Toolchain router

One task, one tool skill. Read this table, open the matching skill, follow it. Do not load several tool skills "just in case": each carries its own OPSEC notes and flag sets, and mixing them produces commands nobody verified.

Route by intent

If the task is…	Open	Why that one
validate credentials, enumerate shares/sessions, dump SAM/LSA/NTDS	netexec	one binary, every protocol, fastest triage
relay NTLM, forge tickets, run a per-service script, dump secrets surgically	impacket	fine-grained control NetExec does not expose
attack AD CS, ESC1-ESC8, request and abuse certificates	certipy	purpose-built for certificate templates
map the domain graph (users, groups, ACLs, sessions)	bloodhound-python	collector for BloodHound analysis
first look at an unknown SMB/LDAP host, no credentials	enum4linux-ng	null-session enumeration without touching auth
interactive shell on a Windows host with WinRM	evil-winrm	pass-the-hash, file transfer, PowerShell
capture NetNTLM hashes from the wire	responder	LLMNR/NBT-NS/mDNS poisoning
get IPv6 hosts to authenticate to you	mitm6	DHCPv6 + WPAD takeover
enumerate or spray usernames through Kerberos pre-auth	kerbrute	no lockout on user enumeration
coerce a machine account to authenticate (PetitPotam style)	coercer	automated coercion method sweep
port and service discovery	nmap	the reference scanner
directory and parameter fuzzing	ffuf or feroxbuster	ffuf for crafted requests, feroxbuster for recursive brute force
template-based vulnerability scanning	nuclei	10k+ maintained templates
subdomain enumeration	subfinder	passive sources
probe HTTP services at scale	httpx	status, title, tech, TLS
fingerprint a web stack	whatweb	CMS and framework signatures
SQL injection	sqlmap	detection through exploitation
crack hashes offline	hashcat (GPU) or john (CPU, formats)	mode coverage vs format coverage
online password spraying against a service	hydra	protocol-aware brute force
extract endpoints and secrets from JavaScript	jsluice	AST-based, not regex
deobfuscate or unbundle JavaScript	webcrack	obfuscator.io, webpack, browserify
capture, replay and diff HTTP(S) traffic	mitmproxy	scriptable proxy plus MCP control
drive a real browser and read its network/CDP data	chrome-devtools	DevTools protocol for agents
tunnel TCP over HTTP or a firewall	chisel	single binary, SOCKS5
build a routed pivot with a TUN interface	ligolo-ng	real routing, no proxychains
send existing traffic through a SOCKS chain	proxychains	wraps any TCP client
implant-based C2 with mTLS and per-session SOCKS	sliver	open-source C2
exploitation framework, payload generation, sessions	metasploit	msfconsole and msfvenom
test an LLM endpoint for jailbreaks, leakage, injection	garak	probe catalogue
audit a model file for malicious pickle code	model-file-audit	picklescan + fickling
map what an agentic app can reach before running it	agentic-radar	static analysis
inventory installed MCP servers, skills, agent configs	snyk-agent-scan	local surface discovery
find which wordlist to use	wordlists	paths and trade-offs
fix the shell itself (zsh, PATH, completions, history)	shell-environment	this machine's shell setup
use the segfault-derived helpers (crt, asnl, io, gssec, sshj)	segfault-cli	small single-purpose CLIs
check what is installed and whether it works	redteam-toolchain	inventory, install, verification
end-to-end web traffic → JS → API workflow	web-traffic-js-reversing	cross-tool sequence
end-to-end AI/LLM target testing	ai-security-testing	cross-tool sequence

Operating rules

1. Confirm the tool exists before promising output. Run redteam-check (or <tool> --version). A skill describes behaviour that requires the binary.
2. Read the skill's OPSEC section before the first command. Each one names the events its actions generate.
3. Stay inside the authorised scope. Example IPs, hostnames and credentials in these skills are placeholders. Scope comes from the engagement, not from documentation.
4. Prefer read-only collection first. Enumeration, then authentication, then execution, then persistence.
5. Record the command, timestamp and raw output for every step that changes a target's state.
6. Do not chain tools the skill did not sanction. If two skills disagree, the more specific one wins; if neither covers the case, stop and ask.

Specialist agents

These are task agents from ~/.omp/agent/agents/, not skills. Dispatch one when the work should run with its own tool allowlist and prompt:

Delegate when…	Agent
the objective is an AD path, not a single command	ad-specialist
the target is a SPA, API capture, or obfuscated bundle	web-reverser
the surface is unmapped and scope is fixed	recon-specialist
a suspected bug needs a deterministic repro	exploit-dev
a plan is noisy, irreversible, or near the scope edge	opsec-reviewer
the target is only reachable from a foothold	pivot-engineer
hashes or passwords must turn into access	credential-operator
an implant or channel is the objective, not a tunnel	c2-operator
the blocker is conceptual and no tool fixes it	consultant

Ambiguous cases

• "Get domain admin" — not a tool. Route to bloodhound-python for the map, then the tool the path needs (certipy, impacket, netexec).
• "Scan the web app" — nuclei for known CVEs, ffuf for content discovery, sqlmap for injection. Run them in that order.
• "Analyse this JS" — webcrack to make it readable, jsluice to extract from it. Never the reverse.
• "Test our chatbot" — ai-security-testing, which dispatches to garak or the agentic tools depending on whether the target is a model endpoint or an agent.

Verification

redteam-check | tail -3        # ok=N missing=0

If a skill's tool is missing, redteam-toolchain has the install command. Do not improvise an install mid-engagement.