correlate

Agent Skills › H-mmer/pentest-agents › correlate

correlate

GitHub

通过关联引擎分析安全发现，构建能力图谱以识别攻击链。该技能旨在将独立漏洞转化为高影响攻击路径，如账户接管或权限提升，并评估风险与证据可靠性。

.claude/skills/correlate/SKILL.md H-mmer/pentest-agents

Trigger Scenarios

需要分析多个安全发现的关联性意图识别潜在的攻击链条和组合漏洞利用

Install

npx skills add H-mmer/pentest-agents --skill correlate -g -y

More Options

Non-standard path

npx skills add https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/correlate -g -y

Use without installing

npx skills use H-mmer/pentest-agents@correlate

指定 Agent (Claude Code)

npx skills add H-mmer/pentest-agents --skill correlate -a claude-code -g -y

安装 repo 全部 skill

npx skills add H-mmer/pentest-agents --all -g -y

预览 repo 内 skill

npx skills add H-mmer/pentest-agents --list

SKILL.md

Frontmatter

{
    "name": "correlate",
    "description": "Run the finding correlation engine to discover attack chains from individual findings.",
    "disable-model-invocation": false
}

Find attack chains by correlating all known findings.

uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py --compact — show current state
Launch correlator agent: "Analyze ALL findings in brain and findings.json. Find attack chains where one finding enables another. Document each chain with combined CVSS 4.0 and end-to-end reproduction steps."
After agent returns, update brain with discovered chains.
Show the user any new high-impact chains found.

Top-Tier Correlation Bar

Build a capability graph, not a list of related bugs.

Nodes are capabilities: read tenant data, write config, trigger webhook, steal token, reach internal host, execute workflow.
Edges require evidence that one capability enables the next. Shared component or same endpoint family is only a hint.
Score each chain by final impact, proof reliability, policy safety, duplicate risk, and report clarity.
Prefer chains that convert low-severity feeders into account takeover, tenant escape, stored XSS with privileged action, SSRF to credential disclosure, or config write to execution.
Record killed chains too. The next correlation pass should know which attractive edges failed and why.