/cross-plugin-pipeline

name: cross-plugin-pipeline
description: |
  This skill should be used when the user mentions "handoff to elliot", "pipeline to elliot", "cross-plugin", "elliot handoff", "transfer to elliot", "handoff package", "generate handoff", "build handoff", "elliot engagement", "pass to elliot", "bridge to elliot", "return flow", "elliot return", "post-exploitation return", "feed back to tyrell", "ingest from elliot", "credential handoff", "target enrichment", "intel handoff", "handoff-builder", "handoff-tracker", "finding correlation", "leak to pentest", "data to exploitation", "breach to engagement", or discusses sending tyrell-acquired data to elliot for active exploitation, building an engagement package from leak intelligence, correlating breach data with pentest targets, enriching elliot's target intel from acquired dumps, generating wordlists from breached credentials, mapping leak data to attack surface, routing protected databases to elliot for exploitation, or receiving post-exploitation data back from elliot to expand tyrell's source intelligence. Always use this skill when the task involves moving data between tyrell and elliot — even if the user says something like "we found credentials, now what?" or "this database needs exploitation" or "send this intel to the pentest team".

Cross-Plugin Pipeline

Bridge between tyrell's passive data acquisition and elliot's active exploitation. tyrell discovers exposed databases, acquires breach data, and extracts intelligence. When targets require active exploitation or acquired credentials need validation against live services, the pipeline packages tyrell's intelligence into an elliot-compatible engagement and routes it for active testing. Post-exploitation, elliot's discoveries flow back to tyrell to expand the intelligence picture.

Pipeline Flow

TYRELL                                              ELLIOT
─────                                              ──────
leak-sources.jsonl ─┐
acquisitions.jsonl  ├─ ENRICH ─ CORRELATE ─ BUILD ─── handoffs/<id>/
dumps/<id>/*.jsonl ─┘     │         │          │         ├─ HANDOFF.md
                          │         │          │         ├─ scope.md
                          │         │          │         ├─ target-intel.jsonl
                          │         │          │         └─ attachments/
                          │         │          │              ├─ wordlist.txt
                          │         │          │              └─ sample-records.jsonl
                          │         │          │
                          │         │          └─ handoff-builder.js create
                          │         └─ Match credentials to services
                          └─ Extract domains, IPs, keys from dumps
                                                        │
                    RETURN FLOW                          │
                    ───────────                          ▼
acquisition-tracker.js add ◄──── elliot post-exploitation data
  --source-plugin elliot          (internal creds, pivots, new targets)

---

Phase 1: Intelligence Enrichment

Before building a handoff, extract maximum value from acquired data. Raw dumps contain far more than credentials — they reveal infrastructure, internal services, cloud keys, and organizational structure.

What to Extract from Dumps

Scan each acquired dump for the following intelligence categories. Use the extraction commands below or analyze manually.

| Category | What to Look For | Example | |----------|-----------------|---------| | **Credentials** | email:password pairs, email:hash pairs, API keys, tokens | `admin@corp.com:P@ssw0rd1` | | **Domains** | Subdomains, internal hostnames, staging environments | `staging.internal.corp.com` | | **IP Ranges** | Internal IPs, server addresses, CIDR blocks in configs | `10.0.0.0/8`, `192.168.1.50` | | **Cloud Keys** | AWS access keys, GCP service accounts, Azure tokens | `AKIA...`, `AIza...` | | **Connection Strings** | Database URIs, LDAP binds, SMTP configs | `mongodb://user:pass@internal:27017/prod` | | **Email Patterns** | Naming conventions, distribution lists, admin accounts | `first.last@corp.com` | | **Service Endpoints** | API URLs, webhook receivers, admin panels | `https://api.corp.com/v2/admin` |

Extraction Commands

Search normalized JSONL dumps for high-value patterns:

# AWS access keys
grep -hoP 'AKIA[A-Z0-9]{16}' dumps/<id>/*.jsonl | sort -u

# Connection strings
grep -hoP '(mongodb|mysql|postgres|redis)://[^\s"]+' dumps/<id>/*.jsonl | sort -u

# Internal IPs (RFC1918)
grep -hoP '(10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+)' dumps/<id>/*.jsonl | sort -u

# Subdomains from email addresses
grep -hoP '@[\w.-]+\.\w+' dumps/<id>/*.jsonl | sed 's/@//' | sort -u

# API keys and tokens (generic patterns)
grep -hoiP '(api[_-]?key|token|secret|authorization)["\s:=]+["\s]*[A-Za-z0-9_\-]{20,}' dumps/<id>/*.jsonl

---

Phase 2: Finding Correlation

Match tyrell's intelligence against elliot's attack surface. This is where passive data turns into actionable attack vectors.

Credential-to-Service Mapping

For each credential set discovered in dumps, identify which live services they target:

| Credential Type | Target Services | Attack Vector | |----------------|----------------|---------------| | `email:plaintext` | Webmail, VPN, SSO, SaaS apps | Credential stuffing / direct login | | `email:md5` | Same services after cracking | Hashcat mode 0, then stuffing | | `email:bcrypt` | Low priority — cracking is slow | Skip unless high-value target | | `username:password` (no @) | SSH, RDP, database logins, admin panels | Direct authentication | | AWS access key + secret | AWS console, CLI, SDK | `aws sts get-caller-identity` to validate | | Database connection string | Internal databases | Direct connection if network path exists |

Correlation Decision Tree

For each credential set in dumps:
│
├─ Are the target service