JDArmy/BREAK

BREAK Knowledge Base Skill

BREAK (Business Risk Enumeration & Avoidance Knowledge) is an open knowledge framework for business risk enumeration and avoidance, containing 3,416 entries covering the following entity types:

Type	Count	ID Format	Description
Risk	400	R0001, R0001-001	Business security risk definition & impact
Avoidance	350	A0001, A0001-001	Defensive measures against risks
AttackTool	125	AT0001, AT0001-001	Tools used by cybercriminals
ThreatActor	83	TA0001, TA0001-001	People carrying out attacks
Term	657	T0001	Business security terminology
Case	1781	C0001	Real security incident cases
BusinessDomain	20	BD00	Industry/business domain classification

Maintenance note: The invocation method of this Skill remains unchanged; entity statistics are updated synchronously with knowledge base case facts, source quality, and data relationship improvements.

Invocation Method

Execute the search script using Bash. The script is located at break_search.mjs in the skill directory.

Basic Command Format

node <skill_dir>/break_search.mjs "<query>" [options]

Where <skill_dir> is the directory path containing this SKILL.md file.

Parameter Description

Parameter	Description
<query>	Required. Search keyword, entity ID, or security problem description.
`--lang zh	en`
--type <types>	Comma-separated entity type filter (risks, avoidances, attackTools, threatActors, terms, cases)
--limit N	Maximum number of results per type, default 5
--detail	Detailed mode, shows full fields and relationships

Workflow

Upon receiving $query, process as follows:

Step 1: Determine User Intent

1. ID Query: $query matches an entity ID format (e.g., R0001, AT0034-001) → direct exact query
2. Keyword Query: $query is a short keyword or term (e.g., "CAPTCHA", "DDoS") → search mode
3. Question Consultation: $query is a descriptive problem (e.g., "Our website is being scraped by crawlers") → Q&A mode

Step 2: Execute Search

ID Query

Directly execute:

node <skill_dir>/break_search.mjs "<ID>" --lang zh

Returns the full details of that entry, including expanded relationships. Present directly to the user.

Keyword Search

node <skill_dir>/break_search.mjs "<keyword>" --lang zh

To limit scope:

node <skill_dir>/break_search.mjs "<keyword>" --type risks,avoidances --lang zh

Organize search results and present to the user.

Question Consultation (Core Scenario)

This is the most important usage mode. When a user describes a business security problem:

Step 1: Extract Keywords

Extract 1~3 sets of search keywords from the user's question. For example:

• "Our company's website is being scraped by crawlers" → Keywords: "crawler", "data scraping", "anti-scraping"
• "User accounts keep getting stolen" → Keywords: "account takeover", "credential stuffing", "credential filling"
• "Someone is exploiting promotions on our platform" → Keywords: "promotion abuse", "marketing fraud", "cybercrime"

Step 2: Multi-Round Search

Call the search script for each set of keywords. Can be called multiple times:

# First round: directly search problem keywords
node <skill_dir>/break_search.mjs "crawler" --lang en

# Second round: search related risks and defensive measures
node <skill_dir>/break_search.mjs "anti-scraping" --type avoidances --lang en

# Third round: if needed, search other related areas
node <skill_dir>/break_search.mjs "data leakage" --type risks,cases --lang en

Step 3: Deep Query

Find the most relevant entity IDs from search results and perform exact queries for detailed information:

# View details of crawler risk and its related avoidance measures
node <skill_dir>/break_search.mjs R0027 --lang en

# View details of a specific avoidance measure
node <skill_dir>/break_search.mjs A0003 --lang en

Step 4: Comprehensive Answer

Based on all retrieved knowledge, provide a structured answer:

## Problem Analysis

Based on the BREAK knowledge base, the problem you described involves the following risks:
- **[R0027] Crawler Risk**: ... (cite definition and description)
- **[R0027-001] xxx**: ...

## Defense Recommendations

For the risks above, BREAK recommends the following avoidance measures:
1. **[A0003] Cloud-based Anti-Scraping**: ... (cite definition)
2. **[A0004] Rate Limiting**: ...
3. ...

## Potentially Involved Attack Tools

- **[AT0005] Crawler Tools**: ...

## Related Cases

- **[C0xxx] xxx Case**: ...

> The information above comes from the BREAK knowledge base (https://break.jd.army/)

Important Principles

1. Always search first, then answer: Do not answer business security questions from memory; always query the BREAK knowledge base via the search script
2. Cite sources: Answers must include specific BREAK entity IDs (e.g., R0027, A0003)
3. Multiple searches: If the first round of search results is insufficient or inaccurate, change keywords and search again
4. Relationship expansion: After finding a relevant risk, check its avoidances field for defensive measures; after finding an attack tool, check its directCauseRisks field for associated risks
5. Language adaptation: If the user asks in English, use --lang en for retrieval and answer in English; vice versa

Documentation Freshness Gate

When the search/packaging scripts in scripts/skill/, exported bilingual data packages, entity field/relationship structure, Skill invocation parameters, or search result format change, both SKILL.md and SKILL_en.md must be updated. npm run validate:docs-freshness is integrated into npm run validate:data and will block when related changes lack Skill documentation updates.

Data governance changes also affect Skill search results. When fixing Case references/summary fact validation issues or adjusting Risk avoidances relationships, maintain the English translation files synchronously, and ensure the first two Case references point to stable pages with crawlable body text to prevent Skill-returned case facts from being unverifiable.

Term classification uses a centralized registry key; classification corrections only modify the Chinese structure source and synchronize entity versions. Skill search and display will merge English text at runtime, so no need to repeatedly write category in English entity files.

2026-07-10 ThreatActor coverage governance added logistics arbitrage, malicious logistics practitioners, market manipulation, malicious quantitative trading, AI agent attacks, platform rule abuse operations, and communication resource abuse service roles, using audit:risk-threat-actor-coverage to distinguish pending relationships from explicitly exempted risks; does not change Skill invocation parameters, search fields, or return format.

2026-07-10 ThreatActor citation audit downgraded Wikipedia to a secondary background source, flagged placeholder links such as institutional homepages, news indexes, and research sections, and strengthened threat actor evidence from government, judicial, academic, and original security research sources; does not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 Entity granularity review cleaned up R0285's irrelevant Term relationships and R0159's duplicate Avoidance references; this maintenance does not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 Atomic governance split A0124 into Rug Pull on-chain real-time detection and loss compensation/fund recovery, merged and removed duplicate A0142/A0160, and removed AT0093 for not meeting specific tool admission criteria; relationships have been migrated to existing atomic entities, does not change Skill invocation parameters and return format.

When cleaning Case fact todos, summary only retains information directly supported by the source text: subject, time, action, disposition, and impact. Details such as amounts, quantities, verdicts, or regulatory measures that failed to be scraped, are only supported by titles, or are not covered by sources should be retained only after supplementing with stable sources, or converged to more conservative factual statements.

When strengthening high-value Case references, prioritize official sources such as law enforcement agencies, courts, prosecutors, regulatory bodies, and vendor announcements. If original public pages are unavailable, use authoritative media with crawlable content, local political-legal/public security channels, or stable reprints for cross-verification, and avoid writing details in summary that are only supported by expired original text. Items confirmed as unavailable from original sources and already supported by multiple sources can be recorded in the todo absorption list without fabricating sources to meet the gate.

2026-07-09 Case P1 reference quality maintenance only strengthened C0066, C0130, C0248 references/summary and English translations; did not change Skill invocation parameters, search fields, return format, or entity structure.

Case fact validation uses scraped body text fed to LLM. review-case-fact.mjs prefers Scrapingdog for scraping; on failure or empty body, falls back to local direct connection scraping, handling UTF-8/GBK/GB18030 based on page declaration. When maintaining this script, ensure submitted fragments adequately cover key body paragraphs. For bulk cleanup of P2 todos, set checkpoints at approximately 100 changes, run validate:data/review:changed before committing to avoid long accumulation of unverified changes.

2026-07-09 Case P2 fact validation maintenance only strengthened or converged case summary/references/English translations; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-09 Second batch of Case P2 fact validation checkpoint continued to converge summary, incidentTime, references, and English translations for C0249, C0310, C0401, C0588, C0595, C0635, C0687, C0697, C0705, C0715, C0753, C0755, C0766, C0796, C0797, C0803, C0805, C0819, C0821, C0833, C0948; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 C0354 case maintenance added court system sources and adjusted the case classification to more closely reflect factual attributes of the security incident; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 C0446 case maintenance added the original official WeChat article from Shimen County People's Court and synchronized the English translation; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 Third batch of Case P2 fact validation checkpoint continued to strengthen or converge summary, references, incidentTime, and English translations for cases C0463, C0521, C0522, C0558, C0565, C0571, C0577, C0579, C0593, C0630, C0642-C0720, C0728, C0735, C0744, C0749, C0772, C0781, C0785, C0791, and supplemented avoidance coverage for R0290; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 Fourth batch of Case P2 fact validation maintenance continued to converge summary, incidentTime, and English translations for C0654, C0657, C0684, C1160, C1198, C1235, and added C0226, C0410, C0792, C0798 (already supported by existing stable sources) to the todo absorption list; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 P1 reference quality and subsequent P2 fact validation maintenance strengthened references, summary, incidentTime, and English translations for R0081, R0196, TA0030 and C0484, C0493, C0502, C0508, C0518, C0538, C0802, C0810, C0812, C0813, C0816, C0851, C0878, C0938, C0996, C1050, C1061, C1062, C1075, C1079, C1084, C1090, C1160, C1198, and synchronously corrected sources and avoidance relationships for A0225, R0267; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 P1 reference quality strengthening continued to replace or supplement authoritative sources for AT0076, A0124, A0270, R0168, R0177, TA0058, removed weak forum sources from R0168, and synchronized English translations; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 AI data poisoning relationship review corrected the direct causal relationship of AT0108 to R0273, removed avoidance measures unrelated to data poisoning, and the TA0058 case/risk attribution, and unified the description of TA0058's training, feedback, and retrieval knowledge chain; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 Subsequent Case P2 fact validation maintenance continued to strengthen crawlable sources, summary, incidentTime, and English translations for C1056, C1060, C1064, C1067, C1069, C1077, C1100, C1102; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-10 Case P2 fact validation checkpoint continued to revise summary, references, incidentTime, relationships, and English translations for C1482, C1484, C1485, C1488, C1490, C1493, C1495, C1498, C1500, C1501, C1504, C1505, C1511, C1512, C1518, C1519, C1521, C1523, C1528, C1531, and added a dedicated e-commerce platform product inspection source for A0222-001; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-11 P2 cleanup batch revised fact summaries and sources for C1190, C1251, C1287, C1366, C1377, C1380, C1384, C1386, C1391, C1392, C1393, C1396, C1400, C1401, C1404, C1406, C1407, C1412, C1414, C1416, fixed 5 actor consistency and 5 risk-avoidance relationship todos, and added terms for human-driven brushing, harassment calls, traceability, DEX, privacy coins, zero-shot voice cloning, PII, social engineering, account washing, Tor; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-07-11 Subsequent P1 reference quality maintenance strengthened official or incident-specific sources for C1377, C1384, C1401, C1406, C1414, C1416, and converged C1384's risk description to a supply chain tampering risk supported by sources; did not change Skill invocation parameters, search fields, return format, or entity structure.

2026-09-02 Term T0621 (Clearing and Settlement) reference maintenance replaced references from the People's Bank of China Clearing Center (cncc.cn) with the official page of the "Payment and Settlement Measures" (Yin Fa [1997] No. 393) issued by the Legal Affairs Department of the People's Bank of China, and synchronized the English translation; did not change Skill invocation parameters, search fields, return format, or entity structure.

review:should-extract uses the entire library's entity titles, keywords, aliases, and currently referenced relationships of the entity to identify already covered candidate entities; when maintaining this script, keep duplicate extraction suggestions de-noised to avoid semantically duplicate new entities appearing in Skill search results.

Entity Relationship Graph

Understanding the relationships between entities helps provide more complete answers:

ThreatActor (Who)
    ├── buildAttackTools → AttackTool (builds tools)
    ├── useAttackTools → AttackTool (uses tools)
    ├── directCauseRisks → Risk (directly caused risks)
    └── indirectSupportRisks → Risk (indirectly supported risks)

AttackTool (What tool)
    ├── directCauseRisks → Risk (directly caused risks)
    ├── indirectSupportRisks → Risk (indirectly supported risks)
    └── avoidances → Avoidance (what measures can avoid it)

Risk (What risk)
    └── avoidances → Avoidance (how to avoid)

Case (Case)
    ├── relatedRisks → Risk
    ├── relatedAttackTools → AttackTool
    └── relatedThreatActors → ThreatActor

Term (Term)
    └── related* → all other entity types

BusinessDomain (Business domain)
    ├── riskDimensions → RiskScene (organizes risk scenes by business risk domain)
    └── riskScenes → Risk (list of risks under a scene; parent risk can represent its children)