---
name: research-ingest
description: Ingest a CVE writeup, blog post, advisory, or GitHub repo into the wiki - fetch, dedup via sources:, update the right technique/tool page(s), re-index. Generic knowledge only; never client data.
---

# Research Ingest

Turn an external source (URL or `raw/research/` file) into durable wiki knowledge. Synthesise into existing technique/tool pages; do NOT create one page per source. Full workflow: `docs/workflows.md` (Research ingest / Git repo ingest).

## Procedure

1. **Fetch the source.**
   - URL: `defuddle parse <url> --md` for clean markdown (install: `npm i -g defuddle`); fall back to the `WebFetch` tool.
   - Local: read the file under `raw/research/`. GitHub repo: clone via WSL only (`wsl -d kali-linux -u kali -- git clone <url> /home/kali/<name>`), then read source/README.

2. **Find the home page.** `qmd_query "<technique/CVE class>"` via wiki-search MCP -> identify the technique/tool page that should hold this. One class = one page.

3. **Dedup (skip rule).** Read only the target page's frontmatter. If the ingest slug is already in `sources:`, STOP - already ingested. Otherwise continue.

4. **Synthesise** the new payload / bypass / CVE chain / detail into the page's existing sections (Methodology, Key payloads, Bypasses and variants). Add concrete commands in code blocks. Reconstruct any image into a code block - never embed images. No em-dashes.

5. **Tool page** if a new standalone tool appears: create/update `wiki/tools/<tool>.md`.

6. **Record the source.** Add the slug to the page's `sources:` list; bump `date_updated`. Register URL/path + slug in `raw/manifest.md`.

7. **Re-index + log.** `python3 scripts/gen_index.py` (catalog) and, after a bulk session, `qmd update` (search index). Append a one-line entry to `session/log.md`. Run `python3 scripts/lint-wiki.py -q` - must be clean.

## Guardrails
- **Generic only.** Wiki holds reusable methodology; client/engagement specifics stay in `targets/<eng>/`. Reusable default creds -> `wiki/cheatsheets/default-credentials.md`; reusable request patterns -> `api-request-findings.md`.
- Prefer enriching an existing page over creating a new one. New page only for a genuinely new technique/tool class.

Report: page(s) updated + slug added + lint status.