What does this skill do, and when should you use it?
This skill packages the end-to-end testing workflow for SmokedMeat, a post-exploitation red team framework for CI/CD pipelines. All configuration is isolated under .claude/e2e/, infrastructure runs in Docker, and the operator TUI (Counter) runs in tmux for capture. It offers a fast smoke path (make e2e-smoke, ~45-90s) and a full GOAT attack-chain path (make e2e-goat, several minutes) covering initial foothold on a public repo through cloud pivoting to flag retrieval. The skill can also target a specific focus area (wizard, layout, exploit, recon, auth) and debug failures by reading tmux capture output.
Reads isolated config from .claude/e2e/.env, config.yaml and tokens.yaml; tears down and starts Docker infrastructure and a Cloudflare tunnel via make targets; launches the Counter TUI in a tmux session and captures its state with tmux capture; runs TestPublicExploitSmoke (deploying the public issue-body foothold, waiting for the Brisket callback, confirming loot) or TestGOATFlagPath (workflow_dispatch abuse, PAT enumeration, SSH pivot, cache poisoning, OIDC-to-GCP pivot, flag retrieval); on failure it analyzes requireContent assertions versus captured output, supports manual interaction via make e2e-capture / e2e-keys, and appends bugs to docs/e2e-bugs.md.
- A developer who changed SmokedMeat TUI code verifies the setup wizard or panel layout quickly using the 'wizard' or 'layout' focus.
- A security engineer confirms the public foothold flow still works in about a minute via make e2e-smoke after exploit-chain changes.
- Debugging odd Counter UI state with make e2e-capture and sending manual keys with make e2e-keys.
- Validating Kitchen/Counter integration by running make e2e-goat through the full chain including cloud pivots and flag retrieval.
- Targeted testing of auth and token validation logic using the 'auth' focus.
- Recording UI bugs in docs/e2e-bugs.md using the prescribed bug format.
How do you install this skill?
- This skill drives real CI/CD attack chains (PR injection, cache poisoning, cloud credential pivots); run only against systems you own or have written authorization to test — misuse against third parties may be unlawful.
- GITHUB_TOKEN and other credentials are stored in plaintext at .claude/e2e/.env and tokens.yaml; watch file permissions and accidental-commit risk.
- Core flows depend on GitHub, Cloudflare tunnels, Docker and overseas network reachability; mainland-China users may face unstable access.
- This is a static source review with nothing executed; e2e paths are not CI-covered and reliability is independently unverified.
- Shell / CLI
- Network access
- Local filesystem
DockermaketmuxGo toolchain (make targets)GitHub token with public_repo/repogh CLI (manual issue cleanup)
Place the skill at .claude/skills/e2e/SKILL.md within the repo (it already lives at this path in boostsecurityio/smokedmeat). After cloning, install Docker and make (Go is not required for the quickstart; Go 1.26+ is needed for source development). Running make e2e-smoke prompts for GITHUB_TOKEN and saves it to .claude/e2e/.env.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/boostsecurityio/smokedmeat.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/.claude/skills/e2e" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- run the e2e smoke test
- test e2e with exploit focus
Trigger the skill in Claude Code, e.g. 'run the e2e smoke test' or 'test e2e with exploit focus'. With no focus, start with the fast smoke path: make e2e-smoke; for the full chain run make e2e-goat. For debugging use make e2e-counter, make e2e-capture, and make e2e-keys KEYS='Enter' to interact with the tmux session manually. Clean up with make e2e-down or make e2e-purge.
What are this skill's strengths and limitations?
- Two preset test paths: a ~1-minute smoke test and the full GOAT attack chain with clearly defined coverage.
- Configuration fully isolated in .claude/e2e/ — never pollutes the global ~/.smokedmeat/.
- Failures include tmux capture output plus a common-failure lookup table for clear troubleshooting.
- Focus keywords (wizard/layout/exploit/recon/auth) allow targeted testing that saves time.
- Heavy environment dependencies: Docker, tmux, make, and a Cloudflare tunnel.
- e2e-goat takes several minutes depending on environment, unsuitable for rapid iteration.
- Only covers the GitHub Actions attack surface (the whooli goat repos); other CI platforms mentioned in the README are not tested by this skill.
- Failures require manual interpretation of tmux captures; automated diagnosis is limited.
- AGPL-3.0 licensing carries copyleft constraints for integration use.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| SmokedMeat E2E Testing Skill this page | 49 · Use with care | ★ 393 | 1mo ago | AGPL-3.0 |
| CI/CD Pipeline Automation | 48 · Use with care | ★ 107k | 12d ago | MIT |
| Dependency Refresh Playbook | 59 · Recommended | ★ 4.5k | 21d ago | MIT |
| Prism Scanner — AI Agent Skill Security Scanner | 55 · Use with care | ★ 27 | 6mo ago | Apache-2.0 |
| ClawSec Release Manager | 54 · Use with care | ★ 1.1k | 12d ago | AGPL-3.0 |
SmokedMeat self-describes as 'like Metasploit, but for CI/CD pipelines' and complements its sibling poutine (build pipeline SAST scanner) on the defensive side; prior art includes Gato-X (GitHub Actions enumeration), Nord-Stream (CI/CD secret extraction), and Sliver/Mythic (C2 architecture references). The skill itself is a test harness with no directly listed competitors.
How did FollowSkills review this skill?
Configuration isolation is explicit (.claude/e2e/ for all tokens/config), allowed-tools are declared, cleanup/purge steps exist, and targets are the authorized whooli playground; deducted because the skill grants Bash to run full exploit chains, writes GITHUB_TOKEN/AUTH_TOKEN to plaintext files without encryption or least-privilege notes, and lacks hard guardrails against misuse against non-owned repos.
Strong structure: concrete make targets, timing tables, failure-indicator table, manual tmux debugging, cleanup paths; deducted because static review cannot verify key-path reproduction, e2e is not exercised in CI, and failure feedback depends on test output rather than independently diagnosable messages.
Trigger description is precise (TUI changes, exploit flows, UI debugging), $ARGUMENTS enables focus routing, and boundaries are reasonably clear; deducted for English-only content and hard dependency on GitHub, Cloudflare tunnels, Docker and overseas reachability, which is risky for mainland-China network environments.
Well-layered docs (isolation → smoke → GOAT → manual → failures → cleanup), complete README/LICENSE/SECURITY.md with clear AGPL-3.0; deducted because the skill has no versioning, changelog or stated maintenance owner, and assumptions about internal-repo usage are implicit.
Task and audience (repo developers) are clear, make commands and expected outputs are specific, and automated e2e has real marginal value over manual testing; deducted because direct usability of outputs is unverified statically and e2e-goat duration is environment-dependent.
Auditable primary material exists (Makefile references, named Go tests, CI workflow, config tables); deducted because there is no independent third-party execution evidence, e2e key paths are outside CI coverage, and conclusions are not statically reproducible.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →