---
name: agent-instructions
description: "THE AGENT INSTRUCTION HUB — All critical skills and instructions an agent MUST know, in one file. Every agent references this. Other files point here."
---

# RTExit Agent Instructions Hub

> **The single file every RTExit agent reads.** It is the most important reference. All other files (master files, scenarios, tools, sources) point to this one for guidance.

**Read this FIRST in any task. Reference it OFTEN.**

---

## 🚨 4 GOLDEN RULES (MEMORIZE THESE)

### Rule 1: AUTHORIZATION BEFORE ACTION
- ✅ Read SEAD (`docs/sead.md` or `_rtexit-output/data/sead.md`)
- ✅ Read scope (`docs/scope.md`)
- ❌ If SEAD doesn't exist → REFUSE to run any test

### Rule 2: MEMORY IS KING
- ✅ Read `_rtexit-output/data/engagement-context.json` at task start
- ✅ Update it after every action
- ✅ The agent NEVER relies on its own memory

### Rule 3: NO HALLUCINATION
- ❌ Never invent CVEs / bounty amounts / report numbers
- ✅ Verify every CVE in NVD
- ✅ Search sources in SOURCES-MASTER.md when needed

### Rule 4: DOCKER KALI ONLY
- ✅ All commands run in `rtexit-kali` container
- ❌ Never run attack tools on the host

---

## 📚 THE 6 MASTER FILES (Know When to Use Each)

| File | When to Read | Quick Use |
|------|--------------|-----------|
| [SCENARIOS-MASTER.md](SCENARIOS-MASTER.md) | When user has a goal | Map goal → scenarios → tools |
| [SOURCES-MASTER.md](SOURCES-MASTER.md) | When scenario is missing | Search trusted sources |
| [TOOLS-MASTER.md](TOOLS-MASTER.md) | Before running any command | Pick the right tool |
| [AGENT-MEMORY.md](AGENT-MEMORY.md) | At every task start | Read/write state |
| [END-TO-END-ENGAGEMENT.md](END-TO-END-ENGAGEMENT.md) | First time / when lost | Real 14-day example |
| [MASTER-CHECKLIST.md](MASTER-CHECKLIST.md) | Every new engagement | Step-by-step checklist |
| [MASTER-PROMPT.md](MASTER-PROMPT.md) | New chat / new agent | Universal entry prompt |

**Cheat sheet:**
- Don't know what to do? → **MASTER-CHECKLIST.md**
- Don't know which scenario? → **SCENARIOS-MASTER.md**
- Don't know which tool? → **TOOLS-MASTER.md**
- Don't know where you are? → **AGENT-MEMORY.md**
- Can't find a scenario? → **SOURCES-MASTER.md**
- New here? → **END-TO-END-ENGAGEMENT.md**

---

## 🤖 THE 7 MAIN AGENTS (Know Your Role)

| Agent | Role | Skill File |
|-------|------|-----------|
| **Ahmed (Commander)** | Strategy, scope, SEAD, methodology | [.agents/skills/rt-agent-commander/SKILL.md](../../.agents/skills/rt-agent-commander/SKILL.md) |
| **Nour (Scout)** | Recon, OSINT, attack surface mapping | [.agents/skills/rt-agent-scout/SKILL.md](../../.agents/skills/rt-agent-scout/SKILL.md) |
| **Saeed (Breaker)** | Exploitation, vulns discovery | .agents/skills/rt-attack-chain-builder/SKILL.md |
| **Lina (Navigator)** | Mobile, web, cross-platform | .agents/skills/rt-mobile-static-deep/SKILL.md |
| **Yusuf (Ghost)** | Post-exploitation, lateral movement | .agents/skills/rt-post-exploitation/SKILL.md |
| **Hassan (Phantom)** | Social engineering, phishing | .agents/skills/rt-exploit-phishing/SKILL.md |
| **Mariam (Scribe)** | Documentation, reporting | .agents/skills/rt-technical-report/SKILL.md |

When asked to act as one of these, **load their SKILL.md** and adopt that persona.

---

## 📋 PHASES (Know Where You Are)

The engagement moves through these phases. Check `engagement-context.json > engagement.phase`:

| Phase | What Happens | Key Skills |
|-------|-------------|------------|
| **planning** | SEAD, scope, threat model | rt-create-sead, rt-scope-definition, rt-threat-model |
| **recon** | OSINT, subdomain enum, surface map | rt-subdomain-enum, rt-osint, rt-js-analysis, rt-github-recon |
| **exploitation** | Find and exploit vulns | rt-exploit-*, rt-business-logic |
| **post_exploit** | PrivEsc, lateral movement, creds | rt-privilege-escalation, rt-lateral-movement, rt-credential-access |
| **reporting** | Document findings, generate reports | rt-finding-document, rt-technical-report, rt-executive-report |
| **closed** | Engagement done | N/A |

---

## 🛠️ THE TOOL ECOSYSTEM (Quick Reference)

### Docker Kali Container
```bash
# Enter
docker exec -it rtexit-kali bash

# Verify tools
/opt/rt-verify/rt-verify-all.sh

# Output dir
/opt/loot/         # shared with host
/opt/SecLists/     # wordlists
/opt/frida-scripts/
```

### Top 20 Most-Used Tools
| Tool | Use | Container Path |
|------|-----|----------------|
| `nmap` | Port scan | /usr/bin/nmap |
| `sqlmap` | SQLi | /usr/bin/sqlmap |
| `burpsuite` | Web proxy | /opt/burpsuite |
| `nuclei` | Vuln scan | /usr/bin/nuclei |
| `ffuf` | Fuzzing | /usr/bin/ffuf |
| `curl` | HTTP client | /usr/bin/curl |
| `gobuster` | Dir brute | /usr/bin/gobuster |
| `responder` | LLMNR poison | /usr/bin/responder |
| `impacket-*` | AD attacks | /usr/bin/impacket-* |
| `mimikatz` | Cred dump | /opt/mimikatz |
| `metasploit` | Exploit framework | /opt/metasploit-framework |
| `hydra` | Online brute | /usr/bin/hydra |
| `john` | Hash crack | /usr/bin/john |
| `hashcat` | Hash crack | /usr/bin/hashcat |
| `bloodhound-python` | AD recon | /usr/bin/bloodhound-python |
| `certipy` | ADCS | /usr/bin/certipy |
| `evil-winrm` | WinRM | /usr/bin/evil-winrm |
| `aws` | AWS CLI | /usr/bin/aws |
| `pacu` | AWS attack | /opt/pacu |
| `jadx` | APK decompile | /usr/bin/jadx |

Full list: [TOOLS-MASTER.md](TOOLS-MASTER.md)

---

## 🔍 THE SEARCH WORKFLOW (When Scenario Missing)

This is the **most important** workflow to memorize.

```
Can't find a scenario for [TARGET]?
  ↓
1. Read SCENARIOS-MASTER.md (maybe I missed it)
  ↓
2. If still not found, read SOURCES-MASTER.md
  ↓
3. Use WebSearch with the right query:
   - NVD:        "site:nvd.nist.gov [product] [vuln]"
   - HackerOne:  "site:hackerone.com [company] [vuln]"
   - PortSwigger: "site:portswigger.net [topic]"
   - GitHub PoC: "site:github.com PoC CVE-XXXX-XXXXX"
   - Exploit-DB: "site:exploit-db.com [product]"
  ↓
4. Verify the source is real
  ↓
5. Save to local knowledge:
   mkdir -p _rtexit-output/data/intel/
   cat > _rtexit-output/data/intel/CVE-XXXX-XXXXX.md << 'EOF'
   # CVE-XXXX-XXXXX
   Source: [URL]
   Verified: [date]
   Product: [name+version]
   Impact: [description]
   Exploit: [link or command]
   Detection: [command]
   Notes: [analysis]
   EOF
  ↓
6. Add to scenarios.md (if relevant)
  ↓
7. Update SOURCES-MASTER.md (if new source)
  ↓
8. Update engagement-context.json (intel additions)
```

---

## 🧠 THE MEMORY WORKFLOW (Always)

### Read State
```bash
# Read full context
cat _rtexit-output/data/engagement-context.json | jq .

# Specific fields
jq -r '.engagement.phase' _rtexit-output/data/engagement-context.json
jq -r '.findings.total' _rtexit-output/data/engagement-context.json
jq -r '.agent_log[-5:]' _rtexit-output/data/engagement-context.json
```

### Update State
```bash
# Quick update
python3 _rtexit/scripts/init-engagement.py update \
  --agent "[agent-name]" \
  --note "[action description]"

# Update specific field
python3 _rtexit/scripts/init-engagement.py update \
  --field "recon.subdomains_found=47" \
  --agent "scout"
```

### Add Finding
```bash
python3 _rtexit/scripts/finding_tracker.py add \
  --title "..." --severity "critical" --target "..." --cvss 9.8
```

### Log Action
```bash
python3 _rtexit/scripts/autodoc_engine.py log \
  --action "port_scan" --agent "scout" --target "staging.acmecorp.com"
```

---

## 📝 DOCUMENT FINDINGS (Always)

Every finding MUST be documented with:

```markdown
# Finding Template
- ID: F-XXX
- Title: [Concise title]
- Severity: critical | high | medium | low | info
- CVSS: [score] ([vector])
- CWE: [number]
- CVE: [if exists]
- Target: [asset]
- Description: [what is the vuln]
- Impact: [what you get]
- Proof of Concept: [steps to reproduce]
- Evidence: [screenshots, requests]
- Remediation: [immediate, short, long term]
- MITRE ATT&CK: [techniques]
- Status: discovered | verified | reported | fixed
```

Use `rt-finding-document` skill or `finding_tracker.py add`.

---

## 🎯 COMMON QUICK COMMANDS

### Web Application Test
```bash
# Enter Kali
docker exec -it rtexit-kali bash

# Quick recon
subfinder -d target.com -all | httpx -title -tech-detect
nmap -p- -sV -T4 target.com

# Vuln scan
nuclei -u target.com -t nuclei-templates/

# Web app test
burpsuite
sqlmap -u "url" --dbs
```

### AD Test
```bash
# Quick wins first
python3 cve-2020-1472-exploit.py dc01.corp.local
impacket-GetNPUsers corp.local/ -dc-ip dc01.corp.local

# With creds
impacket-GetUserSPNs corp.local/user:pass -dc-ip dc01.corp.local -request
impacket-secretsdump corp.local/admin:pass@dc01.corp.local
```

### Cloud Test
```bash
# AWS
aws sts get-caller-identity
aws s3 ls
python3 ScoutSuite.py aws

# Or pacu
pacu
> import_keys --key-id ... --secret-key ...
> run iam__privesc_scan
```

### Quick Wins (Time-Boxed)
1. S3 bucket enumeration (1 hr)
2. Default credentials (5 min)
3. Zerologon if DC in scope (5 min)
4. LFI (5 min per endpoint)
5. IDOR (30 min for mass dump)
6. OAuth redirect_uri (15 min per app)
7. SQLi with sqlmap (30 min)
8. AWS creds in GitHub (5 min)

---

## 📊 SEVERITY GUIDE (How to Rate)

| Severity | CVSS | Example |
|----------|------|---------|
| **Critical** | 9.0-10.0 | RCE, ATO, full domain takeover |
| **High** | 7.0-8.9 | Privilege escalation, data leak, file read |
| **Medium** | 4.0-6.9 | Stored XSS, SSRF, info disclosure |
| **Low** | 0.1-3.9 | Reflected XSS, missing headers |
| **Info** | 0.0 | Best practice violation |

Use `rt-cvss-calculator` for exact score.

---

## 🔗 INTEGRATION MAP (How Everything Connects)

```
┌─────────────────────────────────────────────────────────────┐
│                  RTExit Framework                            │
├─────────────────────────────────────────────────────────────┤
│  AGENT-INSTRUCTIONS.md  ← YOU ARE HERE                       │
│      ↓                                                        │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  6 Master Files                                       │   │
│  │  ┌──────────────────────────────────────────────┐    │   │
│  │  │  SCENARIOS-MASTER  →  20 skill scenarios.md  │    │   │
│  │  │  SOURCES-MASTER    →  WebSearch             │    │   │
│  │  │  TOOLS-MASTER      →  200+ tools             │    │   │
│  │  │  AGENT-MEMORY      →  engagement-context    │    │   │
│  │  │  END-TO-END        →  14-day walkthrough    │    │   │
│  │  │  MASTER-CHECKLIST  →  Step-by-step          │    │   │
│  │  └──────────────────────────────────────────────┘    │   │
│  └──────────────────────────────────────────────────────┘   │
│      ↓                                                        │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  7 Main Agents (Personas)                            │   │
│  │  Ahmed, Nour, Saeed, Lina, Yusuf, Hassan, Mariam    │   │
│  └──────────────────────────────────────────────────────┘   │
│      ↓                                                        │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  200+ Skills (15 categories)                        │   │
│  │  01-recon, 02-web, 03-api, 04-mobile, 05-cloud,     │   │
│  │  06-active-directory, 07-network, ... 14-reporting  │   │
│  └──────────────────────────────────────────────────────┘   │
│      ↓                                                        │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  200+ Tools in Docker Kali Container                 │   │
│  │  Burp, sqlmap, nuclei, nmap, impacket, mimikatz,    │   │
│  │  metasploit, bloodhound, certipy, aws, pacu, ...    │   │
│  └──────────────────────────────────────────────────────┘   │
│      ↓                                                        │
│  ┌──────────────────────────────────────────────────────┐   │
│  │  Persistent Memory                                    │   │
│  │  _rtexit-output/data/engagement-context.json         │   │
│  │  _rtexit-output/data/intel/                          │   │
│  │  _rtexit-output/docs/                                │   │
│  └──────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────┘
```

---

## 🆘 EMERGENCY: "I DON'T KNOW WHAT TO DO"

**Checklist (in order):**

1. ✅ Docker Kali is running? (`docker ps`)
2. ✅ Read engagement-context.json? (`cat ... | jq .`)
3. ✅ What phase are we in?
4. ✅ What's been done? (look at agent_log)
5. ✅ Read MASTER-CHECKLIST.md? (step-by-step)
6. ✅ Read END-TO-END-ENGAGEMENT.md? (real example)
7. ✅ Try SCENARIOS-MASTER.md (find similar scenario)
8. ✅ Search SOURCES-MASTER.md (if unknown)
9. ✅ WebSearch (only as last resort)
10. ✅ Save new knowledge to `_rtexit-output/data/intel/`

If after all 10 steps you still don't know:
- Ask the user for clarification
- Explain what you tried
- Suggest next steps

**NEVER HALLUCINATE. NEVER MAKE UP DATA.**

---

## 📜 VERSION HISTORY

| Version | Date | Changes |
|---------|------|---------|
| 1.0 | 2026-06-10 | Initial creation with 6 master files + 7 agents |

---

## 🎯 FINAL SUMMARY (1-Page Cheat Sheet)

```
RTExit Quick Reference

→ Docker:  docker exec -it rtexit-kali bash
→ Verify:  /opt/rt-verify/rt-verify-all.sh
→ Output:  /opt/loot/
→ Wordlists: /opt/SecLists/

→ Read context:  cat _rtexit-output/data/engagement-context.json | jq .
→ Update context:  python3 _rtexit/scripts/init-engagement.py update
→ Add finding:    python3 _rtexit/scripts/finding_tracker.py add

→ Don't know what to do?  Read MASTER-CHECKLIST.md
→ Don't know scenario?     Read SCENARIOS-MASTER.md
→ Don't know tool?         Read TOOLS-MASTER.md
→ Don't know where you are? Read AGENT-MEMORY.md
→ Can't find scenario?     Read SOURCES-MASTER.md → WebSearch
→ First time here?         Read END-TO-END-ENGAGEMENT.md
→ New chat / new agent?    Use MASTER-PROMPT.md

→ Severity: critical (9.0-10.0), high (7.0-8.9), medium (4.0-6.9), low (0.1-3.9)
→ CVSS:  use rt-cvss-calculator
→ MITRE: use rt-mitre-map
→ Chain: use rt-attack-chain-builder

→ NEVER: invent CVEs, skip SEAD, test out-of-scope
→ ALWAYS: read context, update context, document findings
```

---

**This file is the cornerstone of RTExit.** Every agent should have it open at all times. Every other file references back to it.

**If you forget everything else, remember the 4 golden rules and the 6 master files.**
