CD Fabric

• low Risky intent intent-offensive-security Intents/AnalyzeIncident.md:23
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - The Atomic Red Team entries name only techniques from the ATT&CK list. Each entry is a testing objective a defender could run tomorrow: the system or control in this incident to run that technique's

• low Risky intent intent-offensive-security Intents/AnalyzeIncident.md:38
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - Never a manual check presented as an Atomic Red Team test, and never an atomic named that is not certain to exist.

• low Risky intent intent-offensive-security Intents/AnalyzeIncident.md:84
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **Attack type:** {e.g. Ransomware}

• low Risky intent intent-offensive-security Intents/AnalyzeIncident.md:101
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **Atomic Red Team tests:**

• low Risky intent intent-offensive-security Intents/AnalyzeIncident.md:112
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  Any field the source leaves empty reads `Not stated`; a field the source says is absent reads `None (…)`; conflicting reports read as each version with its source. When the source describes too little

  detector
• low Risky intent intent-offensive-security Intents/AnalyzeMalware.md:70
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  # Malware Analysis: {sample, family or campaign}

• low Risky intent intent-offensive-security Intents/AnalyzeThreatReport.md:11
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  - The extraction covers what the principal wants from this input, inferred before a word is written and never asked for. A pasted report, advisory, write-up or dump of report text means every item wor

  detector
• low Risky intent intent-offensive-security Intents/CyberSummary.md:9
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

  - The briefing covers what the principal wants from this input, inferred before a word is written and never asked for. A pasted artifact (a digest, newsletter, advisory, report or feed dump), a file o

  detector
• low Risky intent intent-offensive-security SKILL.md:45
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row)

  | **AnalyzeThreatReport** | "analyze this threat report", "just the trends from this report", "extract the commands from this pentest writeup", `analyze_threat_report`, `analyze_threat_report_cmds`, `

  table
• low Risky intent intent-offensive-security SKILL.md:47
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row)

  | **ReportFinding** | "write a pentest finding for this", "turn this scan output into a report finding", "improve this security finding", `create_report_finding`, `improve_report_finding` | `Intents/R

  table
• low Risky intent intent-offensive-security SKILL.md:58
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row)

  | **ExtractPoc** | "extract the proof of concept", "pull the PoC from this bug bounty report", "what command validates this vulnerability", `extract_poc` | `Intents/ExtractPoc.md` |

  table

A further 1 matches are quotations in this security skill's documentation and are not counted as findings.