search-first

name	search-first
description	Systematizes the "search for existing tools, exploits, and techniques before writing custom ones" workflow.
origin	openclaw
version	0.2.0.2
compatibility	["openclaw","claude-code","cursor","windsurf"]
allowed-tools	["Bash","Read","Write","Edit","WebSearch","WebFetch","Agent"]
defense_triple_required	false
metadata	{"domain":"workflow","tool_count":0,"guide_count":5,"last_reviewed":"2026-07-26"}

Skill: Search First — Research Before You Exploit

Supplementary Files:

• payloads.md — Search templates for ExploitDB, GitHub, Metasploit, Nuclei, and Kali packages with evaluation scoring
• test-cases.md — Structured test cases for CVE discovery, tool discovery, technique research, and custom build decisions

Summary

Search First skill domain covering workflow operations.

Domain: workflow

Description

Systematizes the "search for existing tools, exploits, and techniques before writing custom ones" workflow. In penetration testing, this means: before developing a custom exploit or tool, search for existing solutions in exploit databases, security tools, GitHub repositories, and community resources.

This skill prevents reinventing the wheel and ensures kali-claw leverages the full ecosystem of existing security tools and known exploit techniques.

Use Cases

• Before writing a custom exploit: search Exploit-DB, GitHub, and security blogs for existing PoCs
• Before building a reconnaissance tool: check if nmap scripts, Nuclei templates, or Metasploit modules already exist
• Before developing a post-exploitation technique: search for existing tools and frameworks
• When facing an unfamiliar technology: research known vulnerabilities and attack paths before testing
• Before creating automation scripts: check if existing tools already provide the capability

Methodology

Search-First Decision Flow

┌─────────────────────────────────────────────┐
│  1. NEED ANALYSIS                           │
│     Define what capability is needed         │
│     Identify target technology/constraints   │
├─────────────────────────────────────────────┤
│  2. PARALLEL SEARCH                         │
│     ┌──────────┐ ┌──────────┐ ┌──────────┐  │
│     │ ExploitDB│ │  GitHub  │ │  Security │  │
│     │ MSF/NS   │ │  PoCs    │ │  Blogs    │  │
│     └──────────┘ └──────────┘ └──────────┘  │
├─────────────────────────────────────────────┤
│  3. EVALUATE                                │
│     Score: reliability, compatibility,      │
│     OPSEC, maintenance, detection risk      │
├─────────────────────────────────────────────┤
│  4. DECIDE                                  │
│     ┌─────────┐  ┌──────────┐  ┌─────────┐  │
│     │  Use    │  │  Modify  │  │  Build   │  │
│     │ as-is   │  │  /Wrap   │  │  Custom  │  │
│     └─────────┘  └──────────┘  └─────────┘  │
├─────────────────────────────────────────────┤
│  5. EXECUTE                                 │
│     Run existing tool / Modify template /   │
│     Write minimal custom exploit            │
└─────────────────────────────────────────────┘

Decision Matrix

Signal	Action
Exact exploit exists for target version	Use — run directly, verify results
Similar exploit exists for adjacent version	Modify — adapt parameters/payloads
Multiple partial tools cover the need	Compose — chain existing tools together
Nothing suitable found	Build — write custom, but informed by research

Search Sources by Category

Exploit & Vulnerability Search

# Exploit-DB local search
searchsploit apache 2.4.49 remote
searchsploit -x 12345  # Examine exploit code

# GitHub PoC search
gh search code "CVE-2025-12345" --limit 20
gh search repos "<tool-name> exploit" --sort stars

# Metasploit module search
msfconsole -x "search type:exploit name:<keyword>"

# Nuclei template search
nuclei -tl -tags cve | grep "<keyword>"

Tool & Capability Search

# Kali package search
apt search <keyword>
dpkg -l | grep <tool>

# GitHub security tool search
gh search repos "<capability> security tool" --sort stars --limit 20

# Exploit framework module search
msfconsole -x "search type:auxiliary name:<keyword>"
msfconsole -x "search type:post name:<keyword>"

Technique & Methodology Search

# MITRE ATT&CK technique lookup
# Web: https://attack.mitre.org/techniques/enterprise/

# HackTricks methodology
# Web: https://book.hacktricks.wiki/

# PayloadsAllTheThings
# Web: https://github.com/swisskyrepo/PayloadsAllTheThings

# GTFOBins / LOLBAS
# Web: https://gtfobins.github.io/
# Web: https://lolbas-project.github.io/

Integration with Other Skills

• With deep-research: Use deep-research for broad topic investigation, search-first for quick tool/exploit lookup
• With security-bounty-hunter: Search for existing reports before hunting similar vulnerabilities
• With terminal-ops: Execute found tools with evidence capture protocol
• With osint: Combine OSINT gathering with tool search for comprehensive preparation

Detection Methods

Search Pattern Audit

• Anomalous query volume: Single token consuming >10x typical search rate.
• Cross-domain correlation: Aggregating data from many domains (OSINT signature).

SIEM Detection Rules

• Splunk SPL: index=search | stats count by user | where count > 1000

Defense Evasion Techniques

Stealth Search

• Distribute across accounts: Use multiple tokens; below per-token limits.
• Slow & methodical: Pace queries below anomaly threshold.
• Cache results: Avoid re-querying same data.
• Mimic legitimate usage: Use natural language queries matching typical patterns.

Anti-Patterns

• Jumping to custom code: Writing an exploit without checking Exploit-DB or Metasploit
• Ignoring version specificity: Using an exploit for the wrong version without adaptation
• Over-customizing: Wrapping a tool so heavily it loses its original capability
• Tool hoarding: Installing every tool found instead of mastering the best one

Examples

Example 1: Exploit Apache Path Traversal

Need: Exploit path traversal in Apache 2.4.49
Search: searchsploit apache 2.4.49 path traversal
Found: CVE-2021-41773, multiple PoCs on GitHub
Action: USE — curl-based PoC is sufficient
Result: curl "http://target/cgi-bin/.%2e/%2e%2e/etc/passwd"

Example 2: Active Directory Enumeration

Need: Enumerate AD domain from compromised Windows host
Search: GitHub "Active Directory enumeration tool"
Found: BloodHound, SharpHound, ldapsearch-ad, Certipy
Action: USE — BloodHound/SharpHound is the standard
Result: Run SharpHound, import to BloodHound for analysis

Example 3: TLS Reverse Shell

Need: Reverse shell bypassing egress filtering (only port 443)
Search: GitHub "reverse shell tls encrypted"
Found: Several TLS-encrypted shell tools
Action: MODIFY — adapt existing TLS shell for constraint
Result: Minimal custom wrapper around existing tool

Orchestration

ECC Loop Pattern

• Pattern: Learning Cycle (search → evaluate → decide → refine search if needed)
• Rationale: Searching is iterative — initial searches inform subsequent queries, and results are refined based on relevance scoring until a suitable solution is found or the decision is made to build custom
• Integration: deep-research (broad topic investigation), terminal-ops (execute found tools), continuous-learning (remember which sources are reliable per topic), docker-patterns (lab verification of found exploits)

Cross-Skill Pipeline

search-first → [any attack skill] → verification-loop
      ↓                                     ↑
deep-research (broader context)    continuous-learning (persist tool knowledge)

Quality Gate

• Pre-condition: Need clearly defined (service/version/technique)
• Post-condition: At least one result evaluated with scoring matrix, or documented decision to build custom
• Verification: Selected tool/exploit tested against lab or verified against documentation