writing-offensive-skills

# Writing Offensive Skills ## Overview Conventions for authoring skills in this repo so the dispatcher can find them and operators can trust them. This adapts superpowers' skill conventions to offensive security. **REQUIRED BACKGROUND:** superpowers:writing-skills (the general conventions) and superpowers:test-driven-development (skills are tested like code — baseline failure first). ## Description = triggers only The `description:` field decides whether the dispatcher loads the skill. Write **`Use when…`** triggering conditions and symptoms ONLY — never summarize the skill's workflow (a workflow summary makes Claude follow the description instead of reading the skill). ```yaml # BAD (summarizes workflow): description: Recon skill that enumerates subdomains then scans ports # GOOD (triggers only): description: Use when mapping a target's external attack surface — subdomains, hosts, exposed services ``` Third person, technology-specific only if the skill is. Verb-first / gerund names. ## Skill layout (progressive disclosure) ``` skills/<name>/ SKILL.md # thin router, <=180 lines references/ # per-technique deep-dives (theory + 2024-2026 + code + detection + OPSEC) scripts/ # runnable tooling (no placeholders) ``` **Domain (technique) skill** SKILL.md sections, in order: frontmatter → When to Activate → **Technique Map** (Technique | ATT&CK Txxxx | CWE | reference | script) → Quick Start → **OPSEC & Detection** table → Deep Dives (lin...