attack-chainlisted

# Attack Chain Orchestration Skill ## ACTION REQUIRED (execute immediately after reading) 1. `NOW`: Read `../field-journal/precedent-pentest.md` — confirm this skill's operations are authorized routine operations 2. `NOW`: **Create/update the case** (`../scripts/case-init.ps1`) and complete `scope.md` (`../ops/scope-contract.md`); no ACT unless `auth.status=granted` 3. `NOW`: Plan the phases as the **lead** role (`../ops/role-map.md`), writing into specialist_roles 4. `NEXT`: Read `../tool-index.md` to verify tool availability and actual paths 5. `NEXT`: If a tool is missing, call bootstrap — do not guess paths 6. `ACT`: Walk the phase gates per `references/lifecycle-checklist.md`; update `timeline.md` + `workitems.md` each phase (`../ops/timeline-workitem.md`); promote discoveries to Evidence/Finding 7. Wrap-up: the `docs-generator` report must include the Evidence chain > The command center for multi-stage attack-path planning and execution. When a task requires a full chain "from A to B", this Skill orchestrates the phases, coordinates sub-skills, and plans the attack path. > Not "red team only" — any penetration scenario that needs cross-phase composition starts here. --- ## When to Route to This Skill The following scenarios **must** go through this Skill for full-chain planning before being dispatched to the specific sub-skills for execution: | Scenario | Why orchestration is needed | |------|--------------| | "Run a complete penetration test for me" | Requires p