vulnerabilities.md` |

  detector
• low Risky intent intent-offensive-security SKILL.md:81
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  | "Can I test this?", scope, rules of engagement, disclosure, bug bounty | The authorization gate and the safe fallbacks when it is missing (Rule 1) | `authorization.md` |

  detector
• low Risky intent intent-offensive-security vulnerabilities.md:7
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  **Contents:** [The Gate, In Order](#the-gate-in-order) · [What Each Score Actually Means](#what-each-score-actually-means) · [Exposure Is The Multiplier](#exposure-is-the-multiplier) · [Triaging An In

• low Risky intent intent-offensive-security vulnerabilities.md:87
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  ## Reading A Pentest Report

• low Risky intent intent-offensive-security vulnerabilities.md:89
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **A pentest samples one path at one moment.** Absence of findings is evidence about the test's scope and duration, not about the system. Read the scope and the constraints section first — that is wh

• low Risky intent intent-offensive-security vulnerabilities.md:93
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Findings feed the backlog through the same gate as everything else. A pentest report is not a work plan and must never become the security programme (`program.md`).

• low Risky intent intent-offensive-security vulnerabilities.md:118
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  Write what the triage produced (`memory-template.md`): every finding that will be tracked as a row in `## Findings` with its id, severity, the attack path it removes, owner and due date — never a dupl

  detector

A further 1 matches are quotations in this security skill's documentation and are not counted as findings.