oasm-platform/open-asm/web-research

Web Research

Use this skill when you need to find external security information that is not already in the OASM platform.

When to Use

• User asks about a specific CVE (e.g., "what is CVE-2024-1234?")
• User asks about recent vulnerabilities or exploits
• User wants to know about patch releases or security advisories
• User asks about industry-specific threats or news
• User needs context about a technology or software vulnerability

Core Tool: retrieve_web_page

Use retrieve_web_page to fetch content from any public URL. It returns statusCode and body.

retrieve_web_page({ url: "https://example.com/path" })

Always use retrieve_web_page instead of trying to construct fetch requests manually. It handles User-Agent headers and error handling automatically.

Two jobs use it:

• Vulnerability intelligence — CVE detail, exploit availability, vendor advisory, fixed version.
• Payload and bypass research — when a WAF or parser drops your payload, fetch what actually works against that product or edge before inventing variants from memory. The current corpus from a public research page beats a remembered payload from training data, and you cite the page you took it from.

Workflow

0. Goal and Todo (Agent mode)

Before the first fetch, call formulate_plan(steps), then start step 1 with transition_step(id, "in_progress"); tool calls are refused until a step is in progress.

• Goal: generated from the request and pinned above the plan, e.g. "Is there a public exploit for CVE-2024-1234 and a fixed version of the affected package?" Pass a goal to formulate_plan only to correct it.
• Steps: identify sources, fetch and analyze, correlate with the workspace, save what matters.

Stop fetching once the pinned goal is answered; links that lead elsewhere go under next steps.

1. Identify What You Need

Before fetching, know what information you're looking for:

• CVE details → fetch from Trickest/NVD
• Exploit PoC → fetch from GitHub/Exploit-DB
• Vendor patches → fetch from vendor advisory pages
• Threat news → fetch from security news sites

2. Build the URL

Pick the right source for the query:

3. Fetch and Analyze

1. Call retrieve_web_page with the constructed URL
2. Parse the body content — extract relevant sections
3. If the page has links to related content, fetch up to 3-5 linked pages for comprehensive analysis
4. Synthesize findings from multiple sources and keep the URL of each fact you reuse — a claim with no source is a claim the main agent cannot check
5. Prefer the primary source (vendor advisory, NVD, CISA KEV, the project's own security page) over a blog or an aggregator, and say which one you used

4. Correlate with Workspace

After gathering external intel, map findings back to the workspace:

• Use enumerate_assets or fingerprint_technologies to check if affected software is in use
• Use discover_vulnerabilities to see if the CVE is already tracked
• Use enumerate_open_issues to check if someone is already investigating

5. Save Important Findings

• Use stm_write to store research results for the current conversation
• Use ltm_write to persist critical threat intelligence

Query Tips

• Include version numbers: "Apache 2.4.49 path traversal" not just "Apache vulnerability"
• Include year for CVEs: "CVE-2024-1234" narrows results
• Use specific terms: "Log4Shell RCE" not "Log4j issue"
• For zero-days, search for the vendor advisory page directly