secagent-knowledge

SecAgent Knowledge — Local LLM-Wiki

Loading this SKILL gives you a complete local knowledge management system. This is not documentation — you actually create and maintain a structured wiki.

Bootstrap (first load)

1. Determine wiki root:
   WIKI_ROOT = {workspace}/wiki

2. Create directory skeleton:
   mkdir -p {WIKI_ROOT}/entities/{ips,domains,cves,tools}
   mkdir -p {WIKI_ROOT}/concepts/{attack-methods,defense-tech,design-patterns}
   mkdir -p {WIKI_ROOT}/discoveries/{scan-results,vuln-findings,pocs}
   mkdir -p {WIKI_ROOT}/synthesis/{reports,analysis,summaries}

3. Initialize INDEX.md at {WIKI_ROOT}/INDEX.md:
   "# Wiki Index\n\nLast updated: {timestamp}\n\n## Entities\n\n## Discoveries\n\n## Synthesis\n"

4. Confirm: "Wiki ready at {WIKI_ROOT}. Starting knowledge production."

The Knowledge Loop: Produce → Structure → Retrieve → Reuse

Produce (on every discovery)

Trigger → Action:
  IP + port + service found           → write entities/ips/{ip}.md
  Product + version identified        → search CVEs first, then write entities/cves/{cve-id}.md
  CVE matched                         → write entities/cves/{cve-id}.md
  Vulnerability confirmed             → write discoveries/vuln-findings/F{###}.md
  PoC successful                      → write discoveries/pocs/{finding-id}-poc.md
  Sub-agent returns results           → extract findings → write to matching directory
  Attack pattern identified           → write concepts/attack-methods/{technique}.md

File naming: use entity identifiers (IP, CVE ID, Finding ID), not descriptive titles.
After each write: append to the matching section in INDEX.md.

Structure (write with exact templates)

IP Entry (wiki/entities/ips/{ip}.md):

# {ip}
- **First seen**: {timestamp}
- **Last seen**: {timestamp}
- **Hostname**: {hostname or "unknown"}
- **OS**: {os or "unknown"}

## Open Ports
| Port | Service | Version | CVE |
|------|---------|---------|-----|
| {port} | {service} | {version} | {cve or "—"} |

## Findings
- [{finding-id}](../discoveries/vuln-findings/{finding-id}.md): {one-line summary}