coverage

Files (1)

• SKILL.md

SKILL.md (first lines)

# Coverage

Systematic thoroughness: which phase items and applicable vuln classes have NOT been done.
Coverage now lives in the plan board (`targets/<eng>/Approach.md`), not a separate file.

## Read the board
```
cat targets/<active>/Approach.md
python3 scripts/next_move.py      # ranks [gap] test moves from the 4a table + findings + Deadends
```
- Phase items still `[ ]` (todo) or `[~]` (doing) are the open work, in kill-chain order.
- The `### 4a` table is the per-asset coverage matrix: one row per (asset, vuln class); a row
  counts as tested when its `status` cell is `[x]`/done. Any applicable class with no done row
  on an in-scope asset is a gap. `next_move.py` surfaces these as `[gap]` moves.

## Then (model)
1. For each asset, the untested applicable classes ARE the to-do. Prioritise by impact + the
   `[gap]`/`[now]` moves from `next_move.py` (fingerprint-targeted).
2. Pull payloads from `wiki/payloads/<class>` for each untested class (or `Skill(arsenal)`).
3. After testing a class on an asset, **add a `### 4a` row to `Approach.md`** with the class,
   the tool/payload, `status` `[x]`, and the `poc/` image (GATE 2). Otherwise the gap recurs.
4. A phase is done only when every applicable item is `[x]` or `[-]` (n/a) or `[!]` (deadend).

## Discipline
- Respect scope: out-of-scope assets are excluded by `next_move.py`.
- "Done" means tested, not necessarily clean - record findings separately as FINDs.
- Don't mark a row `[x]` without actually testing it and capturing a `poc/` image; this
  checklist only helps if honest.

From Encod3d-Sec/TORCH, MIT.

More from Encod3d-Sec/TORCH