# Cyber Exercise Control

Controls authorized cybersecurity exercises through inject scheduling, safety gates...

- Repository: https://github.com/HoangNguyen0403/agent-skills-standard (582 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-exercise-control -g -a claude-code -y`
Codex: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-exercise-control -g -a codex -y`
Cursor: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-exercise-control -g -a cursor -y`
Gemini CLI: `npx skills add HoangNguyen0403/agent-skills-standard --skill cyber-exercise-control -g -a gemini-cli -y`

## Description

Controls authorized cybersecurity exercises through inject scheduling, safety gates, stop and restart decisions, communications, and synthetic-data boundaries. Use when serving as exercise control or white-team coordinator, not as compliance assessor or whitehat operator.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cyber Exercise Control

## **Priority: P0 (CRITICAL)**

Coordinate a bounded exercise; control safety and adjudication handoffs without performing attacks or certifying compliance.

## Structure

```text
cyber-exercise-control/
├── SKILL.md
├── references/control-log.md
└── evals/evals.json
```

## Workflow
1. Confirm approved plan, mode per step (`analysis`, `replay`, `isolated-lab-validation`, `defensive-verification`), authorization, exclusions, runtime support, and synthetic boundaries.
2. Manage execution states using StepResult schema (`planned`, `eligible`, `running`, `completed`, `blocked`, `stopped`, `failed`, `dependency-blocked`).
3. Publish schedule and injects with step ID, trigger, expected channel, limits, and abort conditions.
4. Stop immediately on expiry, drift, unsafe impact, data exposure, or operator signal; host stop dominates concurrent dispatch.
5. Record partial receipts upon cancellation; execute teardown under surviving authority; disclose residual state in CleanupResult.
6. Mark steps lacking predecessor evidence as `dependency-blocked` with `evidence-missing` naming producer; advance independent permitted steps.
7. Restart requires explicit restart authority, reconciled residual boundary, fresh host proofs, new attempt ID, fresh correlation key, and a fresh GateDecision.
## Rules

The rest: https://github.com/HoangNguyen0403/agent-skills-standard/blob/HEAD/.agents/skills/cybersecurity/cyber-exercise-control/SKILL.md