What problem does it solve? Red-team operators often self-throttle during authorized engagements: retracting valid findings after one failed recheck, stopping at the first WAF block, or skipping sister applications that share a vulnerable code template. This Skill corrects those conservative defaults so the engagement actually matches its authorized scope. ## Core Features & Use Cases - Mindset Corrections: Nine concrete corrections covering blocker handling, sister-app sweeps, WAPT-vs-red-team scope discipline, aggressive defaults, persistence through captchas/WAFs/rate limits, and multi-technique cross-validation of findings. - Engagement Checklists: Pre-engagement, during-engagement, and post-engagement checklists plus a per-host sweep cadence (path probing, robots.txt parsing, JS secret grep, API endpoint testing, APK decompilation). - Stop-Condition Discipline: Explicit lists of legitimate versus illegitimate stop conditions, with real failure cases where findings were missed or wrongly retracted. - Use Case: At the start of an authorized external red-team engagement, load this Skill so that when a SQL injection recheck fails mid-test, you investigate the defensive change as a new finding instead of retracting the original one. ## Quick Start Load the redteam-mindset skill at the start of my authorized red-team engagement and apply its discipline rules throughout testing.
