knowledge/deep-research-generic/SKILL.md
File-backed deep research with recursive link-following, multi-tool web fetching, and step-by-step synthesis. Use when the user asks to research, investigate, analyze, or summarize a topic in depth; when a thorough answer requires gathering and cross-referencing multiple sources; or when output must be comprehensive, cited, and not limited by context window size. For CVE/exploit/threat-intel research → use deep-research-offensive.
npx skillsauth add aeondave/malskill deep-research-genericInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
File-backed, multi-pass research workflow. Each useful page is fetched, cleaned, and saved to an intermediate file. Linked pages are recursively followed. All intermediate files are synthesized step-by-step into a single comprehensive research document.
Core principle: Use the file system as extended memory. Never rely on context alone — save everything worth keeping, then synthesize from files.
Before any search:
.research/{topic-slug}/
├── _plan.md # Sub-questions, priorities, URL queue, gap tracker
├── pages/ # One .md file per fetched page
└── output.md # Final synthesized research document
_plan.md with sub-questions and an empty URL queue sectionAsk at most two clarifying questions. If the request is clear, proceed immediately.
For each sub-question, run parallel searches to discover URLs:
web_search (primary): one query per sub-question; multi-provider, synthesized results with citationsfetch_content on https://s.jina.ai/{search-query}search_depth: basic, max_results: 5–10From results:
_plan.md under the URL queueProcess each queued URL individually:
3a. Fetch using the tool hierarchy (stop at first success):
| Priority | Tool | When |
|---|---|---|
| 1 | fetch_content (Jina proxy) | https://r.jina.ai/{url} — strips boilerplate, cleanest markdown |
| 2 | fetch_content (direct) | APIs, raw JSON, PDFs, GitHub repos |
| 3 | Tavily extract | MCP-available; structured extraction |
| 4 | Playwright | JS-rendered SPAs, dynamic tables |
Jina proxy: fetch_content on https://r.jina.ai/{full-url-with-scheme}
Converts any page to clean markdown. Strips ads, nav, popups. Falls back to Gemini for bot-blocked pages.
Escalation: Jina proxy empty → fetch_content direct → Tavily extract → Playwright.
3b. Evaluate: Is the content relevant and citable? If not, mark URL as skipped in _plan.md and move on.
3c. Save to intermediate file pages/{NNN}_{slug}.md:
# {Page Title}
- **Source**: {URL}
- **Fetched**: {date}
- **Serves**: {sub-question name}
- **Relevance**: high/medium/low
## Content
{Cleaned content: facts, data, quotes, code, citations.
Remove navigation, ads, boilerplate. Summarize verbose sections
but preserve all critical detail and data points.}
## Outbound Links
- {URL1} — {why it might be useful}
- {URL2} — {why it might be useful}
3d. Extract links: Identify all outbound links that could deepen the research. Add relevant new URLs to the queue in _plan.md.
Repeat Step 3 for newly queued links. Stop when:
Update _plan.md queue: mark each URL as fetched, skipped, or queued.
After all fetch rounds:
_plan.md with gap analysisBuild output.md incrementally from intermediate files:
output.md with inline citations [N]
c. Move to the next dimensionKey: Each section reads only its relevant files. The research depth is limited only by the data found, not by context window size.
Structure of output.md:
## Executive Summary
[2–3 sentences. Key conclusions + overall confidence.]
## Key Findings
- **{Finding}**: {1 sentence} — Confidence: High/Medium/Low [N]
## Detailed Analysis
### {Dimension 1}
{Analysis with inline citations [1][2].}
### {Dimension 2}
...
## Consensus
[What sources agree on.]
## Conflicts and Uncertainty
[Where sources disagree or data is missing.]
## Sources
[1] Author/Org, "Title", URL — date — Tier N
[2] ...
## Gaps and Follow-up Questions
[What this research does NOT answer.]
Present output.md to the user. Intermediate files remain available for follow-up.
Jina proxy: fetch_content(url="https://r.jina.ai/{target-url-with-scheme}")
Direct: fetch_content(url="{target-url}")
Handles URLs, GitHub repos, PDFs (text extraction), and YouTube transcripts. Jina proxy strips boilerplate, returns clean markdown. Direct mode for APIs, raw text, and documents. Gemini fallback activates automatically for bot-blocked pages.
Multi-provider search (OpenAI, Brave, Perplexity, Exa, Tavily, Gemini). Returns synthesized answer with source citations.
web_search(queries=["sub-question 1", "sub-question 2"]) # parallel
web_search(query="...", recencyFilter="month") # time-bounded
Use numResults=10 for broad sweeps. Post-filter URLs for relevance before deep-fetching.
| Tool | Use |
|---|---|
| tavily_search | Keyword search; search_depth: basic/advanced/ultra-fast |
| tavily_extract | Content extraction from known URLs |
| tavily_crawl | Multi-page crawl (expensive — use last) |
| tavily_map | Enumerate URLs before crawling |
Query rules: max 400 chars, one topic per query, include_domains instead of site:, score > 0.5 filter. Use search_depth: advanced + chunks_per_source: 3 for precise fact retrieval.
Use when fetch_content and Tavily return empty or incomplete content:
| Tier | Examples | Credibility | |---|---|---| | 1 | Peer-reviewed journals, official statistics | High | | 2 | Government/NGO reports, industry standards | High | | 3 | Reputable news outlets, expert commentary | Medium | | 4 | Blogs, forums, unverified claims | Low — verify independently |
development
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
development
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
development
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
databases
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.