75 lines
2.2 KiB
Markdown
75 lines
2.2 KiB
Markdown
# Timeline + WorkItem / Coverage
|
||
|
||
> 可回放作战记录（Z3r0 timeline 思想）+ 覆盖勾选（WorkItem 思想）。
|
||
> 全部落在 **`work/<case>/`**（仓库 gitignore），不进 skill 包正文。
|
||
|
||
## 目录约定
|
||
|
||
```text
|
||
work/<case>/
|
||
scope.md # 契约（ops/scope-contract.md）
|
||
timeline.md # 追加写，禁止改历史条目
|
||
workitems.md # 工作项与覆盖
|
||
evidence/ # 原始产物（截图、pcap、日志）
|
||
notes/
|
||
report/ # 最终报告草稿或拷贝
|
||
```
|
||
|
||
初始化：
|
||
|
||
```powershell
|
||
powershell -File skills\scripts\case-init.ps1 -Hint "full pentest" -CaseName "acme-2026"
|
||
```
|
||
|
||
## timeline.md 格式
|
||
|
||
每条记录 **只追加**：
|
||
|
||
```markdown
|
||
## {ISO-8601} | {role} | {phase}
|
||
- action:
|
||
- command_or_ref:
|
||
- result_summary:
|
||
- artifacts: [] # relative paths under this case
|
||
- evidence_ids: [] # E-xxx when promoted
|
||
- next:
|
||
```
|
||
|
||
**MUST NOT** 删除或改写已有 `##` 时间块（更正用新条目 + `corrects: {timestamp}`）。
|
||
|
||
## workitems.md 模板
|
||
|
||
```markdown
|
||
# Work Items
|
||
|
||
| ID | title | role | targets | surface | status | evidence | notes |
|
||
|----|-------|------|---------|---------|--------|----------|-------|
|
||
| WI-001 | Port scan edge | cie | {ip} | network | done | E-001 | |
|
||
| WI-002 | Auth bypass check | cpe | /api/login | web | blocked | | need creds |
|
||
|
||
status: pending | in_progress | blocked | done | cancelled
|
||
|
||
## Coverage
|
||
- [ ] Recon complete for in_scope assets
|
||
- [ ] Critical/High candidates triaged
|
||
- [ ] Validated findings have Evidence
|
||
- [ ] Path documented (attack/call/solve)
|
||
- [ ] Timeline continuous (no silent gaps >1 major phase)
|
||
- [ ] Report exported via docs-generator
|
||
- [ ] field-journal written (anonymized)
|
||
```
|
||
|
||
## attack-chain / pentest 挂钩
|
||
|
||
| Skill | MUST |
|
||
|-------|------|
|
||
| `attack-chain/` | 多阶段任务创建 case 目录；每阶段结束更新 workitems + timeline |
|
||
| `pentest-tools/` | 每次工具跑批后至少 1 条 timeline；发现 → Evidence 草稿 |
|
||
| 其它 RE skill | 建议 timeline；至少在出报告前补齐 Evidence 链 |
|
||
|
||
## 特色
|
||
|
||
- Agent 友好的纯文本，diff/review 友好
|
||
- 与 tool-index 命令路径可交叉引用
|
||
- 不依赖 WebSocket 直播；需要时把 timeline 贴进报告即可
|