---
name: Correlate
slug: correlate
category: Quality
description: Correlate runs a finding correlation engine to turn individual findings into attack chains. Use it after collecting bugs to identify multi-step paths, document reproduction steps, and surface high-impact chains.
github: "https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/correlate"
language: Python
stars: 804
forks: 156
install: "npx degit https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/correlate ~/.claude/skills/correlate"
installs_to: ~/.claude/skills/correlate
source_path: .claude/skills/correlate/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/H-mmer/pentest-agents"
added: 2026-08-22T05:22:33.856Z
last_synced: 2026-08-22T05:22:33.856Z
canonical_url: "https://dirskills.com/skills/correlate"
---

# Correlate

Correlate runs a finding correlation engine to turn individual findings into attack chains. Use it after collecting bugs to identify multi-step paths, document reproduction steps, and surface high-impact chains.

**Install:**

```bash
npx degit https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/correlate ~/.claude/skills/correlate
```

## README

Find attack chains by correlating all known findings.

1. `uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py --compact` — show current state
2. Launch `correlator` agent: "Analyze ALL findings in brain and findings.json. Find attack chains where one finding enables another. Document each chain with combined CVSS 4.0 and end-to-end reproduction steps."
3. After agent returns, update brain with discovered chains.
4. Show the user any new high-impact chains found.

## Top-Tier Correlation Bar

Build a capability graph, not a list of related bugs.

- Nodes are capabilities: read tenant data, write config, trigger webhook, steal token, reach internal host, execute workflow.
- Edges require evidence that one capability enables the next. Shared component or same endpoint family is only a hint.
- Score each chain by final impact, proof reliability, policy safety, duplicate risk, and report clarity.
- Prefer chains that convert low-severity feeders into account takeover, tenant escape, stored XSS with privileged action, SSRF to credential disclosure, or config write to execution.
- Record killed chains too. The next correlation pass should know which attractive edges failed and why.