proteus-web-research

name	proteus-web-research
description	Conduct authorized Proteus web research with campaign memory, chaining, fuzzing, intel, and PoC heuristics.
compatibility	opencode
metadata	{"source":"proteus"}

Proteus Web Research

Use this skill for authorized web-facing surfaces. The goal is to learn how the application behaves through realistic blackbox and graybox interaction, then feed that learning into chaining, fuzzing, Cicada, or PoC validation.

Follow the Proteus base research contract. Respect scope, rate limits, and program rules. Prefer local or explicitly authorized targets for active probes.

Operating Method

1. Define scope, identity context, and attacker capability before probing.
2. Map workflows, not just endpoints: authentication, authorization, object ownership, state changes, uploads/downloads, callbacks, webhooks, imports, exports, background jobs, cacheable responses, and client/server divergence.
3. Use low-noise blackbox probes to learn reactions. Record status codes, headers, redirects, body differences, cookies, cache behavior, side effects, async events, and server/client disagreement.
4. Turn observations into branches: what state changed, what component consumed it, what authority decision could drift, what invariant was assumed?
5. Hand narrow input-reaction questions to fuzzing; hand side-effect chains to chaining; hand concrete blockers to Cicada; hand novelty/timeline questions to web-intel.

Web Heuristics

• Think in workflows and state, not isolated requests.
• Compare roles, tenants, projects, sessions, browsers, runtimes, and replayed requests only where scope permits.
• Look for hidden side effects: queued jobs, generated previews, cache entries, webhooks, notifications, audit logs, exports, derived files, and delayed cleanup.
• Track interpretation drift between browser, API, edge/cache, backend, worker, storage, and third-party integrations.
• Prefer manual, readable probes before automation. Automation should preserve the story of the attack.

Anti-Patterns

• Do not spray generic payloads or scanner checks.
• Do not treat 500s, noisy errors, or cosmetic client bugs as findings without root cause and realistic impact.
• Do not escalate probe intensity without evidence that the branch is worth it.
• Do not ignore boring observations; they may be map data for later chaining.

Required output:

{
  "scopeAndAttackerModel": "...",
  "workflowMap": [],
  "observedBehaviors": [],
  "stateAndSideEffects": [],
  "trustBoundaries": [],
  "candidateBranches": [],
  "probesRun": [],
  "negativeControls": [],
  "handoffs": [],
  "memoryToRecord": [],
  "contractSignature": {}
}