correlate

SkillSecurity

Run the finding correlation engine to discover attack chains from individual findings.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the correlate skill

What this skill tells your AI

The instructions your AI receives, as published by h-mmer/pentest-agents in .claude/skills/correlate/SKILL.md and read by ahel’s review.

Find attack chains by correlating all known findings.

uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py --compact — show current state
Launch correlator agent: "Analyze ALL findings in brain and findings.json. Find attack chains where one finding enables another. Document each chain with combined CVSS 4.0 and end-to-end reproduction steps."
After agent returns, update brain with discovered chains.
Show the user any new high-impact chains found.

Build a capability graph, not a list of related bugs.

Nodes are capabilities: read tenant data, write config, trigger webhook, steal token, reach internal host, execute workflow.
Edges require evidence that one capability enables the next. Shared component or same endpoint family is only a hint.
Score each chain by final impact, proof reliability, policy safety, duplicate risk, and report clarity.
Prefer chains that convert low-severity feeders into account takeover, tenant escape, stored XSS with privileged action, SSRF to credential disclosure, or config write to execution.
Record killed chains too. The next correlation pass should know which attractive edges failed and why.

Advanced