⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate

Before any probe, evasion, source-IP change or credential-related request, collect the exact target URL, IP, account, or resource, written authorization and permitted scope; show the exact command and expected effect. Wait for explicit confirmation in the current conversation. Otherwise review existing evidence only. Unexpected blocks/lockouts trigger the engagement stop/contact procedure, not automatic evasion. Bound requests, account attempts, timing and cost; never test unrelated accounts or change tenant policies.

When to use this skill

Trigger when:

Running active testing against a target with active SOC monitoring
A confirmed-vulnerable finding stops reproducing on recheck
Baseline timing shifts unexpectedly (3× slower, sudden errors, new headers)
Response sizes change between test windows
New WAF cookies or headers appear that weren't there at session start
Lockout / error rates change between test windows (especially LOCKED count for credential attacks)
Engagement is "assume breach" or "white box" — client knows you're testing

mid-engagement-ir-detection

Mandatory confirmation gate

When to use this skill