Chat Skills

Chat Skills are on-demand reference documents you inject into the AI agent's context during a live pentest session using the /skill command or the skill picker button. Unlike Agent Skills (which drive classification, phase routing, and tool selection end-to-end), Chat Skills are tactical -- tool playbooks, vulnerability theory, framework-specific notes -- that give the agent instant expertise exactly when you need it.

Table of Contents

1. Agent Skills vs Chat Skills
2. Managing Chat Skills
   • Import from Community
   • Uploading Custom Chat Skills
   • Editing and Deleting Skills
3. Using Chat Skills in the Agent Chat
   • The /skill Command
   • The Skill Picker Button
   • Inline Skill Activation
   • Active Skill Badge
   • Removing the Active Skill
4. Writing a Chat Skill File
5. Default Chat Skills Library
6. Community Chat Skills
7. Complete Skill System Comparison

Agent Skills vs Chat Skills

RedAmon has two distinct skill systems designed for different purposes. Understanding the difference is key to getting the best results from the agent.

Rule of thumb: If your skill defines a step-by-step attack procedure with phases, upload it as an Agent Skill. If it is a reference doc, cheat sheet, or conceptual guide, upload it as a Chat Skill.

For full details on Agent Skills (built-in and user), see Agent Skills.

Managing Chat Skills

Chat Skills are managed from Global Settings (gear icon in the top bar) under the Chat Skills tab.

Import from Community

RedAmon currently ships with 1 reference skill (AD Kill Chain). More Chat Skills will be added over time, and community pull requests are welcome. To add the shipped skill to your library:

1. Navigate to Global Settings > Chat Skills
2. Click Import from Community
3. A confirmation dialog shows how many skills will be imported
4. Skills with the same name as existing ones are automatically skipped (no duplicates)

The library starts empty -- click Import from Community to populate it.

Uploading Custom Chat Skills

1. Navigate to Global Settings > Chat Skills
2. Click Upload Skill (.md)
3. Select your Markdown file
4. Enter a name, optional description, and select a category from the dropdown (general, vulnerabilities, tooling, scan_modes, frameworks, technologies, protocols, coordination)
5. Click Upload

The skill is immediately available via /skill <name> in all your sessions.

Editing and Deleting Skills

Each skill card in the Chat Skills tab shows:

• Skill name and category badge
• Description (or "No description" placeholder)
• Upload date

Actions:

• Pencil icon -- edit the skill's description
• Download -- download the .md file
• Trash icon -- delete the skill from your library

Using Chat Skills in the Agent Chat

The /skill Command

Type /skill followed by the skill name in the chat input:

/skill ssrf
/skill ffuf
/skill nuclei

The skill activates immediately. A badge appears above the input showing the active skill name and category.

You can also combine a skill activation with your message in a single command:

/skill ssrf test for SSRF on the API endpoints

This activates the SSRF skill AND sends "test for SSRF on the API endpoints" as your message -- the agent receives both the skill context and your question together.

Other /skill commands:

The Skill Picker Button

Click the lightning bolt button (next to the send button) to open a dropdown showing all your Chat Skills grouped by category. Click any skill to activate it instantly.

The dropdown also includes two action buttons at the top:

• Import from Community -- bulk-import the shipped reference skills (same as in Global Settings)
• Upload .md -- upload a new skill file directly from the chat (no need to go to Settings)

Inline Skill Activation

You can type /skill anywhere in your message -- not just at the beginning. The autocomplete dropdown will appear as soon as you type /s:

test for /skill ssrf on the login endpoint

When you select a skill from the dropdown, the /skill ssrf part is removed from the text and replaced by the skill activation. Your message becomes:

test for on the login endpoint

With the SSRF skill badge now active above the input.

Active Skill Badge

When a skill is active, a small badge appears above the chat input:

[lightning bolt] SSRF Testing Guide  vulnerabilities  [X]

This badge tells you:

• Which skill is currently active
• Its category
• Click the X to remove it

The active skill persists across messages -- once activated, the skill context is included with every message you send until you change or remove it.

Removing the Active Skill

Three ways to remove the active skill:

1. Type /skill remove in the chat
2. Click the X button on the active skill badge
3. Activate a different skill (replaces the current one)

Writing a Chat Skill File

Chat Skill files are simpler than Agent Skill files. They do not need phase-structured workflows or classification keywords. Write clear, actionable reference content:

---
name: ffuf
description: ffuf fuzzing syntax with matcher/filter strategy and non-interactive defaults.
---

# ffuf CLI Playbook

Canonical syntax:
ffuf -w <wordlist> -u <url_with_FUZZ> [flags]

High-signal flags:
- -u <url> target URL containing FUZZ
- -w <wordlist> wordlist input
- -mc <codes> match status codes
- -ac auto-calibration
- -noninteractive disable interactive console mode

Agent-safe baseline:
ffuf -w wordlist.txt -u https://target.tld/FUZZ -mc 200,301,302,403 -ac -t 20 -noninteractive

Common patterns:
- Basic path fuzzing: ffuf -w wordlist.txt -u https://target.tld/FUZZ -mc 200,301,403 -ac
- Vhost fuzzing: ffuf -w vhosts.txt -u https://target.tld -H 'Host: FUZZ.target.tld' -fs 0

Key differences from Agent Skill files:

• No phase structure needed (no "Phase 1: Reconnaissance", "Phase 2: Exploitation")
• No classification keywords needed (no "When to Classify Here" section)
• Optional YAML frontmatter with name and description
• Focus on reference material: flags, patterns, examples, test vectors

Default Chat Skills Library

These skills ship with RedAmon and can be loaded via the Import from Community button in Global Settings > Chat Skills or directly from the skill picker in the chat.

Active Directory (4 skills)

Cloud (3 skills)

Post-Exploitation (3 skills)

Tooling (9 skills)

Protocols (4 skills)

API Security (1 skill)

Technologies (2 skills)

Frameworks (3 skills)

Vulnerabilities (17 skills)

More skills coming. New reference skills will be added over time, and community contributions are welcome -- open a Pull Request with your .md under agentic/skills/<category>/ and it can ship with the next release. See Share Your Chat Skills with the Community for the full contribution flow.

Community Chat Skills

A growing collection of ready-to-use Chat Skill reference files contributed by the community. Each one is a reference doc you can upload via Global Settings > Chat Skills and inject on demand with /skill <name>.

More reference skills will land here over time. The catalog is intentionally small so every shipped skill is battle-tested. If you have a reference doc (tool playbook, vulnerability theory, framework notes) that has proven useful in your own engagements, please open a PR -- see below.

How to use: Click the skill above, download the .md file, then go to Global Settings > Chat Skills and upload it. Or simply click Import from Community in the Chat Skills tab (or from the skill picker in the chat) to import the shipped skills.

How Chat Skills differ from Community Agent Skills: The Community Agent Skills section lists phase-aware attack workflows (step-by-step procedures the agent follows end-to-end). Community Chat Skills listed here are reference docs -- tool guides, vulnerability theory, framework notes -- designed for on-demand injection, not classification-driven workflows.

See Agent Skills > Community Skills for workflow-style community contributions.

Share Your Chat Skills with the Community

Built a useful reference doc? Share it!

How to contribute:

1. Create your .md file following the Writing a Chat Skill File format
2. Test it in your RedAmon instance by uploading it via Global Settings > Chat Skills
3. Fork the repo and add your .md file to agentic/skills/<category>/
4. Open a Pull Request with a short description

Complete Skill System Comparison

RedAmon has three types of skills. This table compares all three across every dimension:

When to use which

Next Steps

• Agent Skills -- full guide to built-in and user attack workflows
• AI Agent Guide -- the AI agent chat interface, phases, and tools
• Global Settings -- configure LLM providers, API keys, and skills