triage

Files (1)

• SKILL.md

SKILL.md (first lines)

# Triage - Scalpel Precision Engine

## Overview

Triage does three things:
1. Runs the **Precision Gate** on every finding (5 layers - no exceptions)
2. Scores **KCCG** (Kill Chain Completeness) and enforces severity caps
3. Assigns **SCL IDs**, calculates **SNR / Scalpel Score**, and writes memory updates

Output: `triage.md` in Scalpel format + memory write-back to `~/.akira/memory.json`

---

## Step 1: Load Context

```bash
TARGET=$1
SESSION=~/pentest-toolkit/results/$TARGET/session.json
RESULTS=~/pentest-toolkit/results/$TARGET
MEMORY=~/.akira/memory.json
SIGNALS_FILE=$RESULTS/signals.jsonl

# Get current SCL counter
SCL_COUNTER=$(jq -r '.scalpel.id_counter // 6' $SESSION 2>/dev/null)
YEAR=$(date +%Y)

# Get all findings from report_draft
FINDINGS=$(jq -r '.report_draft.findings' $SESSION 2>/dev/null)

# Read intel from all phases that ran
PHASES_RAN=$(ls $RESULTS/interesting_*.md 2>/dev/null | sed 's/.*interesting_//' | sed 's/\.md//')

# Redteam intel (if redteam phase ran)
if echo "$PHASES_RAN" | grep -q "redteam"; then
  DA_OBTAINED=$(jq -r '.intel_relay.from_redteam.da_credentials_obtained // false' $SESSION 2>/dev/null)
  KILL_CHAIN=$(jq -r '.intel_relay.from_redteam.kill_chain // ""' $SESSION 2>/dev/null)
  LATERAL_HOSTS=$(jq -r '.intel_relay.from_redteam.lateral_movement_hosts[]?' $SESSION 2>/dev/null | tr '\n' ',')
  RT_TECHNIQUES=$(jq -r '.intel_relay.from_redteam.techniques_used[]?' $SESSION 2>/dev/null)
  RT_PERSISTENCE=$(jq -r '.intel_relay.from_redteam.persistence_confirmed // false' $SESSION 2>/dev/null)
  RT_EXFIL=$(jq -r '.intel_relay.from_redteam.exfil_confirmed // false' $SESSION 2>/dev/null)
  echo "Redteam ran: DA=$DA_OBTAINED | persistence=$RT_PERSISTENCE | exfil=$RT_EXFIL"
  echo "Lateral hosts: $LATERAL_HOSTS"
  # Redteam kill chain + DA credentials = auto-Critical if scope valid
  [ "$DA_OBTAINED" = "true" ] && echo "[!] DA credentials confirmed - KCCG 5/5 for domain compromise chain"
fi

# Signal totals from signals.jsonl
TOTAL_SIGNALS=$(wc -l < $SIGNALS_FILE 2>/dev/null | tr -d ' ' || echo 0)
CONFIRMED_SIGNALS=$(grep '"type":"VULN_CONFIRMED"' $SIGNALS_FILE 2>/dev/null | wc -l | tr -d ' ' || echo 0)
echo "Total signals: $TOTAL_SIGNALS | VULN_CONFIRMED: $CONFIRMED_SIGNALS"
```

---

## Step 2: Discover All Phase Summaries

```bash
ls $RESULTS/interesting_*.md 2>/dev/null
cat $RESULTS/interesting_*.md 2>/dev/null
```

Note which phases ran and which are missing. Any phase that ran but is missing from `report_draft.findings[]` needs its interesting_*.md reviewed for overlooked findings.

---

## Step 3: For Each Finding - Run Precision Gate (5 Layers)

Process every entry in `report_draft.findings[]`. For each:

### Layer 1: Authenticity
- Is the HTTP response from the real live target?
- Check: no CDN cache headers (`X-Cache: HIT`, `Age: N`), no staging/test domain indicators
- Check: response body is dynamic (contains real data, not static placeholder)
- FAIL condition: response is a CDN cache hit, or host is `*.staging.*`, `*.test.*`, `*.sandbox.*`

### Layer 2: Reproducibility
- Can the exact same request sequence be replayed with the same result?
- Standard: 2/3 replays must succeed (race conditions: 1/3 minimum)
- FAIL condition: finding only occurred once and cannot be reproduced

### Layer 3: Data Sensitivity
- Is the exposed data actually sensitive?
- PASS: real credentials (verified active), real PII (name+email+address), real DB rows, real RCE output
- FAIL: field name present but value is empty/null/placeholder, dummy data in test fixture, redacted data

### Layer 4: Scope Validity
- Is the vulnerable endpoint within the declared program scope?
- Check: compare endpoint against `session.json program` and known scope
- FAIL: endpoint is on out-of-scope domain, `*.sandbox.*`, CDN origin, third-party service not in scope

### Layer 5: KCCG Threshold
- See KCCG scoring in Step 4

**Precision Gate result:**
- All 5 layers PASS -> `status: "SCALPEL_CERTIFIED"`, assign SCL ID
- 1-2 layers FAIL -> `status: "POTENTIAL"`, document which layers failed and why
- 3+ layers FAIL -> `status: "NOISE"`, exclude from report, log for ATW update

---

## Step 4: KCCG Score (Kill Chain Completeness Graph)

For each finding, evaluate 5 completeness steps:

| Step | What it means | Evidence required |
|------|--------------|-------------------|
| `initial_access` | Entry point found and confirmed reachable | Specific endpoint/parameter that takes attacker input |
| `escalation` | Privilege gained or auth bypassed | Credential extraction, auth token forged, role elevated |
| `data_access` | Real impact demonstrated | PII accessed, credentials verified live, DB rows extracted, RCE output |
| `reproducible` | Chain works on replay | 2/3 replays succeed (race: 1/3) |
| `scope_valid` | Target in declared scope | Endpoint matches program scope definition |

**KCCG score = steps_completed / 5**

**Severity caps:**
- KCCG 1.0 (5/5) - severity as claimed (Critical allowed)
- KCCG 0.8 (4/5) - severity capped at **High** (data_access not yet proven)
- KCCG 0.6 (3/5) - severity capped at **Medium**
- KCCG < 0.6 - severity capped at **Low / Informational**

From kalpmodi/akira, MIT.

More from kalpmodi/akira