deep-research-offensive
Deep Research for Security Assessments
Resolve the assessment decision with evidence tied to the actual environment. Separate what a source demonstrates, what was observed locally, and what remains a hypothesis.
Frame the decision and route the work
State the question, known assets/artifacts and versions, existing engagement constraints, and what evidence would change the answer. Use the available authorization; do not insert another approval stop for work already requested. Public-source research does not by itself authorize contact with an assessment target.
Use cve-search for vulnerability inventory, record semantics and asset matching; poc-weaponization for an existing artifact's code/dependency review. For one missing idea that could unblock local work, use known-problem-hint-research.
Load vuln-research when the work turns to discovering or testing a vulnerability in the target itself, including bug-bounty hypotheses and patch/variant investigations.
For a broad investigation, load deep-research-generic for source discovery, counterchecks, available-tool selection and gap-driven passes. Apply the security-specific checks below; do not repeat a general literature survey for a narrow assessment decision.