Command Channel Defense Assessment

---
name: command-channel-defense-assessment
description: "Assesses supplied defensive evidence for prevention, visibility, detection, containment, and recovery coverage against opaque command-channel scenarios. Use when reviewing command-and-control exposure or control gaps without designing infrastructure, live tests, or operational guidance."
allowed-tools: Read Grep Glob
---

# Command channel defense assessment

Measure defensive assurance against supplied opaque scenarios. This is an
evidence review, not a design, simulation, validation plan, or authorization.

Never represent topology, components, services, channels, endpoints,
transports, infrastructure, implementation recommendations, or rule, query, or
configuration bodies. Never supply commands, live identifiers, credentials,
payloads, evasion, deployment, or testing guidance.

## When to Use

- Reviewing command-and-control exposure or control gaps without designing infrastructure, live tests, or operational guidance.
- Use only within explicit authorization and the stated rules of engagement.

## When NOT to Use

- Do not treat this skill as permission to access, test, or change a target.
- Do not convert missing evidence into a clean result or a stronger claim.

## Workflow

1. Record one assessment cutoff and engagement window. Bind the governing
   policy and opaque scope reference.
2. Record environment and control fingerprints without names, addresses,
   products, services, or implementation details.
3. Classify the environment. Production review is passive and sanitized only.
   Active or imported validation evidence must bind an `isolated-lab` or
   `dedicated-test-tenant` with an active-validation receipt.
4. Keep three independent tracks per coverage cell: configuration is
   `unknown`, `absent`, or `present`; health is `unknown`, `degraded`, or
   `healthy`; validation is `not-tested`, `inconclusive`, `supported`, or `gap`.
5. Create exactly one cell for each scenario and applicable objective:
   `prevent`, `observe`, `detect`, `contain`, and `recover`.
6. Keep policy, configuration, health, observation, detection, containment,
   recovery, and validation evidence separate.
7. Bind every cited item to the exact scenario, bundle digest, environment and
   control fingerprints, scope, policy, validation receipt, assessment window,
   and custody record.
8. Derive the cell state from the three tracks. Configuration or health evidence
   without validation is `evidence-only`, never `validation-supported`.
9. Record observed validation gaps as immutable open facts. A later fix creates
   a new ledger; it does not rewrite the record that observed the gap.
10. Use `not-applicable` only with a closed policy reason and current policy
    evidence. Missing coverage is not non-applicability.
11. Record defensive handoffs only: evidence refresh, control review, or gap
    remediation. A handoff is neither approval nor completion.
12. Resolve contradictions without changing scenario identity or adding
    operational detail.

## Derivation rules

- `unassessed`: all three tracks are unknown or not tested.
- `evidence-only`: configuration or health is known, but validation is not.
- `validation-supported`: current exact validation supports the objective.
- `gap-observed`: current exact validation demonstrates a gap and an immutable
  gap record exists.
- `inconclusive`: current exact validation is inconclusive.
- `stale`: prior validation is expired, disposed, or invalidated by drift.
- `not-applicable`: current exact policy evidence supports an allowed reason.
- A scenario is validated only when every applicable objective is currently
  validation-supported. One stale, gap, inconclusive, or unassessed cell limits
  the aggregate.

## Report

Return opaque scenario IDs, per-objective derived states, aggregate counts,
open gap IDs, defensive handoffs, and blocking reason codes. Do not quote
restricted values from rejected input.

## Boundary

- Receive scenario IDs and taxonomy receipts from an upstream assessment.
- Send authorized active validation to a separate isolated-lab workflow.
- Send gaps to detection, containment, or recovery owners without prescribing
  implementations.
- Treat `PASS` as consistency only, never authenticity, effectiveness, approval,
  completion, or authority.

## Rationalizations to reject

- **“Configured means covered.”** Presence does not prove health or outcome.
- **“Healthy telemetry proves detection.”** Visibility and detection are
  separate claims with separate evidence.
- **“No alert proves a gap.”** Silence without exact observation and validation
  evidence is inconclusive.
- **“Production is the most realistic test.”** This skill permits passive,
  sanitized production review only.
- **“An imported result applies here.”** It must bind the exact scenario,
  non-production fingerprint, control fingerprint, scope, policy, and window.
- **“The control name is unchanged.”** Fingerprint drift invalidates prior
  claims.
- **“We fixed the gap, so close it here.”** Preserve the observed fact and open
  a later assessment.
- **“The handoff approves the work.”** A handoff transfers defensive work; it
  never grants authority or attests completion.