RedAmon plugin
Skiller
Turns a finished chat session into a better attack playbook or a better version of your own skill, for you to approve.
Learns from an agent chat session and proposes a better, session-agnostic version of a skill it used. Nothing changes until a person approves it.
The guide is also on the RedAmon GitHub wiki.
- Latest version
- 1.1.0
- Works with
- RedAmon plugin platform 1.1.0 or newer, below 2.0.0
- Permissions
- Read chat sessions
- Use a language model
- Propose agent instructions
- override:user_skill.text
- Plugin id
- skiller
- Model calls per run
- 2 to 4, on the model you choose
- Run time
- A background job of at most 10 minutes
- What it keeps
- Nothing from the session, only the proposal
- Applies to
- Built-in skills: every project you own. Your own skills: a new skill, used where you switch it on
What it does
Playbooks tuned by your own engagements
After the agent has worked on a target, Skiller reads that finished session, works out what would have made a skill the agent used reach a correct result sooner or avoid a mistake, and proposes a new version of it: a built-in attack playbook or, since 1.1.0, one of your own skills.
You read the proposal side by side with the current text and approve or reject it. Nothing changes until you approve. A built-in skill can go back to the factory text at any moment; a version of your own skill is saved as a new skill, and the original is never changed.
- v1
The factory playbook RedAmon ships.
- v2
v1 plus the lessons of one session you approved.
- v3
Built on v2 from the next session, and so on.
It edits, it never rewrites
A proposal is a handful of small changes anchored on sentences of the current playbook. Structure, headings, numbering and tone stay as they are.
It is session-agnostic
A playbook runs against every future target, so no host, address, URL, path, parameter, credential or flag from the session may enter it.
A person decides
Skiller only proposes. It cannot approve its own proposal, and RedAmon lets no plugin write the text the agent runs.
The 14 built-in skills it improves, and your own
- CVE (MSF)
- Credential Testing
- Social Engineering Simulation
- Availability Testing
- SQL Injection
- Cross-Site Scripting
- Server-Side Request Forgery
- Remote Code Execution
- Insecure Deserialization
- Path Traversal / LFI / RFI
- Broken Access Control
- HTTP Request Smuggling / Desync
- XML External Entity
- Cryptographic Attacks
Since 1.1.0 it also improves your own skills: the .md workflows you upload in Global Settings, community skills you imported included. Chat Skills are not changed.
Using it
From a finished chat to an approved version
- 1
Start it from a finished chat
In the chat's gear menu, Skiller's group offers Improve skill from this session. RedAmon's skill picker lists the skills the agent used there, built-in and your own, with the turns each got; pick one and start.
- 2
Follow the job
A job window names the skill and the version the agent runs, then moves through three stages: reading the session, writing the new version, saving the proposal.
- 3
Review the proposal
RedAmon's own review window shows v1 against v2, one tab per changed part, side by side or unified, with risky lines flagged. Approve, reject or decide later. For your own skill it offers Save as new skill, named v2 by default, and can use it in the project instead of the old one.
- 4
The agent uses it
From the next message, in every project you own. Each skill in a project's settings shows which version governs it, with Versions and Reset to factory next to it.
Under the hood
Code first, two model calls
A few steps of plain code, two model calls, and code checks on everything the model writes. Every refusal that needs no model comes first, so a session that cannot produce a proposal never costs you a model call.
- 1
Read the session
Through RedAmon, with credentials masked. Refused while the agent is still working.
- 2
Pick the skill
The one you picked, else the skill that was really in the agent's prompt for the most turns, with at least three turns and one tool call.
- 3
Read the current version
Edits always build on the version the agent runs now, so v3 carries the changes of v2.
- 4
Build a digest
Facts, signals computed in code (failures, repeats, your corrections) and a timeline, fenced as untrusted data.
- 5 model call
Diagnose
General lessons in the form: when a situation arises, do this, because of that. Lessons naming anything from the session are dropped.
- 6 model call
Edit
The smallest anchored edits that apply the lessons: insert before or after a sentence, replace it, or append.
- 7
Check every edit in code
Anchors, size limits, placeholders and a leak guard, with one repair round. Edits that still fail are dropped.
- 8
Propose a snapshot
A complete new version goes to RedAmon, which validates it again with the agent's own validator and stores it for your review.
Prompt injection
Why a target cannot write your playbook
A pentest session is full of text written by the target, and some of it may be written on purpose to manipulate an AI. Skiller is built so that such text cannot reach the agent's playbook, in layers.
- Layer 1
Fenced input
The session digest sits inside a randomly marked fence, and the model is told never to follow instructions found in it.
- Layer 2
General lessons only
Skiller collects every session value (hosts, addresses, URLs, paths, parameters, tokens, flags) and drops any lesson that contains one.
- Layer 3
A code guard on every added line
Added text may not name a session value, a new tool or location, tell the agent to send data out, or relax scope, Rules of Engagement or a confirmation step.
- Layer 4
RedAmon's own validation
The agent's validator checks the proposal when it is stored and again when it is approved.
- Layer 5
Your review
Risky lines are flagged, and the scope the version applies to is stated in plain words.
- Layer 6
Re-checked at every use
The agent checks the approved text again each turn and falls back to the factory text when a check fails.
Accepted by an admin at install
What it may do
Read chat sessions
session:readReads the agent chat session it is run on, including the target data in it. Credential-shaped values are masked first.
Use a language model
llm:invokeAsks RedAmon to call the model each user picks for this plugin. The plugin never sees an API key, and its calls have their own daily limit.
Propose agent instructions
override:skill.textProposes new text for a built-in skill. Nothing changes until a person approves it, and Reset to factory always brings the original back.
override:user_skill.text
override:user_skill.textMeasured
How it was evaluated
Skiller ships with an evaluation harness that uses no real target data: three synthetic sessions, each with four planted mistakes and a list of identifiers that must never leak. Results with DeepSeek deepseek-flash, run on 11 October 2026:
| Skill | Edits kept | Leaks | Mistakes covered | Characters added |
|---|---|---|---|---|
| Path traversal | 4 of 4 | 0 | 4 of 4 | 1,410 |
| SQL injection | 3 of 3 | 0 | 4 of 4 | 1,528 |
| XSS | 8 of 8 | 0 | 4 of 4 | 2,371 |
Every run used one model call for the diagnosis and one for the edits, with no repair round. Lessons were mapped to mistakes by keyword. These runs are of 1.0.0; 1.1.0 keeps the built-in prompts byte for byte and adds a session on one of your own skills, whose real-model run is still to do. Full report.
Every detail is in the Skiller guide
Managing versions, every step of the pipeline, messages and errors, limits, and how to get good proposals.