---

name: cyber-exercise description: "Run a bounded cybersecurity exercise workflow with authorization, runtime, control, evidence, and independent adjudication gates; supports safe offline planning when live controls are unavailable." metadata: internal: true triggers: keywords: - cyber exercise - workflow

Cyber Exercise Skill

[!IMPORTANT] Run a bounded cybersecurity exercise workflow with authorization, runtime, control, evidence, and independent adjudication gates; supports safe offline planning when live controls are unavailable.

Optional args: slug=, ticket=<id/url>, mode=interactive|autonomous|channel, channel=, auto_continue=true|false, profile=business|hybrid|technical.

Instructions

When the user asks to perform this workflow, execute the following steps:

Cyber Exercise

Goal: coordinate an authorized, evidence-led exercise without treating white-team control as compliance certification or host enforcement.

Steps

1. Plan: Load cyber-engagement-planning; define objective, scope, exclusions, roles, synthetic-data boundary, evidence owner, expiry, stop, and restart terms.
2. Authorize: Load cyber-authorization; bind engagement_scope_ref, approved actions, exclusions, window, approver, and runtime support.
3. Preflight: Check tool, credential, filesystem, network, logging, and cancellation controls. If unsupported, mark live lane BLOCKED and continue offline plan/evidence review only.
4. Control: Load cyber-exercise-control; release injects, log decisions, stop on expiry/drift/unsafe impact, and require fresh gates before restart.
5. Validate: Load cyber-scoped-validation; validate one bounded claim using synthetic or explicitly authorized observations. Never use offensive scripts, real targets, credentials, malware, or exfiltration.
6. Adjudicate: Load cyber-exercise-adjudication; compare redacted evidence with independently held ground truth. Preserve confirmed, suspected, blocked, not-tested, and false-positive statuses.
7. Report: Load cyber-evidence; update artifacts/security-review.md when a continuous security-review chain exists. Add sparse framework edges only with primary sources and review status.

Runtime Contract

Host runtime enforces tools, credentials, filesystem/network scope, logging, and cancellation. Markdown records intent and evidence; it cannot enforce permissions. Missing runtime support blocks live action, not safe offline planning.

Handoff Payload

• engagement_scope_ref, objective, scope/exclusions, authorization window, runtime support
• control log, evidence records, independent ground-truth reference, finding statuses
• artifacts/security-review.md when in scope, mapping edges, limitations, accountable owner
• feature_status, completed_evidence, missing_evidence, decision_needed, recommended_next_workflow

Blocking Questions

• Is authorization current, explicit, and bounded to this action?
• Which runtime controls are host-enforced, and which are unsupported?
• Who independently holds ground truth and adjudicates outcomes?

Output Template

# Cyber Exercise Report: [name]
## Scope and Authorization
## Runtime Contract
## Control Log
## Evidence and Findings
## Independent Adjudication
## Framework Edges
## Limitations and Decisions
## Outcome Report
feature_status: implemented | partially_implemented | blocked
completed_evidence: []; missing_evidence: []; decision_needed: []; recommended_next_workflow: verify-work
## Next Workflow
verify-work