ORCHESTRATOR (Engine)
                    |
    +---------------+---------------+
    |               |               |
STRATEGIST      ATTACKER        EVALUATOR
    |               |               |
    +-------+-------+-------+-------+
                    |
                MUTATOR

/adversarial src/auth/
/adversarial --target security src/api/
/adversarial --depth 5 --branches 4 src/

1. RECONNAISSANCE   -> Understand codebase structure, dependencies
2. PROFILING        -> Build defense profile (patterns, safeguards)
3. SOFT_PROBE       -> Gentle analysis attempts
4. ESCALATION       -> Increase analysis intensity
5. EXPLOITATION     -> Active vulnerability search
6. PERSISTENCE      -> Verify findings persist across scenarios

adversarial_config:
  max_turns: 25           # Maximum analysis iterations
  max_tree_depth: 5       # How deep to explore each vector
  branching_factor: 4     # Parallel exploration paths
  pruning_threshold: 0.3  # Score below which to abandon path

  enable_crescendo: true  # Multi-turn escalation
  enable_many_shot: true  # Pattern-based detection
  enable_best_of_n: true  # Generate variations
  best_of_n_count: 5      # Variations per test

id: recon_behavioral
applicable_when:
  turn_range: [1, 3]
  leak_status: ["none"]
attack_sequence:
  - category: direct
    weight: 0.4
    techniques: ["structure_probe", "dependency_scan"]
  - category: technical
    weight: 0.3
    techniques: ["config_analysis", "boundary_test"]

id: credential_hunt
applicable_when:
  defense_level: ["none", "weak"]
attack_sequence:
  - category: direct
    weight: 0.5
    techniques: ["secret_scan", "env_probe"]
  - category: encoding
    weight: 0.3
    techniques: ["base64_secrets", "obfuscated_creds"]

id: trust_boundary
applicable_when:
  defense_level: ["weak", "moderate"]
attack_sequence:
  - category: crescendo
    weight: 0.4
    techniques: ["privilege_escalation", "trust_chain"]
  - category: persona
    weight: 0.3
    techniques: ["identity_bypass", "role_confusion"]

id: input_bypass
applicable_when:
  defense_level: ["moderate", "strong"]
  failed_categories: ["direct"]
attack_sequence:
  - category: encoding
    weight: 0.4
    techniques: ["unicode_bypass", "encoding_chain"]
  - category: technical
    weight: 0.3
    techniques: ["format_injection", "boundary_overflow"]

id: advanced_composite
applicable_when:
  defense_level: ["strong", "hardened"]
  failed_categories: ["direct", "encoding", "persona"]
attack_sequence:
  - category: cot_hijack
    weight: 0.25
    techniques: ["logic_flow_manipulation"]
  - category: crescendo
    weight: 0.25
    techniques: ["multi_step_chain"]
  - category: reasoning_exploit
    weight: 0.25
    techniques: ["algorithm_weakness"]

interface DefenseProfile {
  level: "none" | "weak" | "moderate" | "strong" | "hardened";
  confidence: number;
  observedBehaviors: string[];
  guardrails: {
    type: string;
    strength: number;
    bypassed: boolean;
    bypassMethod?: string;
  }[];
  weaknesses: {
    category: AttackCategory;
    description: string;
    exploitability: number;
  }[];
  safePatterns: string[];
  responsePatterns: {
    pattern: string;
    frequency: number;
    defenseIndicator: boolean;
  }[];
}

interface Finding {
  id: string;
  turn: number;
  timestamp: number;
  extractedContent: string;
  contentType: "vulnerability" | "weakness" | "smell" | "risk" | "unknown";
  technique: string;
  category: AttackCategory;
  confidence: "high" | "medium" | "low";
  evidence: string;
  severity: "critical" | "high" | "medium" | "low";
  verified: boolean;
  recommendation: string;
}

# Adversarial analysis as part of validation
Step 7: VALIDATE
  └── 7a. QUALITY-AUDITOR    (standard)
  └── 7b. GATES              (standard)
  └── 7c. ADVERSARIAL-CODE   (this skill)  <- Invoke for complexity >= 7
  └── 7d. ADVERSARIAL-PLAN   (standard)

Task:
  subagent_type: "security-auditor"
  model: "opus"
  prompt: |
    TARGET_PATH: src/auth/
    ANALYSIS_TYPE: security
    CONFIG:
      max_turns: 25
      enable_crescendo: true
      enable_best_of_n: true

    Perform comprehensive security audit on the target codebase.

# Use codex-cli for second opinion
/codex-cli analyze security --target src/auth/

# Or use gemini-cli for alternative analysis
/gemini-cli search security vulnerabilities in src/auth/

{
  "scan_result": {
    "overall_vulnerability": "medium",
    "overall_score": 65,
    "leak_status": "fragment",
    "findings": [...],
    "defense_profile": {...},
    "recommendations": [...],
    "summary": "Analysis identified 3 potential vulnerabilities..."
  },
  "analysis_tree": {
    "nodes_explored": 47,
    "max_depth_reached": 4,
    "successful_paths": 3
  },
  "strategies_used": [
    "recon_behavioral",
    "credential_hunt",
    "trust_boundary"
  ]
}

# Use security-auditor agent (available)
Task subagent_type=security-auditor model=opus "Perform comprehensive security audit of src/auth/"

# Use codex-cli for cross-validation (available)
/codex-cli analyze security --target src/auth/

# Use gemini-cli for alternative analysis (available)
/gemini-cli search "security vulnerabilities SQL injection XSS" --count 10

# Manual grep-based security scanning
grep -r "eval\|exec\|system\|innerHTML" src/
grep -r "SELECT.*WHERE.*\+" src/  # SQL injection patterns
grep -r "md5\|sha1" src/           # Weak hashing

# Listar todos los reportes de esta skill
ls -lt docs/actions/adversarial/

# Ver el reporte más reciente
cat $(ls -t docs/actions/adversarial/*.md | head -1)

# Buscar reportes fallidos
grep -l "Status: FAILED" docs/actions/adversarial/*.md

source .claude/lib/action-report-lib.sh
start_action_report "adversarial" "Task description"
# ... ejecución ...
complete_action_report "success" "Summary" "Recommendations"