| name | asp-artifact-en |
| description | Find artifacts by IOC and attach enrichment to artifacts. |
| argument-hint | review artifact <artifact_id> | list artifacts [filters] |
| compatibility | connect to asp mcp server |
| metadata | {"author":"Funnywolf","version":"0.1.0","mcp-server":"asp","category":"cyber security","tags":["artifact","pivot","enrichment","investigation"],"documentation":"https://asp.viperrtp.com/"} |
ASP Artifact
Use this skill when the user needs to investigate artifacts on ASP.
Artifacts are created automatically by system processes. You can list and analyze existing artifacts, and save analysis back through enrichment.
When to Use
- The user wants to find artifacts by value, type, role, owner, or reputation.
- The user wants to attach enrichment or structured analysis to an artifact.
Operating Rules
- Treat artifacts as the smallest investigation object on the platform.
- Use
list_artifacts for lookup and review.
- If the user wants to save analysis on the artifact itself, use
create_enrichment plus attach_enrichment_to_target.
- For the full enrichment persistence workflow, use the
asp-enrichment-en skill.
Additional Information
rowid is the UUID for each artifact record and is used for data association.artifact_id is the human-readable unique ID for each artifact record.
Decision Flow
- If the user wants to find or review an artifact, call
list_artifacts.
- If the user wants to attach intelligence, analysis notes, or structured analysis to an artifact, use the
asp-enrichment-en skill.
- If the user is investigating from an artifact, treat the artifact as the smallest pivot object and suggest the next most useful hop only when needed.
SOP
List Artifacts
- Extract the narrowest useful filters from the request.
- Call
list_artifacts.
- Parse the returned JSON strings.
- Present a compact artifact view. If the user will likely attach or reuse the artifact next, surface the artifact rowid explicitly.
Preferred response structure:
| Artifact ID | Value | Type | Role | Owner | Reputation | Summary |
|---|
Then add one short explanation line when needed.
Clarification Rules
- Ask for
artifact_id only when the user wants to enrich an existing artifact and did not provide it.
Output Rules
- Be concise.
- Do not output raw JSON unless the user explicitly asks for it.
- Prefer pivot-oriented wording over storage wording.
- When many artifacts match, show the most valuable subset and briefly explain the overall pattern.
Failure Handling
- If no artifacts match, say so directly and suggest the most useful refinement.
- If the target artifact does not exist, say so directly.
