| name | research-ingest |
| description | Ingest a CVE writeup, blog post, advisory, or GitHub repo into the wiki - fetch, dedup via sources:, update the right technique/tool page(s), re-index. Generic knowledge only; never client data. |
Research Ingest
Turn an external source (URL or raw/research/ file) into durable wiki knowledge. Synthesise into existing technique/tool pages; do NOT create one page per source. Full workflow: docs/workflows.md (Research ingest / Git repo ingest).
Procedure
-
Fetch the source.
- URL:
defuddle parse <url> --md for clean markdown (install: npm i -g defuddle); fall back to the WebFetch tool.
- Local: read the file under
raw/research/. GitHub repo: clone via WSL only (wsl -d kali-linux -u kali -- git clone <url> /home/kali/<name>), then read source/README.
-
Find the home page. qmd_query "<technique/CVE class>" via wiki-search MCP -> identify the technique/tool page that should hold this. One class = one page.
-
Dedup (skip rule). Read only the target page's frontmatter. If the ingest slug is already in sources:, STOP - already ingested. Otherwise continue.
-
Synthesise the new payload / bypass / CVE chain / detail into the page's existing sections (Methodology, Key payloads, Bypasses and variants). Add concrete commands in code blocks. Reconstruct any image into a code block - never embed images. No em-dashes.
-
Tool page if a new standalone tool appears: create/update wiki/tools/<tool>.md.
-
Record the source. Add the slug to the page's sources: list; bump date_updated. Register URL/path + slug in raw/manifest.md.
-
Re-index + log. python3 scripts/gen_index.py (catalog) and, after a bulk session, qmd update (search index). Append a one-line entry to session/log.md. Run python3 scripts/lint-wiki.py -q - must be clean.
Guardrails
- Generic only. Wiki holds reusable methodology; client/engagement specifics stay in
targets/<eng>/. Reusable default creds -> wiki/cheatsheets/default-credentials.md; reusable request patterns -> api-request-findings.md.
- Prefer enriching an existing page over creating a new one. New page only for a genuinely new technique/tool class.
Report: page(s) updated + slug added + lint status.
