BREAK skill
BREAK searches the JD.Army business-risk base: 400 risks, 350 avoidances, 125 attack tools, 83 threat actors and 1781 cases.
- 388 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The base describes attacker tools and groups: dual use, apply it only to defend your own systems.
- Using the schemes against other services breaks the law and platform terms.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/breakDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The base describes attacker tools and groups: dual use, apply it only to defend your own systems.
- Using the schemes against other services breaks the law and platform terms.
This is third-party code. Review the repository files before installing.
What it does
BREAK is JD.Army red team's open knowledge base on business risks: abuse of normal product logic rather than code defects. The skill for Claude Code and Codex searches it locally through `break_search.mjs` with no external dependencies. A query takes an ID such as `R0001`, a keyword or a plain question. The base holds 400 risks, 350 avoidances, 125 attack tools, 83 threat actors, 657 terms and 1781 cases across 20 industries. Each risk follows an `R00xx` format, as in MITRE ATT&CK, and links to avoidances and cases. The `--type`, `--limit` and `--detail` options narrow results. English and Chinese editions exist.
Who it is for. Product security, anti-fraud and risk analysts who assess business-logic defenses together with an agent.
Good fit when
- A site is being scraped and mitigation options have to be chosen.
- Typical abuse schemes are checked before a promotion launches.
- A threat model for payments or accounts is built from the risk catalog.
- A report needs real cases and references on a topic.
- A term from an incident is checked against the glossary.
Not a fit when
- A code vulnerability scanner is needed: the base covers business logic, not defects.
- A step-by-step attack method against someone else's system is wanted.
- The result would be passed off as a finished audit opinion without checking.
Example request
Our website is being scraped. Find matching risks and avoidances in BREAK and give three cases each.Limitations
The base describes attacker tools and groups: use it to defend and assess your own systems. Data has to be exported before the skill runs (`npm run export:data-en`). Code and data are Apache-2.0, and JD.Army updates the content at its discretion. Entry texts are mostly Chinese, with the English export produced by a separate command. There is no ready install package: `scripts/skill/package_skill.sh` packs the skill.
How to disable. Remove the skill directory from `~/.claude/skills/` or the Codex skills directory. The cloned repository can be deleted.
FAQ
How do I search the base?
Pass the query to the script: `node scripts/skill/break_search.mjs "credential stuffing" --lang en`. An ID such as `R0001` returns the full entry, and a plain question switches to answer mode.
How do I narrow results by type?
Add `--type risks,avoidances` and `--limit N`. Available types are risks, avoidances, attackTools, threatActors, terms and cases.
How is a business risk different from a vulnerability?
A vulnerability comes from a code defect and is closed by fixing it. A business risk comes from normal product logic, so it is only reduced through avoidance measures and risk models.
Is the base suitable for attacking other services?
No, it targets assessing and strengthening your own defenses. Descriptions of attacker tools exist to explain threats.
What language is the data in?
English and Chinese editions exist. The language is detected from the query or set with `--lang zh|en`.
Discussion
No questions or reviews yet.
Related
SkillsA set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
A Claude Code skill that finds vulnerabilities in one session: threat model, verified findings, CWE and CVSS report.
Claude Code CyberSecurity Skills
Claude Code CyberSecurity Skill Collection
A set of 22 cybersecurity skills for Claude Code: recon, vulnerability assessment, incident response, red and blue team, malware analysis
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
README in short
The framework organizes knowledge by business domain, risk dimension, scenario and risk item. An online version is available at break.jd.army.