Reattack

What it does

When your agent uses it

• Tasks that involve Root cause analysis

Example prompts

• “/reattack”

Requirements

• Compatibility (from SKILL.md): Finding-scoped. Runs against a fresh checkout of the patch base with the exact gated patch already applied. Needs local build or test commands and network access only to the scrutineer API.
• Pre-approved tools (allowed-tools): Read, Write, Bash, Grep, Glob

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

1. 1Read context.json and remediation.json. If the finding or remediation identifiers are absent, return inconclusive with a precise note.
2. 2Fetch the finding from GET {api_base}/findings/{finding_id} using the bearer token. Establish the original bug class, public entry point…
3. 3Inspect patch.diff and the patched source. Build the narrowest local reproduction that exercises the original sink. Do not use destructive…
4. 4Generate and execute at least three distinct, valid attacker-controlled variants. Vary root-cause-relevant structure rather than…
5. 5Run one benign control that is accepted by the public interface and reaches the original sink without crashing. A control rejected before…
6. 6Classify each candidate
7. 7Set the overall outcome

What it can do on your machine

Read from SKILL.md and the folder at commit 8609afc. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Bash
  • Grep
  • Glob

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are json).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Finding-scoped. Runs against a fresh checkout of the patch base with the exact gated patch already applied. Needs local build or test commands and network access only to the scrutineer API.

  From compatibility in the SKILL.md frontmatter.

Context cost

Reattack loads about 1.4k tokens when it runs. Until then it costs about 57 tokens; SKILL.md has 468 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~57

When it runs · the whole SKILL.md, loaded when a task matches

~1.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Read, Write, Bash, Grep, Glob

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from alpha-omega-security/scrutineer at commit 8609afc, republished under its MIT licence (© alpha-omega-security). 468 words, ~1,382 tokens.

name

reattack

description

Independently re-attack one immutable proposed patch with root-cause variants and a benign control. Records whether the patch resisted the attack, was bypassed at the same sink, or could not be evaluated conclusively.

allowed-tools

Read, Write, Bash, Grep, Glob

compatibility

Finding-scoped. Runs against a fresh checkout of the patch base with the exact gated patch already applied. Needs local build or test commands and network access only to the scrutineer API.

license

MIT

metadata.scrutineer.version

1

metadata.scrutineer.output_file

report.json

metadata.scrutineer.output_kind

reattack

metadata.scrutineer.max_turns

50

metadata.scrutineer.model

high

{
  "outcome": "failed_to_bypass",
  "variants": [
    {
      "name": "encoded separator",
      "input": "%2Fexample",
      "origin": "generated",
      "valid": true,
      "outcome": "blocked",
      "same_bug_class": true,
      "same_sink": true,
      "failure_class": "",
      "sink": "src/parser.go:42",
      "evidence": "The public parser reached the patched length check and returned ErrInvalidLength."
    },
    {
      "name": "repeated separator",
      "input": "//example",
      "origin": "generated",
      "valid": true,
      "outcome": "blocked",
      "same_bug_class": true,
      "same_sink": true,
      "failure_class": "",
      "sink": "src/parser.go:42",
      "evidence": "The public parser reached the patched length check and returned ErrInvalidLength."
    },
    {
      "name": "separator after prefix",
      "input": "safe/../example",
      "origin": "generated",
      "valid": true,
      "outcome": "blocked",
      "same_bug_class": true,
      "same_sink": true,
      "failure_class": "",
      "sink": "src/parser.go:42",
      "evidence": "The public parser reached the patched length check and returned ErrInvalidLength."
    }
  ],
  "benign_control": {
    "input": "valid example",
    "reached_sink": true,
    "crashed": false,
    "evidence": "The public parser reached src/parser.go:42 and returned the expected value."
  },
  "notes": "All three generated variants exercise the same original sink through distinct inputs."
}

© alpha-omega-security, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/reattack of alpha-omega-security/scrutineer.

• SKILL.md
• schema.json

Open the folder on GitHubat commit 8609afc