correlate

Agent Skills › H-mmer/pentest-agents › correlate

correlate

GitHub

运行关联引擎，通过关联所有已知发现来识别攻击链。构建能力图而非简单列表，要求证据支持能力间的启用关系，评估综合CVSS评分及风险，优先发现高影响链条（如账户接管），并记录被阻断的链条以供后续分析。

.claude/skills/correlate/SKILL.md H-mmer/pentest-agents

Trigger Scenarios

需要分析多个安全发现之间的逻辑关联以识别复杂攻击路径时希望从独立漏洞中提炼出端到端的完整攻击链场景时进行深度安全审计，需评估漏洞组合带来的叠加风险时

Install

npx skills add H-mmer/pentest-agents --skill correlate -g -y

More Options

Non-standard path

npx skills add https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/correlate -g -y

Use without installing

npx skills use H-mmer/pentest-agents@correlate

指定 Agent (Claude Code)

npx skills add H-mmer/pentest-agents --skill correlate -a claude-code -g -y

安装 repo 全部 skill

npx skills add H-mmer/pentest-agents --all -g -y

预览 repo 内 skill

npx skills add H-mmer/pentest-agents --list

SKILL.md

Frontmatter

{
    "name": "correlate",
    "description": "Run the finding correlation engine to discover attack chains from individual findings.",
    "disable-model-invocation": false
}

Find attack chains by correlating all known findings.

uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py --compact — show current state
Launch correlator agent: "Analyze ALL findings in brain and findings.json. Find attack chains where one finding enables another. Document each chain with combined CVSS 4.0 and end-to-end reproduction steps."
After agent returns, update brain with discovered chains.
Show the user any new high-impact chains found.

Top-Tier Correlation Bar

Build a capability graph, not a list of related bugs.

Nodes are capabilities: read tenant data, write config, trigger webhook, steal token, reach internal host, execute workflow.
Edges require evidence that one capability enables the next. Shared component or same endpoint family is only a hint.
Score each chain by final impact, proof reliability, policy safety, duplicate risk, and report clarity.
Prefer chains that convert low-severity feeders into account takeover, tenant escape, stored XSS with privileged action, SSRF to credential disclosure, or config write to execution.
Record killed chains too. The next correlation pass should know which attractive edges failed and why.