version: "1.0.1" name: web-research description: Perform web research using CVE databases, security advisories, and threat intelligence sources. Use when the user asks about CVEs, security news, vulnerabilities, patch releases, or any external security information not available in the workspace.

Web Research

Use this skill when you need to find external security information that is not already in the OASM platform.

When to Use

• User asks about a specific CVE (e.g., "what is CVE-2024-1234?")
• User asks about recent vulnerabilities or exploits
• User wants to know about patch releases or security advisories
• User asks about industry-specific threats or news
• User needs context about a technology or software vulnerability

Core Tool: retrieve_web_page

Use retrieve_web_page to fetch content from any public URL. It returns statusCode and body.

retrieve_web_page({ url: "https://example.com/path" })

Always use retrieve_web_page instead of trying to construct fetch requests manually. It handles User-Agent headers and error handling automatically.

Workflow

0. Goal and Todo (Agent mode)

Before the first fetch, call formulate_plan(steps), then start step 1 with transition_step(id, "in_progress"); tool calls are refused until a step is in progress.

• Goal: generated from the request and pinned above the plan, e.g. "Is there a public exploit for CVE-2024-1234 and a fixed version of the affected package?" Pass a goal to formulate_plan only to correct it.
• Steps: identify sources, fetch and analyze, correlate with the workspace, save what matters.

Stop fetching once the pinned goal is answered; links that lead elsewhere go under next steps.

1. Identify What You Need

Before fetching, know what information you're looking for:

• CVE details → fetch from Trickest/NVD
• Exploit PoC → fetch from GitHub/Exploit-DB
• Vendor patches → fetch from vendor advisory pages
• Threat news → fetch from security news sites

2. Build the URL

Pick the right source for the query:

3. Fetch and Analyze

1. Call retrieve_web_page with the constructed URL
2. Parse the body content — extract relevant sections
3. If the page has links to related content, fetch up to 3-5 linked pages for comprehensive analysis
4. Synthesize findings from multiple sources

4. Correlate with Workspace

After gathering external intel, map findings back to the workspace:

• Use enumerate_assets or fingerprint_technologies to check if affected software is in use
• Use discover_vulnerabilities to see if the CVE is already tracked
• Use enumerate_open_issues to check if someone is already investigating

5. Save Important Findings

• Use stm_write to store research results for the current conversation
• Use ltm_append to persist critical threat intelligence

Query Tips

• Include version numbers: "Apache 2.4.49 path traversal" not just "Apache vulnerability"
• Include year for CVEs: "CVE-2024-1234" narrows results
• Use specific terms: "Log4Shell RCE" not "Log4j issue"
• For zero-days, search for the vendor advisory page directly