attack-surface

分类: 开发与编程 | 上传者: kirillgreen | 下载: 0 | 版本: v1.0（最新）

战略研究框架，通过结构化的权力问题将数月的市场/竞争研究压缩为数小时。使用由 Exa 驱动的并行情报收集，从竞争对手数据、评论和行业来源中提取未言明的行业见解、脆弱的市场假设和战略攻击面。当用户说“攻击面”、“研究市场”、“竞争分析”、“分析竞争对手”、“寻找市场机会”、“对这个想法进行压力测试”、“市场研究”、“评估机会”、“寻找盲点”、“市场进入”时使用，或者当用户想要深入了解市场、评估新方向、寻找行业盲点、评估合作伙伴关系或分析机会时使用。请勿用于代码审查、测试、部署、错误修复或实施任务。 --- # 攻击面 — 战略研究框架将数月的市场研究压缩为数小时。 3 小时和 3 个月之间的区别不在于信息量，而在于了解哪些问题真正重要。该框架不是“总结这些”或“分析竞争”，而是提取： - **不言而喻的见解** - 成功的参与者了解客户从未大声说出的内容 - **脆弱的假设** - 整个市场建立的信念，以及它们如何打破 - **攻击面** - 盲点，脆弱的共识，无人谈论的开放 ## 何时使用 - 进入新市场或垂直市场 - 评估新的功能方向现有项目 - 评估合作伙伴关系或平台机会 - 在提交之前对业务创意进行压力测试 - 寻找竞争盲点和服务不足的利基市场 - 任何受益于深入循证分析的战略问题 ## 工作流程概述 7 个阶段，在自动情报收集和用户引导分析之间交替： |相|名称 |模式|输出| |--------|------|------|--------| | 1 |简报 | 互动|研究简介 | | 2 |来源收藏|自动化（并联

更新日志: Source: GitHub https://github.com/kirillgreen/skills

目录结构

当前层级: tree/main/attack-surface/

📁 references/
- 📄 analyst-prompt.md 6.1 KB
- 📄 gatherer-prompt.md 5.2 KB
📄 README.md 2.5 KB
📄 SKILL.md 12.8 KB

SKILL.md

---
name: attack-surface
description: >
  Strategic research framework that compresses months of market/competitive research into hours through structured power questions. Extracts unspoken industry insights, fragile market assumptions, and strategic attack surfaces from competitor data, reviews, and industry sources using parallel Exa-powered intelligence gathering.
  Use when user says "attack surface", "research the market", "competitive analysis", "analyze competitors", "find market opportunity", "stress-test this idea", "market research", "evaluate opportunity", "find blind spots", "market entry", or when they want to deeply understand a market, evaluate a new direction, find industry blind spots, assess a partnership, or analyze opportunities.
  Do NOT use for code review, testing, deployment, bug fixing, or implementation tasks.
---

# Attack Surface — Strategic Research Framework

Compress months of market research into hours. The difference between 3 hours and 3 months isn't the amount of information — it's knowing which questions actually matter.

Instead of "summarize these" or "analyze the competition", this framework extracts:
- **UNSPOKEN INSIGHTS** — what successful players understand that customers never say out loud
- **FRAGILE ASSUMPTIONS** — beliefs the entire market is built on, and how they break
- **ATTACK SURFACES** — the blind spots, the fragile consensus, the opening nobody is talking about

## When to Use

- Entering a new market or vertical
- Evaluating a new feature direction for an existing project
- Assessing a partnership or platform opportunity
- Stress-testing a business idea before committing
- Finding competitive blind spots and underserved niches
- Any strategic question that benefits from deep evidence-based analysis

## Workflow Overview

7 phases, alternating between automated intelligence gathering and user-guided analysis:

| Phase | Name | Mode | Output |
|-------|------|------|--------|
| 1 | Briefing | Interactive | Research brief |
| 2 | Source Collection | Automated (parallel) | Source dossier |
| 3 | Unspoken Insights | Automated + checkpoint | Insight report |
| 4 | Fragile Assumptions | Automated + checkpoint | Assumption map |
| 5 | Investor Stress-Test | Automated + checkpoint | Stress-test results |
| 6 | Opportunity Mapping | Automated + checkpoint | Opportunity matrix |
| 7 | Action Plan & Save | Automated | Final research document |

---

## Phase 1: Briefing

Start by understanding what the user wants to research. This is an interactive conversation — ask questions until you have a clear research brief.

**Gather:**
1. **Target** — What market, industry, or opportunity? (e.g., "yacht brokerage SaaS", "AI flashcards for language teachers", "mobile reading apps")
2. **Angle** — What's the user's position? Entering as newcomer, expanding existing product, evaluating partnership?
3. **Known competitors** — Any specific companies or products the user already knows about?
4. **User-provided sources** — URLs, files, documents the user wants included? Accept any format.
5. **Specific questions** — Anything particular the user wants answered beyond the standard framework?

**Project context:** If the research relates to an existing project the user is working on, ask about the current product, tech stack, and strategic position. This grounds the analysis in real context rather than hypotheticals.

**Output a research brief** before proceeding:
```
Research Brief:
- Target: [market/opportunity]
- Angle: [newcomer / existing player / evaluator]
- Known competitors: [list]
- User sources: [list of URLs/files]
- Key questions: [specific questions beyond standard framework]
- Project context: [if applicable, key facts about the user's product]
```

Ask user to confirm before proceeding to Phase 2.

---

## Phase 2: Source Collection

This is the intelligence-gathering phase. Launch parallel subagents to collect diverse source material via Exa MCP. The quality of analysis depends on the quality and diversity of sources.

### What to gather

Launch 4-6 parallel `general-purpose` subagents, each focused on a different source type. All subagents should use Exa MCP tools (`mcp__exa__web_search_exa`, `mcp__exa__crawling_exa`, `mcp__exa__deep_researcher_start`).

**Subagent 1: Competitor Intelligence**
Search for and crawl 5-8 competitor landing pages, product pages, and pricing pages. Extract: value propositions, positioning, pricing models, feature lists, target audience language.

**Subagent 2: Customer Voice**
Search Reddit, forums, review sites (G2, Trustpilot, Product Hunt, App Store reviews) for customer complaints, praise, and unmet needs in this market. Extract: recurring pain points, feature requests, emotional language, switching triggers.

**Subagent 3: Industry Analysis**
Search for industry reports, expert analysis, trend pieces, and earnings call transcripts. Use `deep_researcher_start` with `exa-research-pro` for comprehensive coverage. Extract: market size, growth trends, key players, regulatory landscape, technology shifts.

**Subagent 4: Adjacent & Emerging**
Search for startups entering this space, adjacent markets that could expand into it, and emerging technologies that could disrupt it. Extract: new entrants, pivot signals, technology trends, funding patterns.

**Subagent 5: User-Provided Sources** (if any)
Crawl all URLs the user provided using `mcp__exa__crawling_exa`. Extract full content.

### Subagent prompt template

Read `references/gatherer-prompt.md` for the detailed prompt template to use for each subagent. Each subagent receives:
- The research brief from Phase 1
- Its specific focus area
- Instructions to return structured, evidence-rich findings

### After collection

Compile all subagent results into a **Source Dossier** — a structured document with all collected evidence organized by source type. Present a summary to the user:

```
Source Dossier Summary:
- X competitor pages analyzed
- X customer reviews/complaints collected
- X industry reports found
- X emerging players identified
- X user-provided sources crawled
Key themes so far: [2-3 sentences]
```

Ask: "Sources collected. Anything you want me to search for specifically before we start analysis? Or should I proceed?"

---

## Phase 3: Unspoken Insights

The first analytical question — the one that separates this from generic "market analysis":

> "Based on all collected evidence: What does every successful player in this market understand that their customers never say out loud?"

This question works because it forces the analysis past surface-level features and pricing into the deeper truths that drive the market. The insights customers can't articulate are the ones that create defensible advantages.

**Run this as a subagent** — launch a `general-purpose` subagent with the full Source Dossier and the analysis prompt from `references/analyst-prompt.md` (Section: Unspoken Insights).

**Present findings** to the user as 3-5 numbered insights, each with:
- The insight itself (one clear sentence)
- Evidence from sources (specific quotes, data points)
- Why this matters strategically

**Checkpoint:** "Here are the unspoken insights I found. Do any of these surprise you? Want me to dig deeper on any of them, or should we move to fragile assumptions?"

---

## Phase 4: Fragile Assumptions

The second power question:

> "What are the 3-5 assumptions this entire market is built on, and what would have to be true for each one to be wrong?"

This question maps the market's attack surface — the beliefs everyone takes for granted that could be upended. Every market has fragile consensus points, and finding them is how you find openings.

**Run as subagent** with Source Dossier + Phase 3 insights. Use prompt from `references/analyst-prompt.md` (Section: Fragile Assumptions).

**Present findings** as a structured assumption map:

For each assumption:
- **The assumption** (what everyone believes)
- **Evidence it's true** (why people believe this)
- **What breaks it** (specific conditions that would make it wrong)
- **Fragility score** (1-5: how likely is it to break in the next 2-3 years?)
- **If it breaks** (what happens to the market)

**Checkpoint:** "These are the fragile assumptions I found. Any you disagree with? Want to explore any further?"

---

## Phase 5: Investor Stress-Test

The third power question:

> "Write 5 questions a world-class investor would ask to destroy this business idea, then answer each one using only the evidence in our source dossier."

This is adversarial by design. The goal is to find every weak point before committing resources. A great investor's job is to find the fatal flaw — channel that mindset.

**Run as subagent** with Source Dossier + all prior analysis. Use prompt from `references/analyst-prompt.md` (Section: Investor Stress-Test).

**Present findings** as 5 numbered challenges:

For each:
- **The killer question** (phrased as an investor would ask it)
- **The evidence-based answer** (citing only our sources)
- **Confidence level** (strong / moderate / weak)
- **Remaining risk** (what the answer doesn't fully address)

### Iterative Deepening

For any answer rated "weak" confidence, automatically follow up:

> "What's the strongest version of this argument and where does it still break?"

Continue until all weak points are either resolved or clearly flagged as genuine risks. This iterative deepening is what separates a 3-hour research sprint from a surface-level analysis.

**Checkpoint:** "Here's the stress-test. X questions have strong answers, Y have remaining risks. Want to dig deeper on any of these?"

---

## Phase 6: Opportunity Mapping

Now synthesize everything into actionable opportunities:

> "Given all the unspoken insights, fragile assumptions, and blind spots we've found — what are the 3 highest-leverage entry points or strategic moves? For each, what's the evidence, what's the risk, and what would you need to validate first?"

**Run as subagent** with ALL prior analysis. Use prompt from `references/analyst-prompt.md` (Section: Opportunity Mapping).

**Present** as an opportunity matrix:

| Opportunity | Evidence | Risk | Validation Needed | Leverage (1-5) |
|-------------|----------|------|-------------------|----------------|
| ... | ... | ... | ... | ... |

**Checkpoint:** "These are the highest-leverage opportunities I see. Which ones resonate? Should I develop any of them into a concrete action plan?"

---

## Phase 7: Action Plan & Save

Based on user's selections from Phase 6, create a concrete action plan:

1. **Immediate next steps** (this week)
2. **Validation experiments** (this month)
3. **Strategic moves** (this quarter)

### Save the Document

Compile ALL phases into a single research document and save it.

Use this format:

```markdown
---
id: RESEARCH-YYYY-MM-DD-attack-surface-{slug}
created: YYYY-MM-DD
topic: Attack Surface Analysis — {Topic}
sources: [list of source types used]
tags: [attack-surface, market-research, {topic-tags}]
---

# Attack Surface: {Topic}

## Executive Summary
[3-5 bullet points with the most important findings]

## Research Brief
[From Phase 1]

## Source Dossier Summary
[From Phase 2 — source counts and key themes]

## Unspoken Insights
[From Phase 3]

## Fragile Assumptions
[From Phase 4 — the assumption map]

## Investor Stress-Test
[From Phase 5 — questions, answers, confidence levels]

## Opportunity Matrix
[From Phase 6]

## Action Plan
[From Phase 7]

## Raw Sources
[Links to all sources consulted]
```

Tell the user the file path and offer to discuss any findings further.

---

## Subagent Instructions

All subagents use the `general-purpose` subagent type via the Agent tool. Read the reference files for detailed prompt templates:

- `references/gatherer-prompt.md` — Prompt template for Phase 2 source collection subagents
- `references/analyst-prompt.md` — Prompt templates for Phases 3-6 analysis subagents

When launching subagents:
- Phase 2: Launch 4-6 gatherers **in parallel** (one Agent tool call per search focus)
- Phases 3-6: Launch **sequentially** (each builds on prior results)
- Always pass the full Source Dossier to analysis subagents
- Set `run_in_background: false` for analysis subagents (need results before proceeding)

### Token Budget

This skill launches 6-10 subagent calls total. Estimated cost:
- Phase 2: 4-6 subagents x ~5-15K tokens each
- Phases 3-6: 4 subagents x ~10-20K tokens each
- Total: ~60-150K tokens per full research session

---

## Common Mistakes

| Mistake | Fix |
|---------|-----|
| Skipping Phase 1 briefing | The research brief focuses everything — never skip |
| Generic Exa searches | Use specific, targeted queries from the research brief |
| Presenting analysis without evidence | Every insight must cite specific sources |
| Moving past weak stress-test answers | Always run iterative deepening on weak answers |
| Forgetting to save | Always save the final document at the end |
| Ignoring user-provided sources | Crawl them FIRST — the user chose them for a reason |

登录后下载/点赞/收藏 ❤ 10 | ★ 0

attack-surface

目录结构

SKILL.md

举报内容

提示