web-research

Web research skill

Turn a question about a target into grounded, cited knowledge — search → read → verify → remember — using MoonMCP's keyless OSINT tools. This is passive: it queries search engines and reads third-party pages, it does not send packets to the engagement target (use the moonmcp skill's scoped tools for that).

The loop

1. RECALL first. Before searching, check what's already known: memory_brief(target) for a rollup, or memory_search(query, target=…). Another agent/session may have done this already — build on it, don't redo it.
2. Search with web_search(query, site=…, max_results=…). It's multi-engine (DuckDuckGo → DDG Lite → Bing) and returns {title, url, snippet} per hit plus the engine that answered. Scope to one domain with site="example.com". For operator-grade queries use search_dorks(domain, category=…) and feed a dork string into web_search.
3. Read the promising results with web_read(url) — it returns the page's clean title, description, main text, and outbound links. Read the source before you trust a snippet; snippets lie or truncate.
4. Verify across sources. One page is a lead; two independent pages agreeing is a fact. Note contradictions rather than picking one silently.
5. Remember (see the memory skill). Persist conclusions so the next agent starts ahead of where you did.

Query craft

• Narrow with site: — web_search("login", site="acme.com") finds acme's own login surface; drop site to find third-party mentions (leaks, forums, GitHub, breach posts).
• search_dorks(domain) generates categorised dorks: subdomains, files (sql/bak/env/log), config_secrets, login_admin, directory_listing, errors_debug, code_leaks (GitHub/Pastebin/S3), exposed_services, open_redirect_ssrf. Run a category, then web_search each dork.
• Pivot on what you read — a vendor/version in a page → cve_search it; an employee/email → email_security; an IP/ASN → ip_intel / reverse_ip; a subdomain → hand it to the moonmcp recon flow (in scope only).