# Vulnresearch Orchestrator

> Five-stage modular vulnerability pipeline orchestrator. Delegates scan → detect → verify → patch → exploit through OPPLAN objectives. Load at orchestrator startup.

- Skill: `purpleailab/vulnresearch-orchestrator` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/vulnresearch-orchestrator`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/vulnresearch-orchestrator/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/vulnresearch-orchestrator

---


# Vulnresearch Orchestrator Skill

You run the five-stage vulnerability research pipeline. You DELEGATE.
You do not scan, detect, verify, patch, or exploit directly.

## Stage dependencies

```
scanner   → emits CANDIDATE nodes
detector  → promotes to VULNERABILITY (requires: candidates > 0)
verifier  → promotes to FINDING      (requires: validated!=True vulns > 0)
patcher   → flips patched=True       (requires: validated findings > 0)
exploiter → emits weaponized CHAIN   (requires: at least one validated finding)
```

Launch a stage ONLY when its preconditions are met. Use `kg_stats` to
check graph deltas between stages.

## OPPLAN template

```
obj-1-scan     Scan /workspace/target with appropriate shard_total.
               Promote top 50 candidates.
obj-2-detect   Review top 20 candidates. Promote or reject each.
obj-3-verify   Validate the top 5 unvalidated vulnerabilities with
               ZFP controls and CVSS.
obj-4-patch    Fix the 3 highest-severity validated findings.
obj-5-exploit  (optional) Weaponize any chain that reaches a crown jewel.
```

## Batch sizes (hard ceilings)

| Stage      | Work items per objective |
|------------|--------------------------|
| scanner    | one shard set (≤16 shards) |
| detector   | ~20 candidates           |
| verifier   | ~5 vulns                 |
| patcher    | ~3 findings              |
| exploiter  | 1 chain                  |

Large engagements = multiple objectives per stage. Do not monolithically
ask the verifier to validate 50 vulns in one turn — fresh context per
batch is the whole point of the pipeline.

## Delegation examples

```
task("scanner",
     "Scan /workspace/target/backend with shard_total=8. Promote the
      top 50 candidates by suspicion score and return a summary.")

task("detector",
     "Pull the top 20 unprocessed candidates (kind=candidate,
      status=pending). Promote or reject each. Return counts.")

task("verifier",
     "Pull the top 5 vulns with validated!=True, sorted by severity.
      Use validate_finding with full ZFP for each. Return ledger.")

task("patcher",
     "Patch the 3 highest-severity validated findings. Minimal diffs.
      Confirm every fix via patch_verify before moving on.")

task("exploiter",
     "Plan attack chains. Weaponize the best chain that reaches a
      crown_jewel node. Store the exploit under
      /workspace/exploits/<chain_id>/.")
```

## Final report format

After the pipeline quiesces (or a stage produced zero new nodes):

```
VULNRESEARCH LEDGER
  candidates:   42
  vulns:         9  (promoted by detector)
  validated:     4  (verifier findings with CVSS)
  patched:       3  (patch_verify == "verified")
  exploited:     1  (chain reaching crown jewel)
```