Cyber Exercise Control
Priority: P0 (CRITICAL)
Coordinate a bounded exercise; control safety and adjudication handoffs without performing attacks or certifying compliance.
Structure
textcyber-exercise-control/ ├── SKILL.md ├── references/control-log.md └── evals/evals.json
Workflow
- Confirm approved plan, authorization, exclusions, runtime support, roles, and synthetic-data boundary.
- Publish schedule and injects with owner, trigger, expected channel, and abort condition.
- Log each release, pause, stop, restart, scope change, and escalation with time and authority.
- Stop on authorization expiry, scope drift, unsafe impact, data exposure, or unsupported runtime.
- Restart only after fresh authorization/runtime gates and a recorded decision.
- Hand observations to independent adjudication; preserve evidence and ground truth separately.
Rules
- White team means exercise control and adjudication coordination here; it does not mean compliance or whitehat testing.
- Keep offline inject design available when live controls are unsupported.
- Do not issue attack commands, alter production, handle real credentials, or contact real targets.
- Use shared evidence fields and canonical
artifacts/security-review.mdwhen applicable. Control records carryengagement_scope_ref,skill_version,source,observed_at,finding_status,evidence_refs,limitations, andaccountable_owner.
Anti-Patterns
- No silent scope change: Pause and re-authorize.
- No self-adjudication: Control does not grade its own outcome.
- No fake safety: Markdown cannot enforce runtime restrictions.
- No forced continuity: Stop is valid evidence.


