correlate

Agent Skills › H-mmer/pentest-agents › correlate

GitHub

通过关联安全发现项构建能力图，识别攻击链。分析发现间的启用关系，计算组合CVSS评分并提供复现步骤，优先关注高影响场景如账户接管或提权，同时记录失败的关联路径以优化后续分析。

providers/codex/.agents/skills/correlate/SKILL.md H-mmer/pentest-agents

需要发现多个漏洞之间的攻击链评估组合风险及端到端利用路径生成基于能力的攻击图谱

npx skills add H-mmer/pentest-agents --skill correlate -g -y

More Options

Non-standard path

npx skills add https://github.com/H-mmer/pentest-agents/tree/main/providers/codex/.agents/skills/correlate -g -y

Use without installing

npx skills use H-mmer/pentest-agents@correlate

指定 Agent (Claude Code)

npx skills add H-mmer/pentest-agents --skill correlate -a claude-code -g -y

安装 repo 全部 skill

npx skills add H-mmer/pentest-agents --all -g -y

预览 repo 内 skill

npx skills add H-mmer/pentest-agents --list

Frontmatter

{
    "name": "correlate",
    "description": "Run the finding correlation engine to discover attack chains from individual findings."
}

Find attack chains by correlating all known findings.

uv run python3 ../../tools/statusline.py --compact — show current state
Launch correlator agent: "Analyze ALL findings in brain and findings.json. Find attack chains where one finding enables another. Document each chain with combined CVSS 4.0 and end-to-end reproduction steps."
After agent returns, update brain with discovered chains.
Show the user any new high-impact chains found.

Top-Tier Correlation Bar

Build a capability graph, not a list of related bugs.

Nodes are capabilities: read tenant data, write config, trigger webhook, steal token, reach internal host, execute workflow.
Edges require evidence that one capability enables the next. Shared component or same endpoint family is only a hint.
Score each chain by final impact, proof reliability, policy safety, duplicate risk, and report clarity.
Prefer chains that convert low-severity feeders into account takeover, tenant escape, stored XSS with privileged action, SSRF to credential disclosure, or config write to execution.
Record killed chains too. The next correlation pass should know which attractive edges failed and why.