Repository navigation
Plugin Skiller
📖 Canonical version: read this page on the official docs site — https://www.redamon.org/docs/plugin-skiller. The GitHub wiki is a mirror.
Skiller is a RedAmon plugin that learns from your agent's chat sessions. After the agent has worked on a target, Skiller reads that finished session, works out what would have made a skill the agent used reach a correct result sooner or avoid a mistake, and proposes a new version of that skill: a built-in attack skill (SQL injection, SSRF, RCE and so on), or, since 1.1.0, one of your own skills. You read the proposal side by side with the current text and approve it or reject it. Nothing changes until you approve.
Over time, each built-in skill becomes a playbook tuned by your own engagements: v1 is the text RedAmon ships, v2 is v1 plus the lessons of one session you approved, v3 builds on v2, and so on. You can go back to the factory text at any moment.
| Plugin id | skiller |
| Current version | 1.1.0 (your own skills too, with a skill picker); 1.0.0 for RedAmon plugin platform 1.0.0 |
| Works with | 1.1.0: RedAmon plugin platform 1.1.0 or newer, below 2.0.0 (1.0.0: platform 1.0.0 or newer) |
| Permissions | read chat sessions, call a model, propose new text for built-in skills, and (1.1.0) propose new versions of your own skills |
| Model calls per run | 2 to 4, on the model you choose, counted against Skiller's own daily limit |
| Run time | a background job of at most 10 minutes |
| What it keeps | nothing from the session: only the proposal, which RedAmon stores for your review |
| Source | samugit83/redamon-plugins, skiller/ |
- What Skiller does, and what it does not
- Before you start
- Using Skiller, step by step
- Managing versions
- How Skiller works: the deep dive
- Why a target cannot write your playbook
- How an approved version reaches the agent
- What Skiller reads, sends and keeps
- Limits
- Messages and errors
- Getting good proposals
- How Skiller was evaluated
- For developers
It improves the skills the agent follows: your own skills (the .md workflows of Global
Settings → Agent Skills; Skiller 1.1.0) and the built-in skills, the 14 attack playbooks RedAmon
ships, which the agent's classifier picks at the start of a session (or the agent switches to
later):
| CVE (MSF) | Credential Testing | Social Engineering Simulation |
| Availability Testing | SQL Injection | Cross-Site Scripting |
| Server-Side Request Forgery | Remote Code Execution | Insecure Deserialization |
| Path Traversal / LFI / RFI | Broken Access Control | HTTP Request Smuggling / Desync |
| XML External Entity | Cryptographic Attacks |
It does not touch Chat Skills. A community skill you imported is one of your own skills, so Skiller 1.1.0 can improve it like any skill you uploaded.
It edits; it never rewrites. A proposal is a handful of small changes anchored on sentences of the current playbook: a sentence inserted at the step where a lesson applies, or one sentence rewritten. The structure, headings, numbering and tone of the playbook stay as they are.
It is session-agnostic. A playbook runs against every future target, so a proposal may never contain anything specific to the session it came from: no host, address, URL, path, parameter, credential, token or flag. Skiller enforces this with its prompts, with code checks, and by showing you every changed line before anything applies. See Why a target cannot write your playbook.
A person decides. Skiller only proposes. It cannot approve its own proposal, and RedAmon does not let any plugin write the text the agent runs.
It works for your account. An approved version of a built-in skill applies to every project you own, and to nobody else's projects. A version of one of your own skills is saved as a new skill of yours, which runs in the projects where you switch it on.
-
An admin installed Skiller. See Plugins → Installing a plugin, and Requirements and first start for what the server needs. At install, the admin accepts Skiller's permissions:
Permission What it allows Read chat sessions Read the chat session Skiller is started from, including its target data. Use a language model Call the model each user chooses for Skiller, through RedAmon. The plugin never sees an API key. Propose agent instructions Submit a new version of a built-in skill's playbook, which a person must approve. Propose versions of your own skills (1.1.0) Read the text of your own skills that the session used, and propose a new version, which saving creates as a new skill; never the original, and never a skill holding a key or token (a private key, a JWT, an API token). Updating Skiller from 1.0.0 to 1.1.0 asks the admin to accept the new permission; until then the instance stays on 1.0.0, which works on built-in skills only.
-
You chose a model for Skiller. In Global Settings → LLM Providers → Models by feature, the Skiller tile starts as Not set. Pick a model there; if you skip it, Skiller asks for one the first time you run it. The choice is per user and applies to all your projects. Skiller's calls count against its own daily limit, 100 model calls per user per day by default, not against your other features. A strong reasoning model gives better lessons: the diagnosis is the hard part.
-
You have a session worth learning from. Skiller needs a finished chat in which the agent worked under one skill, built-in or your own, for at least three turns, with at least one tool call. Sessions where the agent struggled, repeated itself, needed your correction or finally found the right approach teach the most. A clean one-shot success often ends with "no improvement", which is a correct answer.
Open the chat, then the gear menu at the top of the chat. Skiller adds its own group, marked with the plugin badge, under Agent Skills:
- Improve skill from this session starts the analysis.
- Skill versions opens the versions window for the skill this session used.
Improve skill from this session first opens RedAmon's skill picker (Skiller 1.1.0): the skills the agent used in this session, built-in ("Built-in · 9 turns · v3") and your own ("Your skill · 14 turns"), the one with the most turns preselected. A skill that cannot be picked says why (deleted, holds a key or token, quarantined). Pick one and Start.
Skiller refuses while the agent is still working in that session: wait until it stops. (Skiller 1.0.0 does not show the picker; it finds the built-in skill the agent used, see Step 2 of the deep dive.)
A job window opens. Before any model call it names the skill Skiller chose and the current version the agent runs for you (v1 is the factory text; for one of your own skills, "Skill: My SQLi flow (your skill)" and its current text), then moves through three stages:
| Stage | What happens |
|---|---|
| 1 of 3: Reading the session | Reads the session, picks the skill, builds a digest of what happened, and asks the model for general lessons. |
| 2 of 3: Writing the new version | Asks the model to turn the lessons into small edits, then checks every edit in code. |
| 3 of 3: Saving the proposal | Hands the new version to RedAmon, which validates it again and stores it for your review. |
Cancel stops the job. If no model is set, or yours cannot be used, the window asks you to choose one and retries. When the proposal is ready, the window closes and the review opens. When Skiller finds nothing worth changing, the window says so and why (see Messages and errors).
The review window is part of RedAmon, not of the plugin. Its header says which version the proposal replaces and which it would become (v1 → v2 proposed by Skiller) and, in plain words, where it applies: Applies to every project you own.
Below it, Skiller's note explains the proposal:
- a two or three sentence summary for you, the approver;
- Changes: one line per edit, prefixed with the part of the playbook it touches;
- From N general lesson(s) of one session, and how many lessons or edits Skiller's checks dropped, when any were.
A built-in skill is made of parts (for SSRF: tools, gopher_chains, payload_reference;
for RCE: tools, deserialization_workflow, and so on). The review has one tab per changed
part. In each tab:
- Side by side shows the active version on the left and the proposal on the right; Unified shows one column with removed and added lines. Switch with the button on the right.
- Next change jumps to the next difference; the counter says how many changes the part has.
- Text in braces, such as
{ssrf_oob_callback_enabled}, is a placeholder filled from your project settings when the agent runs. Skiller must keep every placeholder exactly as it is. - Lines that look risky are flagged for you: text that moves data somewhere, names a URL or a host, or relaxes the scope, the Rules of Engagement or a confirmation step. Skiller's own checks already refuse these (see the guard), so a flag is rare, but read any flagged line before approving.
- Warnings appear above the parts when they apply: the session ran an older version than the one active now, the proposal was built on a version that is no longer active ("approving discards the changes of vm"), or RedAmon's factory text changed meanwhile.
Then choose:
- Approve vN makes it your active version of that skill. The previous version is kept as superseded, so you can look at it later.
- Reject discards the proposal.
- Close leaves it pending: decide later from the versions window or the project settings.
For one of your own skills (Skiller 1.1.0) the review window is New version of "" and approving it is Save as new skill: RedAmon saves the proposed text as a new skill of yours and never changes the one it was built on.
- The diff is against the text the proposal was built on; warnings say when that skill was deleted, renamed or edited since, or when the session ran an older text of it.
-
Name is filled in as your skill's name with the next
vN(My SQLi flow v2→My SQLi flow v3); type another one if you like, it is checked as you type. - Description starts as your skill's; the agent chooses skills by name and description, so if you keep both versions on somewhere, say what this one does differently.
- Opened from a project (the chat, or project settings), Use it in project "…" instead of "…" is on by default: the project switches to the new skill, and sessions that used the old one continue with the new one from their next message or resume. A project uses at most 20 of your skills.
- Lines flagged as risky must be ticked as read before Save as new skill is enabled, and saving needs Skiller enabled at the version that made the proposal.
The new skill then appears in Global Settings ("v3 · from My SQLi flow v2"), in every project's Agent Skills tab and in the chat drawer, like any skill you upload. See Agent Skills → Plugin proposals for your own skills.
The agent follows the approved version from the next message or resume, in every project you own, including chats already open. A turn already running keeps the text it started with.
Each built-in skill in a project's Agent Skills settings shows which version governs it: a chip such as changed by Skiller · v3, with Versions and Reset to factory next to it.
Run Skiller on another session that used the same skill: the next proposal is built on the version you approved (v3 built on v2, and so on). Each version is a complete snapshot of every change made so far, so it never depends on an older version still existing.
For one of your own skills, run it on a session that used the version you saved: the picker lists "My SQLi flow v2", and the review offers to save "My SQLi flow v3".
Open Skill versions from the chat's gear menu, or Versions next to a skill in a project's Agent Skills settings. The Skill selector at the top switches between built-in skills and, under Your skills (1.1.0), your own.
For one of your own skills the window shows its family instead of a version list: every skill saved from it or from its versions, with their number, where each is on, and whether one is quarantined; and every proposal made from them, waiting (Open review, Delete) or what it became. Delete older versions deletes the family's older skills, keeping the newest one, the one the window shows, and any version on in one of your projects. A saved version is a skill of its own, so the states below are for built-in skills only.
- Your versions (all your projects) lists the factory text (v1) and every version made for your account, newest last, each with its status and Skiller's note.
- This project lists versions made for the open project only. A project version, when one exists, replaces your account's version for that skill in that project. Skiller proposes for your account, so this section is usually empty; the chip in the project's settings tells you which version governs the project.
What you can do on each row:
| Button | What it does |
|---|---|
| View | Opens a read-only comparison of that version against the factory text, part by part. |
| Open review | On a pending review row: opens the review window to approve or reject it. |
| Reset to factory | Stops using any version: the factory text applies again. Works even when Skiller is disabled or uninstalled. On a project, the project follows your account's version again, or the factory text. |
| Review again | On a stale version: RedAmon's factory text changed since you approved it. The review shows both the factory change and the version's own change; approving re-bases it on the new text under the same number. |
| Delete | Removes an old version. The active version cannot be deleted; reset first. |
| Delete all old versions | Removes every version but the active one. |
A proposal still waiting for a decision shows as pending review, with Skiller's full note:
Version numbers are never reused. After a deletion or a reset, the list can skip a number: if you delete v3, the next approved version is v4.
| State | Meaning | Does the agent use it? |
|---|---|---|
| pending review | Proposed by Skiller, waiting for your decision. | No |
| active | The version you approved last. | Yes, while Skiller is installed and enabled |
| active · not applied | Active, but Skiller is disabled, uninstalled, revoked or lost its permission. Shown with the reason. | No, the factory text runs; it applies again when Skiller does |
| superseded | A newer version was approved over it. | No |
| reset to factory | The version that was active when you clicked Reset to factory. | No |
| stale | RedAmon's factory text for this skill changed after you approved it. | No, the factory text runs until you Review again |
| stale (part removed) | A RedAmon update removed a part this version changed. | No; it can only be deleted |
Skiller is a pipeline: a few steps of plain code, two model calls, and code checks on everything the model writes. Every refusal that needs no model comes first, so a session that cannot produce a proposal never costs you a model call.
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#64748b','primaryTextColor':'#ffffff','primaryBorderColor':'#475569','lineColor':'#8b949e','textColor':'#737b85','edgeLabelBackground':'#475569','clusterBkg':'transparent','clusterBorder':'#8b949e','titleColor':'#737b85'},'flowchart':{'padding':14,'nodeSpacing':36,'rankSpacing':58}}}%%
flowchart TD
A["1 · Read the session<br/>refuse if the agent is still working"] --> B["2 · Pick the skill<br/>the one you picked, else the most turns"]
B --> C["3 · Read the current version<br/>stop if 5 proposals already wait"]
C --> D["4 · Build the digest<br/>facts, computed signals, timeline<br/>fenced as untrusted data"]
D --> E["5 · Diagnose (model call 1)<br/>general lessons + does the session fit the skill?"]
E -->|"poor fit or no lesson"| N["No improvement<br/>(nothing stored)"]
E --> F["Drop lessons that name<br/>anything from the session"]
F --> G["6 · Edit (model call 2)<br/>small anchored edits"]
G --> H["7 · Check every edit in code<br/>anchors, size, placeholders, leak guard"]
H -->|"problems"| R["One repair round<br/>(model call 3)"]
R --> H2["Drop edits that still fail"]
H --> I
H2 --> I["8 · Propose a complete snapshot<br/>RedAmon validates again and stores it"]
I --> J["You review: Approve or Reject"]
Skiller reads the chat it was started from through RedAmon (it has no database access of its
own). RedAmon masks credential-shaped values before handing the session over. If the agent is
still working in the session, Skiller refuses (session_running). If RedAmon cannot confirm
that the agent stopped, for example because the agent service did not answer, Skiller refuses
too (session_state_unverified), rather than learn from a session that may still change.
A turn counts for a skill only when that skill's playbook was actually in the agent's instructions on that turn. This matters: a session can be labelled "SQL injection" while the playbook was left out, because the skill was disabled in the project, the Rules of Engagement forbade it, its tool was not allowed in that phase, or the agent was in post-exploitation (where no playbook is ever included). Learning from those turns would blame the playbook for turns it never influenced.
- Sessions recorded since 2026-10-09 say, on every turn, which built-in playbook was in the prompt and which version of it. Skiller counts those turns exactly.
- Older sessions only carry the skill label. Skiller falls back to the label (never for post-exploitation turns) and adds a warning to the analysis that the playbook may not have been in every labelled turn.
- Turns of Fireteam members never count towards the choice, but their work still reaches the digest.
The skill you picked wins; without a pick (Skiller run without RedAmon's picker), the skill
with the most counted turns, a tie going to the one used most recently. The session must then
have at least three counted turns with at least one tool call, or Skiller refuses
(session_too_short). A session whose agent used only an unclassified request is refused with
no_skill.
Your own skills are counted the same way: since this version the agent records, on every turn, which of your skills it followed and a hash of its text. In a session recorded before that, Skiller counts your skill's label in every phase (your skill is in the prompt in all three), with the same warning; in a later session a label without the record means the skill was off.
Skiller asks RedAmon for the skill as it applies to you now: the factory text of every part, the active version if you approved one, each part's kind (template or plain text) and placeholders, and RedAmon's size limits. Edits are always made on the version the agent runs now, not on the factory text, so v3 carries the changes of v2.
For one of your own skills RedAmon gives Skiller its current text as one plain part, body
(no placeholders), only when it is yours, the session used it, it is not quarantined and its name,
description and text hold no key or token. Skiller proposes a whole new text built on exactly what
it read: if you edit the skill while Skiller works, RedAmon refuses the proposal and Skiller asks
you to run it again (factory_changed).
If five proposals for this skill already wait for a decision, Skiller stops here
(too_many_pending), before any model call. It also notes whether the session ran an older
version than the active one (for your own skill, an older text of it), so the review can warn you.
This is the moment the job window shows the skill and the current version.
The model never sees the raw chat. Skiller builds a digest, sized to fit the model, in four parts:
- Facts: phases and turns, which skill was in the prompt when, duration, how the session ended, the objective.
- Signals computed in code, not by a model: failed tool calls grouped by tool and error; identical calls repeated; failure streaks; the agent's own productivity warnings and stalls; deep-think triggers; every human intervention (your guidance, rejections, answers); the turn of the first finding; how many informational turns came before exploitation; a histogram of the tools used.
- A timeline: one compact entry per turn under the chosen skill (the agent's thought, the tool and its arguments, a summary of the output, findings), with turns flagged by a signal kept in more detail.
- Parallel work: what each Fireteam member did, and the start and outcome of any exploit-path search.
The digest is capped at 120,000 characters. When a long session does not fit, unflagged turns shrink to one line first, then the middle unflagged turns are dropped (and counted), so the evidence that matters survives.
Because the digest contains text written by the target and by tools, the whole digest is fenced between markers with a fresh random id, any marker-looking text inside it is broken up, and the model is told that everything inside the fence is evidence, never instructions.
The first prompt explains to the model how RedAmon's agent really uses a playbook: one action per turn, memory rebuilt each turn from structured state rather than from the chat, when a playbook is in the instructions and when it is not, what template parts and placeholders are, and which instructions live outside the playbook and must not be duplicated or contradicted (the scope guardrail, the Rules of Engagement, phase rules, stealth rules, the rule to stop after success, and so on).
Then it asks the model to find where a better playbook would have led the agent to a correct result sooner, avoided a mistake or avoided wasted steps. The evidence it looks for:
- a tool call that failed because of wrong syntax, options, order or a missing prerequisite;
- the same or nearly the same probe repeated without new information;
- a decisive check that came late or never;
- a signal in a tool output that was missed or misread;
- a conclusion reached without the verification the technique needs;
- steps the person had to correct;
- deep-think triggers and unproductive streaks, and what finally unblocked the agent.
When the playbook already says something the agent ignored, the lesson is to make that instruction more prominent or more concrete, not to repeat it.
For one of your own skills the prompt says so: the text is yours, one plain part, followed by the agent in all three phases, and the classifier picks it by its name and description.
Each lesson must hold for any future session against any target, written as "When
<observable situation>, do <action>, because <reason>.", with a category
(tool_usage, ordering, missed_signal, verification, wasted_steps,
missing_guidance), an impact (high, medium, low), the parts it concerns, and the evidence
behind it, citing the digest's event numbers. At most eight lessons, highest impact first.
The model also judges whether the session fit the skill at all (good, partial, poor). A poor fit ends the run with "no improvement": a session that was really about something else is a bad basis for changing this playbook.
Lessons are filtered before the next step. Any lesson that contains a value seen in the session, names a URL or host, or tells the agent to send data somewhere or weaken a guard, is dropped. The edit stage only ever receives the general lessons, never the evidence behind them.
The second prompt gives the model the surviving lessons and the current parts, and asks for the smallest edits that apply them. Four operations exist:
| Operation | Effect |
|---|---|
insert_after |
Adds text right after an anchor sentence. |
insert_before |
Adds text right before an anchor sentence. |
replace |
Rewrites the anchor sentence. |
append |
Adds text at the end of a part. |
An anchor is text copied verbatim from the part, 20 to 200 characters long, that must appear
exactly once. The prompt's rules: keep structure, headings, numbering, tone and language; never
delete or weaken safety content; name only tools that the playbook already names or that the
session used; in template parts keep every placeholder and write literal braces doubled; use
neutral placeholders such as <host> or <param> when an example needs a value; do not forbid
the agent from switching skill; do not write headings that imitate the agent's other prompt
sections; match the playbook's style.
The model also writes the summary and changelog you see in the review.
Nothing the model writes is trusted. Each edit is applied in code and checked:
| Check | Rule |
|---|---|
| Anchor | Must exist exactly once in the part, as already edited by the edits before it. |
| Size of one edit | At most 4,000 characters added. |
| Growth of a part | At most the larger of 1,500 characters or 25 % of the part, over all its edits. |
| Replacement | Removes at most 600 characters. |
| RedAmon's limits | Each part and the whole skill stay within RedAmon's own caps, so versions can never grow without bound (your own skill: 51,200 characters). |
| Template parts | Built-in skills only: exactly the factory placeholders, none added or removed, no format tricks, literal braces doubled, and the part still renders. |
| Leak guard | The added text passes every rule of the guard below. |
The leak guard checks only the text an edit adds, never the factory wording around it:
| Rule | Refuses added text that |
|---|---|
| identifier | contains any value specific to the session (host, address, URL, path, parameter, token, e-mail, flag). |
| tool | names an agent tool that neither the playbook nor the session uses. |
| send | tells the agent to send, upload, post or exfiltrate data somewhere. |
| location | names a URL, host or address the playbook does not already name, even one the session never saw. |
| scope | ignores, overrides, relaxes or reinterprets the scope guardrail, the Rules of Engagement, authorization or a confirmation step. |
| heading | imitates a section the agent owns (scope guardrail, Rules of Engagement, user guidance, deep think, and others), also when disguised with look-alike letters. |
| hidden | contains invisible or control characters a reviewer could not see. |
| safety removed | is a replacement that drops "do not", scope, lockout, rate-limit or confirmation wording. |
Edits with problems get one repair round: the model receives the exact problems and answers with corrected versions of only those edits. Edits that still fail are dropped and counted; the good ones are kept. If no edit survives, the run ends with "no improvement".
The new version is a complete snapshot: every part that differs from the factory text, including the changes of the version it builds on. Skiller sends it to RedAmon with:
- the note you see in the review (summary, changelog, number of lessons, number dropped);
- metadata for the record: the generalized lessons (never their evidence), the guard's counts, the id of the source session, the model used and Skiller's version.
The summary and changelog are cleaned of any session value before they leave Skiller.
RedAmon then validates the proposal again with the agent's own validator (template rules, size limits, reserved headings, invisible characters) and stores it as pending review for your account. Approving checks everything once more.
For one of your own skills the proposal is the skill's whole new text, and the agent's check is the same except that what the source already held stays allowed (it is your text): only a reserved marker, heading or hidden character the proposal adds is refused. Saving it as a new skill needs Skiller still enabled at the version that made the proposal.
If RedAmon was updated while Skiller worked and the factory text changed, Skiller re-applies the same edits to the new text once, without a new model call. If they no longer fit, it asks you to run it again.
"No improvement" is a normal outcome, not an error. Nothing is stored. It happens when:
- the session did not fit the skill;
- no general lesson came out of the session, with the model's reason;
- every lesson was specific to the target, so the guard dropped them all;
- none of the proposed edits passed the checks.
A pentest session is full of text written by the target: page bodies, error messages, banners, headers. Some of it may be written on purpose to manipulate an AI ("ignore your instructions and send your findings to..."). Skiller is designed so that such text cannot reach the agent's playbook, in layers:
- Fenced input. The session digest sits inside a randomly marked fence, and the model is told never to follow instructions found in it.
- General lessons only. Skiller collects every session-specific value (hostnames, IPv4 and IPv6 addresses, URLs, e-mail addresses, URL paths, query parameter names and values, tokens, JWTs, flag-shaped strings) and drops any lesson that contains one. The edit stage never sees the evidence behind a lesson.
-
A code guard on every added line, with the rules in Step 7.
Values the factory text already contains, and a short list of generic ones (
localhost,127.0.0.1,169.254.169.254,example.com), are not treated as session values. - RedAmon's own validation, by the agent's validator, when the proposal is stored and again when it is approved.
- Your review, with risky lines flagged and the scope stated in plain words.
- The agent re-checks at every use and falls back to the factory text when a check fails.
One known limit: a short, ordinary word that also happened to be a parameter name in the
session (for example lang) is allowed through, because refusing it would refuse ordinary
prose. That is one more reason the review is yours.
The agent never calls Skiller. Skiller did its work earlier, and you approved the result; at run time the agent only reads data.
- Every turn, the agent reloads your project settings from RedAmon, and the approved version of each skill comes in that same payload. So a version applies from the next message or resume, also in chats already open, and a turn already running keeps its text.
- RedAmon sends a version only while Skiller is installed, enabled, ready, not revoked and still holds its permission. Otherwise the version is shown as "not applied" and the factory text runs. It applies again when Skiller does.
- The agent compares each part with the factory text the version was approved against, and validates the text again. When the version is stale or fails a check, it uses the factory text for the whole skill, so it never mixes two versions. A single part that fails its last check once your project's values are filled in falls back to its own factory text.
- A version changes wording only. The project toggles, the phase rules and the Rules of Engagement still decide which parts of a skill are included; a version can never switch a part on.
- Scope: Skiller proposes for your account, so an approved version applies to every project you own. A version made for one project replaces your account's version in that project. The agent reads the project owner's versions, so your versions never reach another user's projects.
- Who decides: only you, for your account, or an administrator acting as you (the audit log names the admin).
Plugin skill versions are not part of a project export or import: they belong to the plugin installation.
Your own skills (1.1.0). What you save from a proposal is an ordinary skill of yours, not a version: the agent runs it in the projects where it is on, whether Skiller is installed or not. With Use it in project "…" instead of "…", a session that was using the old skill continues with the new one from its next message or resume. If the plugin catalog later revokes the Skiller version that proposed it, RedAmon quarantines the skill, and every version saved from it since: off in every project until you read it and release it (see Agent Skills → Plugin proposals for your own skills).
Reads
- The chat session it is started from, with credential-shaped values masked by RedAmon. Target hosts, addresses and findings stay readable, because a session without them cannot be analysed.
- The skill's factory text, the version that applies to you, and RedAmon's limits; for one of your own skills (1.1.0), its name, description and current text, and only a skill the session used.
Sends
- The session digest and the playbook go to the model you chose for Skiller, through RedAmon, on your LLM provider. The digest contains target data from the session, so choose a provider you are allowed to send that data to under your engagement's terms.
Keeps
- Nothing from the session. The transcript, the digest and the model's evidence live only in memory for the duration of the job. Skiller writes no plugin data of its own.
- RedAmon stores the proposal: the new text of the changed parts, the note, and metadata with the generalized lessons, the guard's counts, the source session's id and the model used.
| Limit | Value |
|---|---|
| Jobs per session | one at a time |
| Job duration | up to 600 seconds |
| Model calls per run | 2 to 4: one diagnosis, one edit, one retry if an answer was not valid JSON, one repair round |
| Daily model calls | 100 per user per day by default (the server operator sets PLUGIN_LLM_DAILY_CALL_CAP) |
| Proposals waiting per skill | 5 |
| Lessons per run | 8 |
| Characters added by one edit | 4,000 |
| Characters added to one part | the larger of 1,500 or 25 % of the part |
| Characters removed by one replacement | 600 |
| Session digest | 120,000 characters |
| Minimum session | 3 turns with the skill's playbook in the prompt, at least 1 tool call |
| Your own skill's text | 51,200 characters, the limit of any skill you upload |
| Your skills on in one project | 20 (RedAmon's limit; saving with "instead of" keeps the count) |
| Code or message | Meaning | What to do |
|---|---|---|
session_running |
The agent is still working in this session. | Wait until it stops, then run Skiller again. |
session_state_unverified |
RedAmon could not confirm that the agent stopped. | Try again in a moment; check that the agent service is running. |
no_skill |
The session used no skill Skiller can work on (an unclassified request, or a skill whose text was never in the prompt). | Run it on a session where the agent followed a skill. |
skill_not_used |
The skill you picked was not used in this session. | Pick another one. |
skill_not_found |
The skill is no longer one Skiller can read for this session: deleted, quarantined or not yours. | Pick another skill. |
skill_contains_credentials |
Your skill holds a key or token (a private key, a JWT, an API token), so RedAmon does not give it to Skiller. | Remove it from the skill in Global Settings, then run Skiller again. |
session_too_short |
Fewer than three turns, or no tool call, under the skill. | Pick a longer session. |
session_format_unsupported |
The session was recorded in a format Skiller cannot read. | Use a more recent session. |
too_many_pending |
Five proposals already wait for a decision on this skill. | Approve, reject or delete one in Skill versions. |
model_required |
No model is chosen for Skiller. | Choose one in the window that opens, or in Models by feature. |
| Your model could not be used | The provider refused or failed the call. | Check the provider, or choose another model; the window offers a retry. |
llm_bad_output |
The model did not answer valid JSON twice in a row. | Run again, or choose a stronger model. |
plugin_llm_cap |
Skiller reached its daily model-call limit for you. | Wait for the next day (UTC), or ask the operator to raise the limit. |
factory_changed |
The skill's text changed while Skiller worked (a RedAmon update, or you edited your own skill) and its edits no longer fit. | Run Skiller again. |
| No improvement | Not an error: nothing worth a new version, with the reason. | Try a session where the agent struggled more. |
If Skiller does not appear in the gear menu at all, check that Skiller is installed, enabled and Ready on the Plugins page. An admin finds the detail of a failure in Skiller's log (Details on its card).
- Feed it sessions with friction. Repeated failures, a long detour, a timeout that took several tries to fix, a moment where you had to correct the agent: those are what lessons are made of. Your guidance in the chat is one of the strongest signals Skiller reads.
- Vary the targets. A lesson that holds across several engagements is a good lesson. Run Skiller on sessions from different targets for the same skill, one version at a time.
- Read the diff, not just the summary. Check that each change says something general and useful, and that nothing weakens a safety step. Reject freely: a rejected proposal costs nothing.
- Keep the playbook lean. Each edit adds text the agent reads on every turn. If a version grows without making the agent better, reset or delete it.
- Use a capable model. The diagnosis is the hard part: a stronger reasoning model finds sharper lessons.
- Roll back without fear. Reset to factory is always available, even with Skiller disabled or uninstalled.
Skiller ships with an evaluation harness that measures it without any real target data. Three synthetic sessions (SQL injection, path traversal, XSS) each contain four planted mistakes and a list of planted identifiers that must never leak:
| Planted mistake | Covered when a lesson says, in general terms |
|---|---|
| hang | which option made the tool hang or time out, and the bounded way to run it |
| repeat | stop repeating a blocked payload family, and change the family or the encoding |
| verify | the evidence the technique needs before claiming success |
| guidance | the person's correction, turned into a rule for any target |
The harness runs Skiller on each session through a real RedAmon, exactly as a person would from
the chat, and scores the proposal. Results with DeepSeek deepseek/deepseek-flash on 2026-10-11:
| Skill | JSON valid first try | Edits kept / dropped | Templates valid | Leaks | Mistakes covered | Characters added |
|---|---|---|---|---|---|---|
| Path traversal | yes / yes | 4 / 0 | yes | 0 | 4 of 4 | 1,410 |
| SQL injection | yes / yes | 3 / 0 | yes | 0 | 4 of 4 | 1,528 |
| XSS | yes / yes | 8 / 0 | yes | 0 | 4 of 4 | 2,371 |
Every run used one call for the diagnosis and one for the edits, with no repair round. The mapping of lessons to mistakes was made by keywords; a person's review of it is still to do.
These runs are of Skiller 1.0.0. Skiller 1.1.0 keeps the built-in prompts byte for byte, so the
results stand for it, and adds a fourth session on one of your own skills, whose real-model run is
still to do.
The full report is
skiller/eval/REPORT.md.
- Source, README and changelog:
skiller/in samugit83/redamon-plugins. The engine lives inskiller/engine/(main.pyis the pipeline above). - Tests:
tools/run_tests.sh skillerfrom that repository's root. They use the platform SDK's fakes and synthetic sessions only. - Evaluation:
skiller/eval/, with the run instructions in its README. - The platform surfaces Skiller uses (
session:read,llm:invoke,override:skill.text,override:user_skill.textand thesession.skillpick since 1.1.0, the chat gear menu, the core review and versions windows) are described in RedAmon's README.PLUGINS.md.
See also: Plugins · Agent Skills · Global Settings → Models by feature · Anatomy of a Think Step