Coverage

Coverage

Systematic thoroughness: which phase items and applicable vuln classes have NOT been done. Coverage now lives in the plan board (targets//Approach.md), not a separate file.

Read the board

cat targets//Approach.md
python3 scripts/next_move.py      # ranks [gap] test moves from the 4a table + findings + Deadends

• Phase items still [ ] (todo) or [~] (doing) are the open work, in kill-chain order.
• The ### 4a table is the per-asset coverage matrix: one row per (asset, vuln class); a row

counts as tested when its status cell is [x]/done. Any applicable class with no done row on an in-scope asset is a gap. next_move.py surfaces these as [gap] moves.

Then (model)

1. For each asset, the untested applicable classes ARE the to-do. Prioritise by impact + the

[gap]/[now] moves from next_move.py (fingerprint-targeted).

1. Pull payloads from wiki/payloads/ for each untested class (or Skill(arsenal)).
2. After testing a class on an asset, add a ### 4a row to Approach.md with the class,

the tool/payload, status [x], and the poc/ image (GATE 2). Otherwise the gap recurs.

1. A phase is done only when every applicable item is [x] or [-] (n/a) or [!] (deadend).

Discipline

• Respect scope: out-of-scope assets are excluded by next_move.py.
• "Done" means tested, not necessarily clean - record findings separately as FINDs.
• Don't mark a row [x] without actually testing it and capturing a poc/ image; this

checklist only helps if honest.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Encod3d-Sec
• Source: Encod3d-Sec/TORCH
• License: MIT

Install and usage instructions live in the source repository linked above.