Red Team Assessment

{
  "skill_name": "red-team-assessment",
  "evals": [
    {
      "id": 1,
      "name": "redteam-breadth-first-strategy",
      "prompt": "红队评估中你发现了 3 个潜在入口：A) Web应用有一个可能的SQLi B) VPN设备疑似默认密码 C) 邮件服务器SMTP开放relay。你应该先深入A的SQLi，还是先快速测试所有3个？为什么？",
      "expected_output": "先广度优先：快速验证所有3个入口的可利用性（每个30-60分钟），再选择最容易的深入。因为在红队评估时间有限的情况下，优先最大化发现攻击面",
      "expectations": [
        "广度优先|breadth-first|先全部试|快速验证",
        "30分钟|60分钟|时间限制|快速测试",
        "最容易|最有效|选择最佳|再深入",
        "最大化|攻击面|发现|全局视角",
        "时间有限|效率|ROI|资源分配"
      ],
      "required_terms": [
        "ROI",
        "30分钟"
      ]
    },
    {
      "id": 2,
      "name": "redteam-pivot-rule",
      "prompt": "你在一个 Web SQLi 上已经花了 4 个小时（约 3-5 轮尝试），WAF 不断拦截你的 payload，进展缓慢。你应该继续还是换路？理由是什么？",
      "expected_output": "应该换路。3-5 轮无明显进展应立即 pivot 到其他攻击面。红队不是漏洞验证——继续死磕单个点是浪费评估时间",
      "expectations": [
        "换路|pivot|切换|放弃|转向",
        "3-5轮|无进展|多轮失败|时间浪费",
        "其他攻击面|新入口|替代方案",
        "红队|不是漏洞验证|整体评估",
        "效率|时间|有限资源|优先级"
      ],
      "required_terms": [
        "pivot",
        "3-5轮"
      ]
    },
    {
      "id": 3,
      "name": "redteam-phase-time-allocation",
      "prompt": "一个为期 5 天的红队评估项目，你会如何分配各阶段的时间比例？",
      "expected_output": "大致分配：信息收集/OSINT 20%(1天), 初始突破 30%(1.5天), 内网渗透/横向移动 30%(1.5天), 报告/清理 20%(1天)。但信息收集和初始突破可能需要灵活调整",
      "expectations": [
        "信息收集|OSINT|20%|第一阶段",
        "初始突破|入口|30%|1-2天",
        "内网|横向移动|30%|中间阶段",
        "报告|清理|20%|最后阶段",
        "5天|分配|比例|时间规划"
      ],
      "required_terms": [
        "OSINT",
        "20%"
      ]
    }
  ]
}

{
  "skill_id": "red-team-assessment",
  "recall_tests": [
    {
      "id": 1,
      "type": "keyword_positive",
      "description": "核心关键词",
      "keywords": [
        "red team",
        "渗透测试",
        "安全评估"
      ]
    },
    {
      "id": 2,
      "type": "keyword_positive",
      "description": "场景搜索",
      "keywords": [
        "全流程",
        "外网打点",
        "automation",
        "pentest"
      ]
    },
    {
      "id": 3,
      "type": "keyword_negative",
      "description": "不应被CTF召回",
      "keywords": [
        "ctf crypto",
        "ctf pwn"
      ]
    }
  ],
  "llm_tests": [
    {
      "id": 1,
      "name": "red-team-assessment-scenario",
      "scenario": "需要规划一次完整的红队评估行动。请搜索红队评估方法论。",
      "max_rounds": 2,
      "expect_tool_calls": [
        {
          "tool": "list_skills",
          "keyword_contains": "red team|红队|assessment|评估"
        },
        {
          "tool": "read_skill",
          "id": "red-team-assessment"
        }
      ]
    }
  ]
}